Use the raw request body bytes (as received) with HMAC-SHA256 and compare in constant time:

const crypto = require('crypto');

const rawBody = /* exact request bytes as string or Buffer */;
const expected = crypto.createHmac('sha256', SECRET).update(rawBody).digest('hex');
const header = req.headers['x-beamdesk-signature'] || '';
const provided = header.replace(/^sha256=/i, '');
if (provided.length !== expected.length) return false;
return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(provided));