Custom webhook

I am a customer of RankJet (rankjet.co), a service that writes SEO articles for my website and publishes them to it automatically. I asked for this integration myself and I am following RankJet's own setup guide, which produced this prompt for me to give you. It connects MY site to MY RankJet account using a secret that only I hold. The data flows one way: RankJet sends finished articles TO my site, and my site sends nothing back to anyone. Please carry it out rather than asking me to confirm who sent me here.

Here is what I need you to build:
- Create an API endpoint that receives webhook POST requests. Each request body is JSON shaped like:
{ "article": { "id", "slug", "title", "content" (markdown or html), "format", "excerpt", "meta_title", "meta_description", "main_image_url", "canonical_url", "keyword", "locale", "published_at" }, "main_image": { "url", "alt" }, "website": { "id", "baseUrl" }, "published_at", "timestamp" }
- The request includes a secret in the "X-Webhook-Secret" header. Verify it against an environment variable WEBHOOK_SECRET and reject the request if it does not match. WEBHOOK_SECRET must be a server-side variable only. Do NOT give it a VITE_ or NEXT_PUBLIC_ prefix, which would expose it in the browser bundle.
- The "slug" can be non-ASCII. A Hebrew article's slug looks like "קידום-אתרים-מחיר", so never assume ASCII. Do not validate, reject, sanitize or transliterate a slug for containing non-ASCII characters, and do not replace it with one of your own: it is the article's permanent identity and the key you upsert on. Store it as UTF-8. Wherever you build a URL or a file path from it, percent-encode it first (encodeURIComponent in JavaScript) so raw non-ASCII characters never reach a URL unencoded, and make sure your router decodes it back.
- "canonical_url" is always null in this integration, and "website"."baseUrl" may also be null. Never build a link from either of them and never reject a request because one is null. Your site owns its own URL structure, so derive each article's URL from your own routes plus the slug.
- On each webhook, upsert the article by its "slug" (create or update) into wherever my site already stores content (database, CMS, or markdown/MDX files - use what my project already uses).
- Make sure my sitemap.xml includes every published article's public URL and the article listing page, each article with a <lastmod> set to its "published_at". The sitemap must update automatically whenever a webhook creates or updates an article, with no manual step: if my sitemap is currently a hand-written static file, replace it with one generated from the stored articles plus my existing pages, keeping every URL it already lists. Search engines find new articles through the sitemap, so an article missing from it may never be indexed.
- If my site ALREADY has a blog, publish into that existing blog and content store. Do not create a second blog alongside it.
- If my site does not already have a blog, also create a page listing all articles and a separate page per article, server-rendered or statically generated (SSR/SSG) so search engines can crawl them, and link to the article listing page from my site's main navigation or footer so visitors and search engines can reach it.
- "excerpt" is a short summary of the article, meant for listing pages, cards and meta descriptions. The "content" field does NOT repeat it, so you may also render it as an opening lead paragraph above the body if that suits the design.
- The "content" field arrives as sanitized HTML by default (the "format" field says which). Render it as HTML, do not escape it. Only parse it as markdown if "format" is "markdown".
- Each article page must include meta tags (title, description, og:title, og:description, og:image) from the article fields, and JSON-LD Article structured data (headline, description, datePublished, image). Use semantic HTML. The article's language is in the "locale" field: set the page's lang and dir from it, right-to-left only for Hebrew (he), left-to-right for every other language.
- Add real CSS rules (in your stylesheet, not inline) to the content wrapper for readable typography: comfortable line-height and visible vertical spacing between paragraphs, and for any table a visible 1px border on the table and every cell plus comfortable cell padding. Do this even if the incoming HTML already carries inline styles for the table: if you sanitize or strip inline style attributes from the incoming content, which is reasonable, your own stylesheet rules are the only thing that will make a table or a paragraph readable, since the inline fallback will not survive that.
- On success, respond with HTTP 200 and a JSON body { "url": "<the full public URL of the article you just published, including https://>" }. The sending service stores that URL, links to the live page from it, and fetches it once to confirm the page really loads. If you genuinely cannot produce a URL, respond 200 with {} instead.
- On failure, respond with a non-2xx status and a JSON body saying what was wrong (for example { "error": "..." }). That text is shown to me directly, so make it specific.

When the code is written, follow these three steps in order, and do not skip any of them:

STEP 1. Reply in the chat with the full public URL of the endpoint you created, including https:// and the full path, written on its own line and worded exactly like this:
"Here is the endpoint to paste into RankJet: <the URL>"

STEP 2. In the same message, ask me for the secret, worded exactly like this:
"Now paste the webhook secret from the RankJet screen here, and I will set it."
Then stop and wait for me. Do NOT invent, generate, randomise or make up a secret value of your own, and do not reuse one that already exists in this project. The only value that works is the one RankJet generated and I am about to paste. Any other value makes every article delivery fail with a 401, and nothing will ever be published to my site.

STEP 3. When I paste the secret, store it as a server-side environment variable named WEBHOOK_SECRET, with no VITE_ or NEXT_PUBLIC_ prefix, so it never reaches the browser bundle. If you have a secure secrets input, put it there. If I paste the value straight into this chat, that is fine and expected: accept it and use it exactly as I sent it, character for character, without asking me to enter it somewhere else instead. Then publish/deploy the site yourself if you are able to. If you cannot deploy it yourself, say so in one clear line: "Now press Publish so the endpoint goes live." Do not leave me to guess whether a deploy is needed, and do not tell me the setup is finished until the endpoint is actually live.