code: private function validateSignature($signature, $payload, $secret)
      {
          if (empty($signature)) {
              return false;
          }
  
          $signature = current($signature);
  
          $explodeResult = explode('=', $signature, 2);
  
          if (2 !== count($explodeResult)) {
              return false;
          }
  
          list($algorithm, $hash) = $explodeResult;
  
          if (empty($algorithm) || empty($hash)) {
              return false;
          }
  
          if (!in_array($algorithm, hash_algos())) {
              return false;
          }
  
          $payloadHash = hash_hmac($algorithm, $payload, $secret);
  
          return $hash === $payloadHash;
      }
docs: @param string $signature
  @param string $payload
  @param string $secret
  
  @return bool