You built the blog. SiteSeed fills it.

import { createHmac, timingSafeEqual } from "node:crypto";// rawBody: the request body as text, before any JSON parsing.export function isFromSiteSeed(rawBody, timestamp, signature, secret = process.env.SITESEED_WEBHOOK_SECRET) {  if (!secret || !timestamp || !signature) return false;  // Signed more than 5 minutes ago: refuse it.  if (!(Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300)) return false;  const hmac = createHmac("sha256", secret).update(timestamp + "." + rawBody).digest("hex");  const given = Buffer.from(signature);  const wanted = Buffer.from("sha256=" + hmac);  return given.length === wanted.length && timingSafeEqual(given, wanted);}// Express: read this route's body raw, not as JSON.// app.post("/api/siteseed", express.raw({ type: "application/json" }), (req, res) => {//   const body = req.body.toString("utf8");//   if (!isFromSiteSeed(body, req.get("x-siteseed-timestamp"), req.get("x-siteseed-signature"))) {//     return res.status(401).end();//   }//   const { event, article } = JSON.parse(body);//   res.json({ ok: true });// });

import hashlibimport hmacimport osimport timedef is_from_siteseed(body: bytes, timestamp: str | None, signature: str | None) -> bool:    """body is the raw request body, before any JSON parsing."""    secret = os.environ.get("SITESEED_WEBHOOK_SECRET", "")    if not secret or not timestamp or not signature:        return False    try:        # Signed more than 5 minutes ago: refuse it.        if abs(time.time() - int(timestamp)) > 300:            return False    except ValueError:        return False    digest = hmac.new(secret.encode(), timestamp.encode() + b"." + body, hashlib.sha256).hexdigest()    return hmac.compare_digest(signature, "sha256=" + digest)# Flask:  is_from_siteseed(request.get_data(), request.headers.get("x-siteseed-timestamp"),#                          request.headers.get("x-siteseed-signature"))# Django: is_from_siteseed(request.body, request.headers.get("x-siteseed-timestamp"),#                          request.headers.get("x-siteseed-signature"))

<?php// Read the body raw: the signature covers the exact bytes.$body = file_get_contents('php://input');$timestamp = $_SERVER['HTTP_X_SITESEED_TIMESTAMP'] ?? '';$signature = $_SERVER['HTTP_X_SITESEED_SIGNATURE'] ?? '';$secret = (string) getenv('SITESEED_WEBHOOK_SECRET');function is_from_siteseed(string $body, string $timestamp, string $signature, string $secret): bool {    if ($secret === '' || $timestamp === '' || $signature === '') return false;    // Signed more than 5 minutes ago: refuse it.    if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) return false;    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $body, $secret);    return hash_equals($expected, $signature);}if (!is_from_siteseed($body, $timestamp, $signature, $secret)) {    http_response_code(401);    exit;}$payload = json_decode($body, true);// Save by $payload['article']['id'] on article.published; remove it on article.unpublished.header('Content-Type: application/json');echo json_encode(['ok' => true]);