Custom Site (Webhook)

import { createHmac, timingSafeEqual } from "node:crypto";
 
export async function POST(req: Request) {
  const raw = await req.text(); // raw body, before JSON.parse
  const expected = createHmac("sha256", process.env.SEOBOX_WEBHOOK_SECRET!)
    .update(raw)
    .digest("hex");
  const given = req.headers.get("x-seobox-signature") ?? "";
 
  if (
    given.length !== expected.length ||
    !timingSafeEqual(Buffer.from(given), Buffer.from(expected))
  ) {
    return Response.json({ error: "invalid signature" }, { status: 401 });
  }
 
  if (req.headers.get("x-seobox-event") !== "post.publish") {
    return Response.json({ ok: true }); // ignore events you don't handle
  }
 
  const post = JSON.parse(raw);
  // Upsert by slug into your CMS / database / MDX files:
  // await db.post.upsert({ where: { slug: post.slug }, create: {...}, update: {...} });
 
  return Response.json({
    id: post.slug,
    url: `https://example.com/blog/${post.slug}`,
  });
}

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";
 
const app = express();
 
// Use express.raw so the body stays byte-for-byte what SEObox signed.
app.post("/api/seobox", express.raw({ type: "application/json" }), async (req, res) => {
  const expected = createHmac("sha256", process.env.SEOBOX_WEBHOOK_SECRET)
    .update(req.body)
    .digest("hex");
  const given = req.get("x-seobox-signature") ?? "";
 
  if (
    given.length !== expected.length ||
    !timingSafeEqual(Buffer.from(given), Buffer.from(expected))
  ) {
    return res.status(401).json({ error: "invalid signature" });
  }
 
  const post = JSON.parse(req.body.toString("utf8"));
  // await savePost(post)  — upsert by post.slug
 
  res.json({ id: post.slug, url: `https://example.com/blog/${post.slug}` });
});
 
app.listen(3000);

<?php
$raw      = file_get_contents('php://input');
$secret   = getenv('SEOBOX_WEBHOOK_SECRET');
$expected = hash_hmac('sha256', $raw, $secret);
$given    = $_SERVER['HTTP_X_SEOBOX_SIGNATURE'] ?? '';
 
if (!hash_equals($expected, $given)) {
    http_response_code(401);
    echo json_encode(['error' => 'invalid signature']);
    exit;
}
 
$post = json_decode($raw, true);
// savePost($post);  — upsert by $post['slug']
 
header('Content-Type: application/json');
echo json_encode([
    'id'  => $post['slug'],
    'url' => 'https://example.com/blog/' . $post['slug'],
]);

import hmac, hashlib, json, os
from flask import Flask, request, jsonify
 
app = Flask(__name__)
SECRET = os.environ["SEOBOX_WEBHOOK_SECRET"].encode()
 
@app.post("/api/seobox")
def seobox():
    raw = request.get_data()  # raw bytes, before parsing
    expected = hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    given = request.headers.get("X-SEOBOX-Signature", "")
 
    if not hmac.compare_digest(expected, given):
        return jsonify(error="invalid signature"), 401
 
    post = json.loads(raw)
    # save_post(post)  — upsert by post["slug"]
 
    return jsonify(id=post["slug"], url=f"https://example.com/blog/{post['slug']}")