code: function verify_nylas_request(req) {
    const digest = crypto
      .createHmac('sha256', config.nylasClientSecret)
      .update(req.rawBody)
      .digest('hex');
    return digest === req.get('x-nylas-signature');
  }
docs: Each request made by Nylas includes an X-Nylas-Signature header. The header contains the HMAC-SHA256 signature of the request body, using your client secret as the signing key. This allows your app to verify that the notification really came from Nylas.