Connect Webhooks to Rankauto

Before you begin

Common real use cases:

• A custom-built site or static site generator (Next.js, Hugo, Jekyll)
• A CMS Rankauto doesn’t connect to natively yet
• Automation platforms — Zapier, Make.com, n8n
• Serverless functions — Vercel Functions, AWS Lambda, Cloudflare Workers
• Notification channels — post a Slack or Discord message whenever something publishes

Setting up your webhook

Connecting a webhook replaces any WordPress, Shopify, or Wix connection you have — Rankauto publishes to exactly one place at a time. Reconnecting later, even to the same URL, always generates a brand-new secret.

Authentication

Every webhook request is signed with HMAC-SHA256 over the raw JSON body, using the secret Rankauto generated for you. Rankauto doesn’t support an unsigned mode — every request can be verified. The signature is sent in two headers carrying the identical value, so you can read whichever your framework makes easier:

To verify: compute an HMAC-SHA256 hex digest of the exact raw request body using your stored secret, then compare it to the signature header using a constant-time comparison, not ===. Hashing a re-serialized copy of the body (after your framework has already parsed it into an object) will produce a different digest and always fail — hash the raw bytes you actually received.

Code example

Node.js — signature verification

const crypto = require('crypto');

function verifyRankautoSignature(rawBody, signatureHeader, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader, 'hex'),
    Buffer.from(expected, 'hex')
  );
}

app.post('/api/rankauto-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-rankauto-signature'];
  const secret = process.env.RANKAUTO_WEBHOOK_SECRET;

  if (!signature || !verifyRankautoSignature(req.body, signature, secret)) {
    return res.status(401).json({ message: 'Invalid signature' });
  }

  const article = JSON.parse(req.body);

  if (article.test) {
    return res.status(200).json({ message: 'Test received' });
  }

  // Your real publish logic here.

  res.status(200).json({ message: 'Received' });
});

Payload structure

Rankauto sends a JSON body shaped like this on every real publish or republish:

{
  "title": "How to Build Backlinks for Better SEO",
  "content_html": "<h1>How to Build Backlinks...</h1><p>...</p>",
  "content_markdown": "# How to Build Backlinks...\n\n...",
  "slug": "how-to-build-backlinks-for-better-seo",
  "meta_description": "Learn proven strategies to build high-quality backlinks...",
  "status": "published",
  "featured_image": "https://.../featured.jpg",
  "published_url": null,
  "published_at": "2026-09-23T15:03:15.416Z",
  "is_republish": false,
  "test": false
}

Delivery & reliability

Honest, real behavior — read this before relying on webhooks for anything critical:

• A delivery attempt times out after 15 seconds.
• There is no automatic retry. If your endpoint is down, returns an error, or times out, that one delivery is lost — Rankauto logs it (visible on the connection page as “Last delivery: failed …”) but doesn’t queue or retry it. The article is still genuinely published on Rankauto’s own side either way.
• Unpublishing an article never triggers a webhook — only a real publish or republish does.
• Only one webhook URL can be connected per site at a time.

Troubleshooting

Frequently asked questions

Other integrations

Set up Rankauto on another platform.