code: public static boolean isValidSignature(String requestBody, String signatureHeader,
              String webhookEndpointSecret) {
          String computedSignature =
                  new HmacUtils(HmacAlgorithms.HMAC_SHA_256, webhookEndpointSecret)
                          .hmacHex(requestBody);
          return MessageDigest.isEqual(signatureHeader.getBytes(), computedSignature.getBytes());
      }
docs: Validates that a webhook was genuinely sent by GoCardless by computing its
  signature using the body and your webhook endpoint secret, and comparing that with
  the signature included in the `Webhook-Signature` header.
  
  @param requestBody the request body
  @param signatureHeader the signature included in the request, found in the
  `Webhook-Signature` header
  @param webhookEndpointSecret the webhook endpoint secret for your webhook endpoint,
  as configured in your GoCardless Dashboard
  @return whether the webhook's signature is valid