Facebook Call back deletion URL for Instagram basic API

Question

i have problem when following the documentation , Facebook says that "Unable to confirm request was received" while the code is getting the signed_request and the app secret is correct

 public function parse_signed_request($signed_request)
    {
        list($encoded_sig, $payload) = explode('.', $signed_request, 2);

        $secret = env('PERSONAL_INSTAGRAM_SECRET');

        // decode the data
        $sig = $this->base64_url_decode($encoded_sig);

        $data = ($this->base64_url_decode($payload));

        // confirm the signature
        $expected_sig = hash_hmac('SHA256', $payload, $secret, $raw = true);

        if ($sig !== $expected_sig) {
            error_log('Bad Signed JSON signature!');
            return null;
        }

        return $data;
    }

and the $sig is always not equal the $expected_sig

i tried encoding and decoding the input and trying the JWT decoder online , the header is correct and the data of payload is correct