Shelf, inside the tools your team already uses.

{
  "id": "0d6f6c2e-9a0b-4c57-8f1e-2f6a1f0f7b11",
  "type": "movements",
  "test": false,
  "sentAt": "<the moment it was sent, ISO 8601>",
  "read": { "build": "<the read's reference>", "fromMs": 1791244800000, "toMs": 1791504000000, "label": "<the read, in words>" },
  "brands": ["your-brand", "a-rival"],
  "count": 2,
  "atLeast": false,
  "movements": [
    {
      "kind": "price_down",
      "label": "Price cut",
      "platform": "blinkit",
      "sku": "123456",
      "name": "Product name 100 g",
      "brand": "a-rival",
      "city": "Pune",
      "storeId": null,
      "fromPricePaise": 6000,
      "toPricePaise": 5600,
      "stores": 41,
      "storesOutOf": 60,
      "cities": null,
      "readAtMs": 1791417600000,
      "line": "Price cut: Product name 100 g ₹60 to ₹56 on blinkit (Pune, 41 of 60 stores)"
    }
  ],
  "more": 0,
  "links": { "changes": "https://seetheshelf.com/feed", "alerts": "https://seetheshelf.com/alerts" }
}

import crypto from 'node:crypto';

// rawBody: the request body exactly as it arrived (a string or a Buffer), before any JSON parsing
export function isFromShelf(rawBody, header, secret) {
  const m = /^t=(\d+),v1=([a-f0-9]{64})$/.exec(header || '');
  if (!m) return false;
  // refuse a post that is more than five minutes old: it may be a replay
  if (Math.abs(Date.now() / 1000 - Number(m[1])) > 300) return false;
  const expected = crypto.createHmac('sha256', secret).update(m[1] + '.' + rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(m[2]));
}

// isFromShelf(body, request.headers['x-shelf-signature'], process.env.SHELF_WEBHOOK_SECRET)

import hashlib, hmac, re, time

def is_from_shelf(raw_body: bytes, header: str, secret: str) -> bool:
    m = re.fullmatch(r"t=(\d+),v1=([a-f0-9]{64})", header or "")
    if not m:
        return False
    if abs(time.time() - int(m.group(1))) > 300:  # more than five minutes old: may be a replay
        return False
    signed = m.group(1).encode() + b"." + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, m.group(2))