Webhook signature never matches

You verify a payment provider's webhook signature like this, using the correct secret, but verification always fails. Why?

app.post('/webhooks/pay', express.json(), (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex')
  if (expected !== req.get('X-Signature')) return res.sendStatus(400)
  // ...
})