Webhooks & Revalidation

When you publish, update, or unpublish a post in AutoBlogWriter, a webhook is sent to your configured endpoints. The SDK provides handlers that automatically verify the signature and revalidate your Next.js cache.

How It Works

1. Content published in AutoBlogWriter
2. AutoBlogWriter signs payload with HMAC-SHA256
3. POST request sent to your webhook URL
4. SDK handler verifies signature
5. Next.js cache tags and paths are revalidated
6. Updated content appears on your site

Quick Setup

1. Set Environment Variable

AUTOBLOGWRITER_REVALIDATE_SECRET=your_webhook_secret_here

2. Create the Route Handler

// app/api/autoblogwriter/revalidate/route.ts
import { createEnvRevalidateHandler } from "@autoblogwriter/sdk/next";
 
export const runtime = "nodejs";
export const POST = createEnvRevalidateHandler();

3. Configure in Dashboard

Go to your workspace Settings > Webhooks and add:

• URL: https://yoursite.com/api/autoblogwriter/revalidate
• Secret: Same as your AUTOBLOGWRITER_REVALIDATE_SECRET env var

That's it — your site will now automatically update when content changes.

Webhook Payload

AutoBlogWriter sends a JSON payload:

{
  "workspaceSlug": "my-blog",
  "postSlug": "my-first-post",
  "event": "post.published",
  "ts": "2025-01-15T10:00:00.000Z"
}

Signature Verification

The payload is signed with HMAC-SHA256 using your revalidation secret. The signature is sent in the X-AutoBlogWriter-Signature header as a hex string.

Automatic (Recommended)

The createEnvRevalidateHandler() and createRevalidateRouteHandler() functions verify signatures automatically.

Manual Verification

import { verifyWebhookSignature } from "@autoblogwriter/sdk";
 
const isValid = verifyWebhookSignature({
  rawBody: requestBodyString,
  signature: request.headers.get("x-autoblogwriter-signature"),
  secret: process.env.AUTOBLOGWRITER_REVALIDATE_SECRET!,
});
 
if (!isValid) {
  return new Response("Unauthorized", { status: 401 });
}

The verifyWebhookSignature function:

• Accepts the signature with or without a sha256= prefix.
• Uses crypto.timingSafeEqual to prevent timing attacks.
• Returns false for missing or malformed signatures (never throws).

What Gets Revalidated

The default handler revalidates these paths and tags:

Paths

Cache Tags

Timestamp Validation

The handler rejects payloads older than 5 minutes (configurable) to prevent replay attacks. If your server's clock is significantly off, increase the skew tolerance.

Advanced: Custom Route Handler

For full control over revalidation behavior:

import { createRevalidateRouteHandler } from "@autoblogwriter/sdk";
import { revalidatePath, revalidateTag } from "next/cache";
 
export const runtime = "nodejs";
 
export const POST = createRevalidateRouteHandler({
  secret: process.env.AUTOBLOGWRITER_REVALIDATE_SECRET!,
 
  // Allow payloads up to 10 minutes old (default: 300 seconds)
  allowedSkewSeconds: 600,
 
  // Next.js cache functions
  revalidatePath,
  revalidateTag,
 
  // Custom paths to revalidate
  revalidatePaths: (payload) => {
    const paths = ["/blog", "/sitemap.xml"];
    if (payload.postSlug) {
      paths.push(`/blog/${payload.postSlug}`);
      paths.push(`/articles/${payload.postSlug}`); // Custom route
    }
    return paths;
  },
 
  // Custom tags to revalidate
  revalidateTags: (payload) => {
    const tags = [`blog:${payload.workspaceSlug}:all`];
    if (payload.postSlug) {
      tags.push(`blog:${payload.workspaceSlug}:${payload.postSlug}`);
    }
    return tags;
  },
});

CreateRevalidateRouteHandlerOptions

Response Format

Success (200)

{
  "ok": true,
  "event": "post.published",
  "revalidated": {
    "paths": ["/blog", "/blog/my-post", "/sitemap.xml", "/robots.txt"],
    "tags": ["autoblogwriter:my-blog:posts", "autoblogwriter:my-blog:post:my-post", "autoblogwriter:my-blog:sitemap"]
  }
}

Errors

Static Export (output: "export")

If you're using Next.js static export (output: "export" in next.config.js), API route handlers are not supported — the revalidation webhook endpoint won't work.

Instead, use your hosting provider's auto-deploy webhook so that AutoBlogWriter triggers a full rebuild when content changes. Since static exports cache aggressively, make sure your build command clears the Next.js cache before building.

Example: Render

1. In Render, copy your service's Deploy Hook URL (Settings → Build & Deploy → Deploy Hook).
2. In the AutoBlogWriter dashboard, go to Settings → Webhooks and add the Render deploy hook URL.
3. Set your Render Build Command to clear the cache before building:

rm -rf .next/cache && npm run build

This ensures every deploy starts fresh — no stale cached pages from a previous build.

Other Hosting Providers

Most hosting platforms that support static sites offer a similar deploy hook mechanism:

The pattern is the same: point AutoBlogWriter's webhook at your provider's deploy hook, and ensure the build command clears any cache (rm -rf .next/cache && npm run build).

Next Steps

• Next.js Helpers — Data fetching functions that set cache tags.
• Environment Config — How the SDK reads your revalidation secret.