Webhooks in SvelteKit

Point the webhook at this route. The payload fields are documented in Webhooks.

// src/routes/api/cosmic/+server.ts
import { json } from '@sveltejs/kit';

export async function POST({ request }) {
  const secret = request.headers.get('x-webhook-secret');
  if (secret !== process.env.COSMIC_WEBHOOK_SECRET) {
    return json({ error: 'unauthorized' }, { status: 401 });
  }

  const payload = await request.json();
  if (payload.resource === 'objects' && payload.event === 'published') {
    // Rebuild or revalidate the page for payload.data.object.slug.
  }

  return json({ ok: true });
}

Set the same header name and value in Bucket Settings > Webhooks. Store the expected value in COSMIC_WEBHOOK_SECRET, not in client code.

FAQ

What does Cosmic POST?

JSON with resource, event, triggered_at, and data. Create the webhook in Bucket Settings > Webhooks.

How do I reject a forged request?

Set a custom header on the webhook and compare it to a server environment variable before doing any work.

How much does Cosmic cost?

Project plans are Free ($0), Builder ($99/mo), Team ($299/mo), Business ($499/mo), Enterprise (custom pricing). Yearly billing saves 10%. Workspace plans are Small Workspace ($999/mo) and Large Workspace ($2,999/mo), and they start with a 30-day free trial. Allowances, add-on rates, and the rest of the pricing FAQ are plain text at https://www.cosmicjs.com/pricing.md.

Are API keys required, and is content private?

Each Bucket has a read key and a write key in Bucket Settings > API Access. GET requests use the read key. POST, PATCH, and DELETE use the write key as Authorization: Bearer. Do not put the write key in a browser bundle, a mobile app, or a NEXT_PUBLIC_ variable. SAML single sign-on is on Large Workspace and Enterprise. The audit log is append-only. Text versions: https://www.cosmicjs.com/security.md and https://www.cosmicjs.com/docs/dashboard/audit-log.md.

Can an agent create a Cosmic project without an existing account?

Yes. POST https://dapi.cosmicjs.com/v3/agents/sign-up provisions a free-tier project and bucket tied to a human email, with no existing Cosmic account. The human claims it with the emailed one-time code. The playbook is https://www.cosmicjs.com/docs/ai-onboarding.md.