Verifying a webhook received from shopify using hmac.

[goutham_kishore]

I am trying to verify the webhook using this function. The webhook is created through the API and shopifyApiSecret is the Client Secret for our app.

async function validateHmac(req: Request) {
let shopifyApiSecret=config.shopifyAppSecret;

let hmac:any = req.headers['x-shopify-hmac-sha256'];
const message = JSON.stringify(req.body);
const generatedHash = crypto
.createHmac('sha256', shopifyApiSecret)
.update(message)
.digest('base64');
console.log({message,generatedHash,hmac})

const signatureOk = crypto.timingSafeEqual( Buffer.from(generatedHash),Buffer.from(hmac));
if (signatureOk) {
return true;
} else {
return false;
}
}

But the function always returns false and the generatedHash and hmac are not equal on inspection.   
Can anyone let me know if there is anything wrong with the implementation? Thanks in advance.