Bolt.new via webhook

Bolt.new connects to RankPine via webhook. The setup adds a server function to your existing app and routes RankPine to the existing Webhook / REST integration. It is not a separate Bolt publishing protocol.

Before you start

• The app needs Bolt Database or a connected Supabase project with server/Edge Functions. A frontend-only site cannot protect the signing secret.
• Choose the article table and the public article route before asking Bolt to implement the receiver.
• Create a random RANKPINE_WEBHOOK_SECRET and keep it out of source code.

Bolt's official docs place server-function secrets under the database icon's Secrets section and publish public projects from the top-right Publish menu to a bolt.host or custom domain. Bolt also documents that third-party webhooks do not carry a Supabase JWT, so the receiving function needs its own signature verification. See Secrets, webhook authentication, and publishing.

1. Add the shared receiver

Download the RankPine receiver template into the server-function folder Bolt already uses. Its Web Request/Response API works in an Edge Function without a framework rewrite.

Implement its two adapter methods against the project's real data layer:

• upsertByRankPineId creates or updates by article.id and returns the same external ID and canonical URL on every retry.
• refreshSitemap updates, revalidates, or rebuilds the sitemap/content index owned by this Bolt app.

Copy-paste build instruction

Add RankPine publishing to this existing Bolt.new project via the existing webhook pattern. Do not replace, restyle, or restructure unrelated application code.

Create one public server/Edge Function called rankpine-webhook using https://rankpine.com/docs/templates/rankpine-webhook-receiver.ts. Read RANKPINE_WEBHOOK_SECRET from Bolt Database Secrets (or the connected Supabase Edge Function secrets), never from client code. Verify the HMAC over the exact raw bytes before parsing, enforce the five-minute freshness window, require matching X-RankPine-Event, and validate the payload.

Use the app's current database. Add only the smallest article schema change needed, with a unique RankPine article ID. Upsert title, slug, HTML, Markdown, meta description, language and translation metadata, sources, SEO metadata, featured image, inline images, publishedAt, and scheduledFor. Return stable { id, url } JSON. Update or invalidate the sitemap/content-discovery mechanism in the receiver adapter; this app owns that behavior.

This third-party webhook will not have a Supabase JWT. Disable JWT verification only for rankpine-webhook and keep mandatory RankPine HMAC verification in the function. Leave every other function's authentication unchanged. Report the exact deployed endpoint URL and all files/schema changed. Do not publish on my behalf.

2. Add the secret

1. Open the Bolt project and select the database icon.
2. Choose Secrets and create RANKPINE_WEBHOOK_SECRET.
3. If the project uses Supabase directly, add the same secret under Edge Functions → Secrets, then tell Bolt to refresh its connection.

Do not use a VITE_-prefixed variable: those values belong in browser code and are not suitable for a signing secret.

3. Publish and obtain the URL

Deploy the server function, then choose Publish → Publish for a public site or Publish → Update for an existing deployment. Copy the exact function URL from Bolt's function output. A Supabase-backed URL usually ends in /functions/v1/rankpine-webhook; a framework API route uses the public bolt.host/custom domain plus its route path.

Do not use a private Bolt deployment URL unless it explicitly allows unauthenticated server-to-server requests.

4. Connect in RankPine

1. Open Settings → Integrations → Website builders via webhook.
2. On Bolt.new, choose Connect via webhook.
3. Enter the deployed URL and the identical signing secret.
4. Keep both HTML and Markdown enabled, then connect.

RankPine immediately sends a signed verification event. A 401 usually means the secrets differ; a JWT/auth error means the function is still blocking the request before its HMAC check.

5. Verify a test article

Publish one test article and check the server-function log, database row, returned public URL, and live sitemap. Then update the same RankPine article and confirm the unique article.id row changes in place. Bolt preview success alone does not prove the published endpoint or production secret works.