When writing a Slack integration or app, Slack's servers will make requests to your web service. In order to verify the integrity and authenticity of requests from Slack, the body of each request is signed, and the signature is included in the request headers. The X-Slack-Signature header field contains an HMAC-SHA256 keyed hash of the request body.
If you're using Node.js, here's a way to verify the requests.
If you're using Express then you may be using body-parser to reformat the request body as JSON when applicable. In that case, a verify function will need to be passed so that it can save the raw body before processing. Here's an example: