Integrations

1. 1Message @BotFather and create a bot (/newbot), copy the token.
2. 2Message @userinfobot to find your chat_id.
3. 3Under Integrations → Telegram, paste the token and the chat_id.
4. 4Send anything to your bot (otherwise Telegram won't let it send the first message).

On your server: Channel settings → Integrations → Webhooks → New webhook, copy the URL and paste it under Integrations. Alerts arrive as messages in the chosen channel.

System notifications that work even with the tab closed. Each device (laptop, Android phone) is connected separately with the “Enable on this device” button; the device list, with its own test and removal, lives in the same popup.

You give your own HTTPS address and every monitor hit arrives as a POST with JSON (Content-Type: application/json). The body always has the same shape — fields we don't know for a given offer arrive as null:

{
  "title": "iPhone 13 Pro 256GB",
  "url": "https://vinted.pl/items/123456",
  "marketplace": "vinted",
  "price": "2 000 PLN",
  "image": "https://images.vinted.net/...jpg",
  "hidden": false,
  "monitorId": "8f3c1e2a-…-uuid",
  "seller": {
    "login": "ola_vinted",
    "country": "Polska",
    "countryFlag": "🇵🇱",
    "city": "Warszawa",
    "feedbackCount": 123,
    "feedbackReputation": 0.98,
    "photoUrl": "https://images.vinted.net/avatar.jpg"
  }
}

1. 1title, url, marketplace — always present.
2. 2price — a formatted string (e.g. “2 000 PLN”) or null.
3. 3image — thumbnail URL or null.
4. 4hidden — true when we found the offer by id-probing and it may be invisible in the marketplace's public search.
5. 5monitorId — UUID of the monitor that caught the offer (for routing on your side).
6. 6seller — the seller's details; Vinted only today, null elsewhere. feedbackReputation is a 0–1 fraction (0.98 = 98%).

Optional signing key: once you set one, every request carries an x-snipeit-signature: sha256=<hex> header, where hex = HMAC-SHA256(key, raw body). Compute the same on your side and compare — that confirms the request came from us and the body wasn't altered.

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody, header, secret) {
  const expected =
    "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header ?? "");
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Email: the simplest channel — you give an address and receive alerts by email with a link to the offer.