API

Cache revalidation

Let Reblog tell your site to drop an article from its cache the moment it is published, edited, renamed, unpublished or deleted. One endpoint on your side, one secret, and stale articles stop happening.

If your site renders Reblog articles statically or with ISR, it keeps each rendered page until a later render succeeds. That one rule is the whole problem: when an article is deleted or renamed, the Content API starts answering 404 for its old handle, the render fails, and your site goes on serving the page it already had. Forever.

How it works#

You add one route to your site and set a shared secret. Reblog calls it whenever an article is published, edited, renamed, unpublished or deleted, with the exact list of paths that changed, and your site purges them. Delivery is on our side: a call your site refuses or misses is retried for an hour, so a deploy or an outage never loses a purge.

Setup#

1. 1

   Copy your secret

   Open your project, go to Integrations > Cache revalidation. It is already on and the signing secret is already there: reveal it and press copy. There is nothing to enable, nothing to invent and nothing to email around.

2. 2

   Add the route to your site

   Create app/api/reblog/revalidate/route.ts with the handler below, and set the copied value as REBLOG_REVALIDATE_SECRET in your hosting environment (on Vercel: Project Settings, Environment Variables). Deploy.

3. 3

   Press Save and send test

   Back in Integrations. A green result means the round trip works. From then on every publish, edit, rename, unpublish and delete purges itself.

The route handler#

Eleven lines, and there is no package to install. Every call carries your secret in its Authorization header, so checking that header is the whole of it:

import { revalidatePath } from 'next/cache'

export async function POST(req: Request) {
  if (req.headers.get('authorization') !== `Bearer ${process.env.REBLOG_REVALIDATE_SECRET}`) {
    return new Response('Unauthorized', { status: 401 })
  }

  const { paths = [] } = await req.json()
  for (const path of paths) revalidatePath(path)

  return Response.json({ revalidated: paths.length })
}

The signed version, checking the HMAC and rejecting replays. This is the exact code running on reblog.so's own blog, which reads the Content API the same way your site does. Copy it as it is.

import crypto from 'crypto'
import { NextResponse } from 'next/server'
import { revalidatePath, revalidateTag } from 'next/cache'

const MAX_SIGNATURE_AGE_SECONDS = 300

const timingSafeEqual = (a: string, b: string) => {
  const bufA = Buffer.from(String(a))
  const bufB = Buffer.from(String(b))
  if (bufA.length !== bufB.length) return false
  return crypto.timingSafeEqual(bufA, bufB)
}

const isAuthorized = (request: Request, rawBody: string, secret: string) => {
  const bearer = (request.headers.get('authorization') || '').replace(/^Bearer\s+/i, '')
  if (bearer && timingSafeEqual(bearer, secret)) return true

  const signature = request.headers.get('x-reblog-signature') || ''
  const timestamp = request.headers.get('x-reblog-timestamp') || ''
  if (!signature || !timestamp) return false

  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp))
  if (!Number.isFinite(age) || age > MAX_SIGNATURE_AGE_SECONDS) return false

  const expected =
    'sha256=' + crypto.createHmac('sha256', secret).update(`${timestamp}.${rawBody}`).digest('hex')
  return timingSafeEqual(signature, expected)
}

export async function POST(request: Request) {
  const secret = process.env.REBLOG_REVALIDATE_SECRET
  if (!secret) {
    return NextResponse.json({ error: 'REBLOG_REVALIDATE_SECRET is not configured' }, { status: 503 })
  }

  const rawBody = await request.text()
  if (!isAuthorized(request, rawBody, secret)) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const payload = JSON.parse(rawBody || '{}')
  if (payload.event === 'ping') {
    return NextResponse.json({ ok: true, event: 'ping', revalidated: [] })
  }

  const revalidated: string[] = []
  const listings = new Set<string>()

  for (const path of payload.paths || []) {
    if (typeof path !== 'string' || !path.startsWith('/')) continue
    // A literal path takes no `type` argument: that one is for route patterns
    // like '/blog/[slug]' and would not match this cache entry.
    revalidatePath(path)
    revalidated.push(path)
    // '/blog/how-to-x' also changes '/blog': the listing shows the article.
    const parent = path.split('/').slice(0, -1).join('/')
    if (parent) listings.add(parent)
  }
  for (const listing of listings) {
    revalidatePath(listing)
    revalidated.push(listing)
  }
  for (const tag of payload.tags || []) {
    if (typeof tag === 'string' && tag) revalidateTag(tag)
  }

  return NextResponse.json({ ok: true, event: payload.event || null, revalidated })
}

What Reblog sends#

{
  "event": "article.updated",
  "project_id": "7906b84e",
  "article_id": "665f0c2b9d1e4a0012ab34cd",
  "lang": "EN",
  "status": "published",
  "handles": ["blog/new-name", "blog/old-name"],
  "paths": ["/blog/new-name", "/blog/old-name"],
  "tags": ["reblog:article:blog/new-name", "reblog:project:7906b84e"],
  "removed_handles": ["blog/old-name"],
  "sent_at": "2026-09-07T10:00:00.000Z"
}

handles and paths include the article's linked translations, and, on a rename, the handle the article was moved away from. Purging every path in the list is always the correct behaviour.

Checking that it works#

• Save and send test on the Integrations screen sends a ping and shows the HTTP status your site answered. A 401 means the two secrets differ; a 404 means the route is not deployed yet.
• Rename a published article, then load its old URL. It should stop serving the article within seconds.
• The Integrations screen lists the recent deliveries with their event, handles and response code, so you can see exactly what your site was told and when.
• Connected an AI agent over MCP? It can run the same checks: get_revalidation_status reports the recent deliveries and whether an article is still owed a purge, and revalidate_article re-sends one (or, with no article, the test ping).

When Reblog stays quiet#

• You switched cache revalidation off for the project, the project has no site URL, or the secret was pinned to an environment variable that is not set.
• The change only touched a draft. A draft was never on your site, so there is nothing to purge.
• The very first check for a project, which only records a starting point rather than purging your whole library at once.