Webhook reference

import { createHmac, timingSafeEqual } from "node:crypto";

export async function POST(request: Request) {
  const raw = await request.text(); // the raw body, not re-serialized JSON
  const sent = request.headers.get("x-contentautopilot-signature") ?? "";
  const expected = createHmac("sha256", process.env.SEOVYN_WEBHOOK_SECRET!).update(raw).digest("hex");

  const a = Buffer.from(sent);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !timingSafeEqual(a, b)) {
    return new Response("Bad signature", { status: 401 });
  }

  const { event, data } = JSON.parse(raw);
  // Save or update the page identified by data.slug.
  return new Response("ok");
}

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const app = express();

// express.raw keeps the exact bytes: the signature covers the body as sent.
app.post("/api/content-webhook", express.raw({ type: "application/json" }), (req, res) => {
  const sent = req.get("x-contentautopilot-signature") ?? "";
  const expected = createHmac("sha256", process.env.SEOVYN_WEBHOOK_SECRET).update(req.body).digest("hex");

  const a = Buffer.from(sent);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !timingSafeEqual(a, b)) return res.status(401).send("Bad signature");

  const { event, data } = JSON.parse(req.body.toString("utf8"));
  // Save or update the page identified by data.slug.
  res.send("ok");
});

import hashlib
import hmac
import json
import os

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["SEOVYN_WEBHOOK_SECRET"].encode()


@app.post("/api/content-webhook")
def content_webhook():
    raw = request.get_data()  # the raw body, before any JSON parsing
    sent = request.headers.get("x-contentautopilot-signature", "")
    expected = hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sent, expected):
        abort(401)

    payload = json.loads(raw)
    # Save or update the page identified by payload["data"]["slug"].
    return "ok"