One minimal-API endpoint — signed articles arrive as JSON.
ASP.NET Core renders the blog; DraftSEO delivers the posts. The recipe is a MapPost minimal-API endpoint in Program.cs — a StreamReader over req.Body gives you the raw body, HMACSHA256 plus CryptographicOperations.FixedTimeEquals verify it, and you store the post. No extra packages: System.Security.Cryptography ships with .NET.
| Connection | A minimal-API endpoint — MapPost in Program.cs, recipe provided |
|---|---|
| Security | HMAC-signed + timestamped — FixedTimeEquals over ${timestamp}.${rawBody}, replay-window protected |
| Payload | Full article JSON — title, HTML, images, meta, slug, language |
| Images | DraftSEO CDN URLs — URLs ride in the payload; rehost to your own storage if you prefer |
| Framework fit | Minimal API or MVC — same check works in a controller action too |
Who does what
Paste the MapPost endpoint, verify the HMAC over the raw body a StreamReader gives you, then save the post with EF Core. After the green test, zero effort per article.
Your DbContext and Razor views stay entirely yours.
Setup
Connect a site → ASP.NET Core. You get a signing secret and the minimal-API recipe.
~1 minute
Paste the MapPost handler into Program.cs, read the raw body, verify the signature with FixedTimeEquals and store the post.
~10 minutes
DraftSEO sends a signed test event; a green check confirms the connection.
~1 minute
Every generated article is delivered to your endpoint on cadence.
Ongoing · zero clicks
FAQ
A JSON body { event, deliveryId, data } — data holds the title, HTML article, slug, language, meta fields and image URLs, which JsonDocument.Parse (or your DTO) reads directly.
Each request is HMAC-signed over ${timestamp}.${rawBody} with a timestamp header; you recompute it with HMACSHA256 and compare using CryptographicOperations.FixedTimeEquals, rejecting anything past the 5-minute replay window.
Either. The recipe uses a MapPost minimal-API endpoint, but the identical signature check drops into an MVC controller action — read the raw request body first, verify, then bind the parsed payload.
No card required. Signed test delivery in under a minute.