code: private boolean validateSignature(Credentials credentials, String secretKey) {
          String clientSignature = credentials.getSignature();
          String serverSignature = createSignature(credentials, secretKey);
          return MessageDigest.isEqual(clientSignature.getBytes(), serverSignature.getBytes());
      }
docs: Validate the signature on the request by generating a new signature here and making sure
  they match. The only way for them to match is if both signature are generated using the
  same secret key. If they match, this means that the requester has a valid secret key and
  can be a trusted source.
  
  @param credentials the credentials specified on the request
  @param secretKey the secret key that will be used to generate the signature
  @return true if the signature is valid