# RankOrg - Publishing Integrations

Configure where generated SEO articles go live: RankOrg-hosted domains, your own domain, WordPress, or signed webhooks.

## Publishing destinations

Every RankOrg site publishes to one destination. The canonical URL points at that destination so the same article does not compete with itself across domains.

- **Hosted subdomain** (e.g. `yourname.rankgt.com`): The fastest path — a RankOrg-hosted blog on a *.rankgt.com subdomain with automatic TLS. Live in seconds, no DNS changes.
- **Custom domain** (e.g. `blog.yourdomain.com`): Point a subdomain at RankOrg with a single CNAME. RankOrg issues TLS automatically and sets the canonical URL to your domain so there's no duplicate indexing.
- **Proxy subpath** (e.g. `yourdomain.com/blog/*`): Serve the blog under a path on your existing root domain (e.g. /blog) via a reverse proxy, so the content ranks on your primary domain's authority.

## WordPress integration

Publish generated articles straight into a self-hosted or WordPress.com site via the WordPress REST API. RankOrg creates each post with status 'publish'.

- Connect fields:
  - `siteUrl`: Your WordPress site URL, e.g. https://mysite.com.
  - `username`: A WordPress user with permission to publish posts.
  - `appPassword`: A WordPress Application Password (Users → Profile → Application Passwords). Not your login password.
- Auth: HTTP Basic (username + application password), sent to /wp-json/wp/v2/posts.
- Credentials are verified against /wp-json/wp/v2/users/me at connect time and stored encrypted.

## Webhooks

RankOrg POSTs a signed JSON event to your endpoint every time an article publishes, so you can sync content into any CMS, cache, or pipeline.

- Event: `article.published` (version 2026-06-09)
- Request headers:
  - `X-RankOrg-Event`: The event type, e.g. article.published.
  - `X-RankOrg-Delivery`: Unique delivery id (matches payload.id).
  - `X-RankOrg-Timestamp`: Unix seconds when the request was signed.
  - `X-RankOrg-Signature`: sha256=<hex HMAC> — see verification below.
- Signature: HMAC-SHA256 over the string `{timestamp}.{rawRequestBody}` using your webhook secret (whsec_…). Recompute it and compare in constant time; reject if it doesn't match or the timestamp is stale.
- Delivery: Up to 3 attempts. Retried on HTTP 408, 425, 429, or any 5xx; a 2xx marks the delivery successful.

Example `article.published` payload:

```json
{
  "id": "evt_...",
  "version": "2026-06-09",
  "event": "article.published",
  "createdAt": "2026-07-03T09:00:00.000Z",
  "site": {
    "id": "site_...",
    "name": "Acme Blog",
    "slug": "acme",
    "canonicalHost": "blog.acme.com",
    "blogUrl": "https://blog.acme.com/blog"
  },
  "article": {
    "id": "art_...",
    "title": "…",
    "slug": "my-post",
    "url": "https://blog.acme.com/blog/my-post",
    "canonicalUrl": "https://blog.acme.com/blog/my-post",
    "metaDescription": "…",
    "contentHtml": "<h1>…</h1>",
    "heroImage": "https://…",
    "keywords": ["…"],
    "status": "published",
    "publishAt": "2026-07-03T09:00:00.000Z",
    "publishedAt": "2026-07-03T09:00:00.000Z"
  }
}
```

## Public web endpoints

- `/llms.txt` - AI discovery file — what RankOrg is, its pages, tools, and this API.
- `/robots.txt` - Crawler directives, including AI crawler access.
- `/sitemap.xml` - Full URL index for search engines.
- `/index.md` - Markdown twin of the homepage for AI answer engines.

## Related docs

- Developer docs: https://rankorg.com/docs
- MCP for AI agents: https://rankorg.com/docs/mcp