code: public static boolean isSignatureValid(String payload, String signature, String appSecret) {
          try {
              final Mac mac = Mac.getInstance(HMAC_SHA1);
              mac.init(new SecretKeySpec(appSecret.getBytes(), HMAC_SHA1));
              final byte[] rawHmac = mac.doFinal(payload.getBytes());
  
              final String expected = signature.substring(5);
              final String actual = bytesToHexString(rawHmac);
  
              return expected.equals(actual);
          } catch (NoSuchAlgorithmException | InvalidKeyException e) {
              throw new RuntimeException(e);
          }
      }
docs: Verifies the provided signature of the payload.
  
  @param payload   the request body {@code JSON payload}
  @param signature the SHA1 signature of the request payload
  @param appSecret the {@code Application Secret} of the Facebook App
  @return {@code true} if the verification was successful, otherwise {@code false}