Default version of signature in new project is 4. But your code knew nothing about version 4 and use md5 for it, so verification is failed. https://github.com/paymentwall/paymentwall-node/blob/a9f2870c732cd536a7a8f3a10cd40cf2548d0f8e/lib/Signature/Pingback.js#L24