Webhooks

{
  "id": "evt_5f1c0b2a9d7e4c3b8a6f0e1d",
  "type": "changes",
  "createdAt": "2026-10-07T09:12:31Z",
  "changes": [
    {
      "id": 812,
      "kind": "CHANGED",
      "observedAt": "2026-10-06T21:03:00Z",
      "price": 1399.0,
      "previousPrice": 1499.0,
      "changes": { "price": [1499.0, 1399.0] },
      "item": { "id": 77, "title": "Lenovo ThinkPad X1 Carbon Gen 12", "url": "https://…", "currency": "EUR" }
    }
  ],
  "cursor": 812
}

import hashlib, hmac, os, time


def verify(body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = [p.split("=", 1) for p in header.split(",") if "=" in p]
    t = next((v for k, v in parts if k == "t"), None)
    signatures = [v.encode() for k, v in parts if k == "v1"]
    # isascii: "²".isdigit() is true, int("²") fails
    if t is None or not (t.isascii() and t.isdigit()) or abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), t.encode() + b"." + body, hashlib.sha256).hexdigest().encode()
    # bytes, not str: compare_digest refuses str with other than ASCII characters
    return any(hmac.compare_digest(expected, s) for s in signatures)


# Flask
from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["PRICANA_WEBHOOK_SECRET"]


@app.post("/pricana")
def pricana():
    if not verify(request.get_data(), request.headers.get("Pricana-Signature", ""), SECRET):
        abort(400)
    event = request.get_json()
    for change in event["changes"]:
        ...  # queue it; skip change ids you already have
    return "", 204

import crypto from 'node:crypto'
import express from 'express'

export function verify(body, header, secret, tolerance = 300) {
  const parts = header.split(',').map((p) => p.split('='))
  const t = parts.find(([k]) => k === 't')?.[1]
  const signatures = parts.filter(([k]) => k === 'v1').map(([, v]) => v)
  if (!t || !/^\d+$/.test(t) || Math.abs(Date.now() / 1000 - Number(t)) > tolerance) return false
  const expected = crypto.createHmac('sha256', secret).update(`${t}.`).update(body).digest('hex')
  const want = Buffer.from(expected)
  // the same number of bytes, not just characters: timingSafeEqual throws otherwise
  return signatures.some((s) => {
    const got = Buffer.from(s)
    return got.length === want.length && crypto.timingSafeEqual(got, want)
  })
}

const app = express()
// the raw body: parsing JSON first would change the bytes that were signed
app.post('/pricana', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verify(req.body, req.get('Pricana-Signature') ?? '', process.env.PRICANA_WEBHOOK_SECRET)) {
    return res.sendStatus(400)
  }
  const event = JSON.parse(req.body.toString('utf8'))
  for (const change of event.changes) {
    // queue it; skip change ids you already have
  }
  res.sendStatus(204)
})
app.listen(3000)

<?php
function pricana_verify(string $body, string $header, string $secret, int $tolerance = 300): bool
{
    $t = null;
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        [$k, $v] = array_pad(explode('=', $part, 2), 2, '');
        if ($k === 't') $t = $v;
        if ($k === 'v1') $signatures[] = $v;
    }
    if ($t === null || !ctype_digit($t) || abs(time() - (int) $t) > $tolerance) return false;
    $expected = hash_hmac('sha256', $t . '.' . $body, $secret);
    foreach ($signatures as $s) {
        if (hash_equals($expected, $s)) return true;
    }
    return false;
}

$body = file_get_contents('php://input');
if (!pricana_verify($body, $_SERVER['HTTP_PRICANA_SIGNATURE'] ?? '', getenv('PRICANA_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit;
}
$event = json_decode($body, true);
foreach ($event['changes'] as $change) {
    // queue it; skip change ids you already have
}
http_response_code(204);

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.ArrayList;
import java.util.HexFormat;
import java.util.List;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public final class PricanaSignature {

    /** body: the request body exactly as received, as UTF-8 text. */
    public static boolean verify(String body, String header, String secret) throws Exception {
        String t = null;
        List<String> signatures = new ArrayList<>();
        for (String part : header.split(",")) {
            String[] kv = part.split("=", 2);
            if (kv.length == 2 && kv[0].equals("t")) t = kv[1];
            if (kv.length == 2 && kv[0].equals("v1")) signatures.add(kv[1]);
        }
        if (t == null || !t.matches("\\d+") || Math.abs(Instant.now().getEpochSecond() - Long.parseLong(t)) > 300) {
            return false;
        }
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] expected = HexFormat.of()
            .formatHex(mac.doFinal((t + "." + body).getBytes(StandardCharsets.UTF_8)))
            .getBytes(StandardCharsets.UTF_8);
        for (String s : signatures) {
            if (MessageDigest.isEqual(expected, s.getBytes(StandardCharsets.UTF_8))) return true;
        }
        return false;
    }
}