express.js

app.use('/api/notification', function(req, res, next) {
  req.hmac = crypto.createHmac('sha256', APP_SECRET);

  req.on('data', function(chunk) {
    req.hmac.update(chunk);
  });

  req.on('end', function() {
    let signGiven = req.get('X-Dropbox-Signature');
    let signComputed = req.hmac.digest('hex');
    if(signGiven !== signComputed) {
      log.warn('Dropbox Webhook Signature Fail');
      res.sendStatus(403);
      res.end();
    } else {
      log.info('Dropbox Webhook Signature verified');
    }
  });
  next();
});