Use the following code example to validate callback in your handler.
const crypto = require("crypto");
const express = require("express");
const bodyParser = require("body-parser");

const callbackSecret = "YOUR_CALLBACK_SECRET"; // put here your callback secret

const app = express();

app.use(bodyParser.json());

// signature validation middleware
app.use((req, res, next) => {
  const timestamp = req.header('x-timestamp');
  const signature = req.header('x-signature');

  const signatureCheck = crypto
    .createHmac('sha256', callbackSecret)
    .update(timestamp + JSON.stringify(req.body))
    .digest('hex');

  if (signature !== signatureCheck) {
    return res.status(401).send();
  }

  next();
});

app.post('/callback', (req, res, next) => {
  // handle callback
  console.log(req.body);

  res.send('OK');
});

app.listen(3000);