node.js - GitHub Webhook Secret Never Validates -

i'm using github webhook pipe events application of mine (an instance of github's hubot) , secured sha1 secret.

i'm using following code validate hashes on incoming webhooks

crypto    = require('crypto') signature = "sha1=" + crypto.createhmac('sha1', process.env.hubot_github_secret).update( new buffer request.body ).digest('hex') unless request.headers['x-hub-signature'] signature   response.send "signature not valid"   return 

the x-hub-signature header passed through in webhook looks this

x-hub-signature: sha1=1cffc5d4c77a3f696ecd9c19dbc2575d22ffebd4

i passing in key , data accurately per github's documentation, hash ends different.

here github's documentation. https://developer.github.com/v3/repos/hooks/#example

and section misinterpreting

secret: optional string that’s passed http requests x-hub-signature header. value of header computed hmac hex digest of body, using secret key.

can see i'm going wrong?

seems not work buffer, json.stringify(); here's working code:

var   hmac,   calculatedsignature,   payload = req.body;  hmac = crypto.createhmac('sha1', config.github.secret); hmac.update(json.stringify(payload)); calculatedsignature = 'sha1=' + hmac.digest('hex');  if (req.headers['x-hub-signature'] === calculatedsignature) {   console.log('all good'); } else {   console.log('not good'); }