Drop in one route handler — articles arrive as signed JSON.
Next.js owns the rendering; DraftSEO owns the pipeline. Every publish POSTs a signed delivery to a route handler in app/webhook/route.ts — req.text() hands you the raw body for the HMAC check, you upsert the post, and your own pages render it. The recipe is copy-paste; crypto is built into Node so there is nothing to install.
| Connection | A route handler — app/webhook/route.ts, recipe provided |
|---|---|
| Security | HMAC-signed + timestamped — verified over ${timestamp}.${rawBody}, replay-window protected |
| Payload | Full article JSON — title, HTML, images, meta, slug, language |
| Images | DraftSEO CDN URLs — URLs ride in the payload; rehost to your own storage if you prefer |
| Framework fit | SSG / ISR friendly — call revalidatePath/revalidateTag when a delivery lands |
Who does what
Paste the route handler, verify the HMAC over ${timestamp}.${rawBody}, store the post and render it from your own pages. After the green test delivery: zero minutes per article.
You keep total control of components, routing and caching.
Setup
Connect a site → Next.js. You get a signing secret and the App Router receiver recipe.
~1 minute
Drop it into app/webhook/route.ts, verify the signature and timestamp, then upsert the post — the recipe shows every line.
~10 minutes
DraftSEO fires a signed test event at your endpoint; a green check means you are connected.
~1 minute
Every generated article arrives at your route handler on schedule.
Ongoing · zero clicks
FAQ
A JSON body { event, deliveryId, data } — data carries the title, the article as HTML, the slug, language, meta title/description and image URLs. Everything a Next.js page needs to render and index the post.
Each request carries an HMAC signature over ${timestamp}.${rawBody} plus an X-DraftSEO-Timestamp header; you recompute it from the raw body req.text() gives you and reject anything outside the 5-minute replay window.
Yes — the receiver is a normal route handler, so after you store a post call revalidatePath or revalidateTag for its route and the new page is served without a redeploy.
No card required. Signed test delivery in under a minute.