One http.HandlerFunc — signed articles arrive on net/http.
Your Go service owns the rendering; DraftSEO delivers the content. The recipe is a plain http.HandlerFunc registered with http.HandleFunc — io.ReadAll pulls the raw body, crypto/hmac and crypto/sha256 verify the signature with hmac.Equal, and you store the post. Everything is standard library, so there is no framework to adopt.
| Connection | An http.HandlerFunc — net/http, no framework, recipe provided |
|---|---|
| Security | HMAC-signed + timestamped — hmac.Equal over ${timestamp}.${rawBody}, replay-window protected |
| Payload | Full article JSON — title, HTML, images, meta, slug, language |
| Images | DraftSEO CDN URLs — URLs ride in the payload; rehost to your own storage if you prefer |
| Framework fit | net/http only — crypto/hmac + crypto/sha256 from the standard library |
Who does what
Register the handler with http.HandleFunc, verify the HMAC over the body io.ReadAll returns, then write the post to your store. After the green test, zero effort per article.
Your router, your DB driver, your templates — untouched.
Setup
Connect a site → Go. You get a signing secret and the net/http receiver recipe.
~1 minute
Register /webhook with http.HandleFunc, read the raw body, verify the signature with hmac.Equal and store the post.
~10 minutes
DraftSEO sends a signed test event; a green check confirms the connection.
~1 minute
Every generated article is delivered to your handler on cadence.
Ongoing · zero clicks
FAQ
A JSON body { event, deliveryId, data } — data holds the title, HTML article, slug, language, meta fields and image URLs, which json.Unmarshal decodes into your struct or a map.
Each request is HMAC-signed over ${timestamp}.${rawBody} with a timestamp header; you recompute it with crypto/hmac + crypto/sha256 and compare using hmac.Equal, rejecting anything past the 5-minute replay window.
None — the recipe is net/http with crypto/hmac and crypto/sha256 from the standard library. If you use Gin, Echo or Chi, drop the same verification into your handler; the receiver is framework-agnostic.
No card required. Signed test delivery in under a minute.