shopifyhook.js

var crypto = require('crypto'),
    secret = 'OUR_APP_SHARED_SECRET',
    message = req.rawBody.toString('utf8'),
    digest = crypto.createHmac('SHA256', secret)
              .update(new Buffer(message, 'utf8'))
              .digest('base64');
              
console.log(digest == req.headers['X-Shopify-Hmac-Sha256']);
// true

Technically, line #5 doesn't need to be a Buffer for crypto to hash your message, but it is required when • unicode characters are in the req.body payload. Otherwise, the digest will not match the provided hmac hash from Shopify.