verify_signature.go

func verifySignature(payload []byte, secret, receivedSignature string) (bool, error) {
	signature, err := computeSignature(payload, secret)
	if err != nil {
		return false, err
	}

	return signature == receivedSignature, nil
}

func computeSignature(payload []byte, secret string) (string, error) {
	h := hmac.New(sha256.New, []byte(secret))

	_, err := h.Write(payload)
	if err != nil {
		return "", err
	}

	return "sha256=" + base64.StdEncoding.EncodeToString(h.Sum(nil)), nil
}