One Axum handler — signed articles arrive as raw Bytes.
Your Axum service owns the rendering; DraftSEO delivers the content. The recipe is an async handler that takes a Bytes body extractor — those are the exact request bytes for the HMAC — and verifies it with mac.verify_slice before parsing serde_json. It leans on hmac, sha2 and hex, the standard Rust crates for this.
| Connection | An Axum handler — router.route("/webhook", post(...)), recipe provided |
|---|---|
| Security | HMAC-signed + timestamped — verify_slice over ${timestamp}.${rawBody}, replay-window protected |
| Payload | Full article JSON — title, HTML, images, meta, slug, language |
| Images | DraftSEO CDN URLs — URLs ride in the payload; rehost to your own storage if you prefer |
| Framework fit | hmac + sha2 + hex crates — the Bytes extractor preserves the exact bytes for signing |
Who does what
Add the async handler with a Bytes extractor, verify the HMAC with verify_slice, then persist the post with your DB crate. After the green test, zero effort per article.
Your sqlx, your templates, your router — unchanged.
Setup
Connect a site → Rust (Axum). You get a signing secret and the handler recipe.
~1 minute
Add the hmac, sha2 and hex crates, route /webhook to the handler, take a Bytes body, verify the signature and store the post.
~10 minutes
DraftSEO sends a signed test event; a green check confirms the connection.
~1 minute
Every generated article is delivered to your Axum handler on cadence.
Ongoing · zero clicks
FAQ
A JSON body { event, deliveryId, data } — data holds the title, HTML article, slug, language, meta fields and image URLs, which serde_json decodes into a Value or your own struct.
Each request is HMAC-signed over ${timestamp}.${rawBody} with a timestamp header; you feed the raw Bytes into Hmac<Sha256> and verify with mac.verify_slice on the hex-decoded header, rejecting anything past the 5-minute window.
hmac and sha2 for the signature, hex to decode the header, serde_json to parse the body — plus axum and tokio for the server. All are shown in the recipe Cargo.toml.
No card required. Signed test delivery in under a minute.