Rebuild your site with webhooks

Add a webhook

1. 1 Open API keys and find the Webhooks section.
2. 2 Give it a name and the URL to call — for example a Netlify or Vercel build hook.
3. 3 Save it. Mojimoto shows a signing secret once; copy it somewhere safe.

What gets sent

On publish, Mojimoto POSTs a JSON payload describing the event and the affected document. Every request carries an X-Mojimoto-Signature header — an HMAC of the body using your signing secret — so your receiver can prove the request is genuine before acting on it.

Verify the signature

Compute the same HMAC over the raw request body and compare it, in constant time, to the header. Reject anything that does not match.

import crypto from 'node:crypto';

function verify(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  );
}