Are you using Express for as your web server, and are you using middleware such as body-parser to properly handle the body of incoming requests?
If it is Express that you’re using then you need to ensure you use body-parser or else req.body will be undefined.
Here’s an example of how to use body parser to both make the body of webhook notifications be assigned to req.body, and also perform the verification step.
const bodyParser = require('body-parser');
const crypto = require('crypto');
const verifyNotice = (req, res, buf, encoding) => {
const expected = req.headers['x-hub-signature'];
const calculated = 'sha256=' + crypto.createHmac('sha256', webhookSecret).update(buf).digest('hex');
req.verified = expected === calculated;
};
app.use(bodyParser.json({ verify: verifyNotice }));