Webhooks

Pagekit POSTs to your endpoint when content changes.

Events

post.created
post.updated
post.published
post.unpublished
post.deleted

Payload

{
  "event": "post.published",
  "data": { "id": "post_123", "slug": "building-ai-agents" },
  "createdAt": "2026-09-14T10:00:00.000Z"
}

Verifying the signature

Every request carries x-pagekit-event and an HMAC-SHA256 signature of the raw body in x-pagekit-signature, keyed with the webhook secret.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(rawBody: string, signature: string, secret: string) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Typical use

Pagekit → webhook → Vercel / Netlify → revalidate