Your own endpoint

If your site is not one of the platforms QuQi already publishes to, you can have it send each finished article to an address of your own instead. The card is called Webhook and sits under Publishing, described as posting article data to any endpoint — enough to drive a custom stack of your own. Your code decides what happens to the article after that. Like every publishing destination, it takes your one publishing slot.

What you need

Neither of the two boxes comes from a third-party account. Both are things you decide.

• An endpoint URL — any web address you control that accepts a POST. Leave the https:// off and it is added for you, and a trailing slash is dropped.
• A signing secret, if you want one — any string you choose, up to 255 characters. Leave the box empty and one is generated for you, so a signature is always sent either way.
• The address has to be reachable from the public internet. An address on the machine itself, on a private network, or a name that does not resolve is refused before anything leaves QuQi, with “That endpoint URL is not a reachable public address.”

Connect it

What QuQi sends

Every message is a POST with a JSON body. Two headers tell you what you are looking at: X-Quqi-Event says ping for a test and article.published for a real article, and X-Quqi-Signature carries an HMAC-SHA256 of the exact body you received, keyed with your secret.

What your endpoint has to do

• Answer a test ping with a success response. Anything else and connecting is refused, and you are told which status number came back.
• Answer within 15 seconds at connect time, and within 30 seconds when an article is sent.
• Keep redirects short if you use them — up to three hops are followed, and every hop has to be a public address too.
• Reply to a published article however you like. A success response with no body at all still counts as published.
• If you reply with JSON holding a url, that is stored as the article’s link in QuQi. An id in the same reply is kept as your own reference for it.

The article payload

Ids are 36-character strings, not numbers. content is HTML, ready to drop into a page — there is no separate Markdown field. cover_image, excerpt, meta_title, meta_description and keyword can each come back empty, so treat them as optional.

{
  "event": "article.published",
  "article": {
    "id": "9f1c2a7e-4b30-4c11-9a6d-2f5c8e1b7d04",
    "title": "How to keep a sourdough starter alive",
    "slug": "how-to-keep-a-sourdough-starter-alive",
    "excerpt": "A starter only needs three things…",
    "content": "<h2>Feeding<\/h2><p>A starter only needs…<\/p>",
    "cover_image": "https:\/\/cdn.quqi.io\/covers\/sourdough.jpg",
    "meta_title": "How to keep a sourdough starter alive",
    "meta_description": "Feed it, watch it, and know when it is done.",
    "keyword": "sourdough starter care",
    "word_count": 1480,
    "published_at": "2026-08-25T09:06:44+00:00"
  },
  "website": {
    "id": "3b7e5d10-8c22-4f91-b0a4-1d6e2c9f7a55",
    "domain": "example.com",
    "name": "Example Bakery"
  }
}

Proving the message came from QuQi

X-Quqi-Signature is an HMAC-SHA256 of the exact bytes you received, keyed with your signing secret, written as lowercase hex. Compute it over the raw body before you parse the JSON — re-serialising first changes the bytes and the signature will never match.

The test ping is signed the same way, so one code path verifies both.

import crypto from "crypto";

\/\/ the signature covers the RAW body — parse only after checking it
app.post("\/hooks\/quqi", express.raw({ type: "application\/json" }), (req, res) => {
  const expected = crypto
    .createHmac("sha256", process.env.QUQI_WEBHOOK_SECRET)
    .update(req.body)
    .digest("hex");

  const sent = req.get("X-Quqi-Signature") || "";
  if (sent.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(sent), Buffer.from(expected))) {
    return res.sendStatus(401);
  }

  const body = JSON.parse(req.body);
  if (body.event === "ping") return res.sendStatus(200);

  \/\/ same event whether it is the first send or an edit: match, then upsert
  const a = body.article;
  upsertPostById(a.id, a);

  res.json({ url: `https:\/\/example.com\/blog\/${a.slug}` });
});

When you edit an article

QuQi sends one article event, article.published, and it sends it every time. Edit an article and press send again and your endpoint receives the same event with the new text — there is no separate update event and no flag marking it as an edit.

That means your endpoint decides. Match on id — it is generated once and never changes, even if the title does — and update the post you already have instead of adding a second one. The slug is stable too, so it works as a key if that suits your storage better.

Checking it worked

One destination at a time

A website publishes to exactly one place. While WordPress, Ghost, Webflow, Shopify or another destination is connected, the Webhook card carries a lock and an “in use” note instead of a Set up button, and connecting anyway is refused until you disconnect that one first. If a site somehow ends up with both, the purpose-built destination is the one an agent publishes to.

Disconnecting asks you to confirm, then simply forgets the address — there is nothing to revoke at your end, and QuQi never reads anything from your endpoint beyond its answer to each message.