One Express route — every article lands as signed JSON.
Your Express app renders the blog; DraftSEO feeds it. The recipe mounts express.raw() on the route so the exact request bytes survive for the HMAC check — sign a parsed body and it 401s — then you verify with the built-in crypto module and store the post. No SDK, no lock-in to any Node framework.
| Connection | An Express route — POST /webhook with express.raw(), recipe provided |
|---|---|
| Security | HMAC-signed + timestamped — crypto.timingSafeEqual, replay-window protected |
| Payload | Full article JSON — title, HTML, images, meta, slug, language |
| Images | DraftSEO CDN URLs — URLs ride in the payload; rehost to your own storage if you prefer |
| Framework fit | Any Express app — express.raw() captures the exact bytes for signing |
Who does what
Mount express.raw() on the route, recompute the HMAC over the raw buffer, then persist and render the post however your app does. Past the green test, nothing more per article.
Middleware, ORM and views stay entirely yours.
Setup
Connect a site → Node.js. You get a signing secret and the Express receiver recipe.
~1 minute
Add express.raw() to /webhook, verify the signature over the raw bytes, then save the post — the recipe covers each step.
~10 minutes
DraftSEO sends a signed test event; a green check confirms the handshake.
~1 minute
Every generated article is delivered to your Express route on cadence.
Ongoing · zero clicks
FAQ
A JSON envelope { event, deliveryId, data } — data holds the title, HTML body, slug, language, meta fields and image URLs, so your route can insert a complete post in one write.
Each request is HMAC-signed over ${timestamp}.${rawBody} with a matching timestamp header; you verify it with crypto.timingSafeEqual and reject anything older than the 5-minute window.
The signature is computed over the exact request bytes, so the body must not be pre-parsed to JSON. express.raw() on the webhook route hands you the untouched buffer — parse it yourself only after the HMAC check passes.
No card required. Signed test delivery in under a minute.