Webhook

{
  "event": "article.published",                          // one of the three events below
  "sentAt": "2026-10-10T05:20:00.000Z",
  "deliveryId": "0b6f6c0e-6d1c-4c62-9a57-3f1f0d0f7a11",  // same on every retry
  "site": {
    "id": "site_8f3a2c",
    "name": "Acme"
  },
  "article": {
    "id": "art_5d21e9",                                  // never changes: your key
    "status": "published",                               // or "unpublished", or "test"
    "slug": "shared-inbox-for-small-teams",              // last part of the page address
    "title": "Shared Inbox for Small Teams",
    "description": "How to pick a shared inbox.",        // meta description
    "html": "<p>A shared inbox lets a team…</p>",        // null when unpublished
    "image": "https://cdn.example.com/cover.png",        // cover image, or null
    "imageAlt": "A team sharing one inbox",
    "author": "Jane Doe",                                // from the Writing tab, or null
    "keywords": ["shared inbox", "team email"],          // main keyword first
    "language": "en",
    "wordCount": 1480,
    "readingTime": 7,                                    // minutes
    "publishedAt": 1791619200,                           // Unix seconds
    "updatedAt": 1791619200                              // Unix seconds
  }
}

import { createHmac, timingSafeEqual } from "node:crypto";

export const runtime = "nodejs";
export const dynamic = "force-dynamic";

// The signing secret SiteSeed showed once when you connected the webhook.
const SECRET = process.env.SITESEED_WEBHOOK_SECRET ?? "";

type Article = {
  id: string; status: string; slug: string; title: string;
  description: string | null; html: string | null;
  image: string | null; imageAlt: string | null; author: string | null;
  keywords: string[]; language: string | null;
  wordCount: number | null; readingTime: number | null;
  publishedAt: number | null; updatedAt: number | null;
};

// Replace these two with your own storage.
// Store by article.id, so an update replaces its page.
async function savePost(article: Article) {
  // await db.post.upsert({ where: { siteseedId: article.id }, ... })
}
async function removePost(articleId: string) {
  // await db.post.deleteMany({ where: { siteseedId: articleId } })
}

function isFromSiteSeed(body: string, timestamp: string | null, signature: string | null) {
  if (!SECRET || !timestamp || !signature) return false;
  // Signed more than 5 minutes ago: refuse it.
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const hmac = createHmac("sha256", SECRET).update(timestamp + "." + body).digest("hex");
  const given = Buffer.from(signature);
  const wanted = Buffer.from("sha256=" + hmac);
  return given.length === wanted.length && timingSafeEqual(given, wanted);
}

export async function POST(request: Request) {
  // Read the body as text: the signature covers the exact bytes.
  const body = await request.text();
  const timestamp = request.headers.get("x-siteseed-timestamp");
  const signature = request.headers.get("x-siteseed-signature");
  if (!isFromSiteSeed(body, timestamp, signature)) {
    return Response.json({ error: "invalid signature" }, { status: 401 });
  }

  const { event, article } = JSON.parse(body) as { event: string; article: Article };
  if (event === "article.published") await savePost(article);
  if (event === "article.unpublished") await removePost(article.id);

  // Any 2xx confirms it. A test (integration.test) lands here and stores nothing.
  return Response.json({ ok: true });
}