I’m doing an integration of my app with Lemonsqueezy and use webhook to get data about subscriptions. I use everything from LS official guides, however I receive invalid x-signature used to validate that the webhook has LS origin every time.

Here is my code, does anyone have a clue of what’s going wrong?

app.post('/lemonsqueezy-webhook', express.json(), (req, res) => {
    try {
        const secret = 'THIS IS MY SECRET';
        const hmac = crypto.createHmac('sha256', secret);
        const expectedSignature = Buffer.from(hmac.update(JSON.stringify(req.body)).digest('hex'), 'utf8');
        const signature = Buffer.from(req.headers['x-signature'] || '', 'utf8');
        console.log('signature:', signature.toString());
        console.log('expectedSignature:', expectedSignature.toString());
        if (!signature.equals(expectedSignature)) {
            console.error('Invalid signature received:', signature);
            res.status(401).send('Invalid signature');
            return; // Ensure no further processing or response sending occurs
        } else {
            console.log('Valid signature confirmed:', signature);
        }
    } catch (error) {
        console.error('Error in signature verification:', error);
        res.status(500).send('Server error');
        return;
    }

    const data = req.body;
    // Check if the event is for a new subscription
    if (data.meta.event_name === 'subscription_created') {
        console.log(`New subscription created for user: ${data.data.attributes.user_email}, Subscription ID: ${data.data.id}`);
    }
    // Respond to LemonSqueezy to acknowledge receipt of the webhook
    res.status(200).send('Webhook received');
});

I tried every option from official ls guidelines, cursor.sh and perplexity suggested me — nothing worked. Every time it gives invalid x signature and tells me that it doesn’t compare right with the expected one. But i’ve 10 times checked that the codes are the same in my app and LS. One thing i see is that the LS webhook list has different server time (?) from my local time. Maybe it has something to do with it… IDK