Verify signature webhook - hash_hmac sha256

webhook.php

<?php

$webhook = fopen('php://input', 'rb');
$webhook_content = "";
while (!feof($webhook)) {
   $webhook_content .= fread($webhook, 4096);
}
fclose($webhook);
$webhook_data = json_decode($webhook_content, true);
$signature = $webhook_data["signature"];
unset($webhook_data["signature"]);

$object = MODEL::where('id', 'x')->first();
//Chave privada interna da api que envia o webhook
$private_key = $object ? $object->private_key : null;

//conecta todos os items do post body via implode
$to_hash = implode("#", $webhook_data);
$my_hash = hash_hmac("sha256", $to_hash, $private_key);
if($my_hash === $signature) {
  //DO THE ACTION
}