Developer guide

Webhooks

Get notified when content is published or a message arrives.

Available on Pro and Business. Add an https:// URL in Webhooks and choose events:

post.published, project.published, report.published, contact.received

Each delivery is a POST with a JSON body and the header:

text

X-CMSAF-Signature: t=1761400000,v1=<hex HMAC-SHA256 of "t.body">

Verify it with the secret shown when you created the webhook, and reject requests older than 5 minutes.

import crypto from "node:crypto";
export function verify(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const mac = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(v1));
}

Answer with any 2xx within 8 seconds. Use it to rebuild pages, e.g. call Next.js revalidatePath.