Syndicate endpoint: Support multiple methods of supplying a token

docs/.vitepress/theme/custom.css

@@ -41,8 +41,8 @@
   --vp-c-indigo-darker: hsl(var(--indigo-h-s) 10%);
   --vp-c-indigo-soft: hsl(var(--indigo-h-s) 10% / 0.75);
 
-  --vp-c-divider-light-1: hsl(var(--neutral-h-s) 50% / 0.25);
-  --vp-c-divider-light-2: hsl(var(--neutral-h-s) 50% / 0.125);
+  --vp-c-divider-light-1: hsl(var(--neutral-h-s) 50% / 0.2);
+  --vp-c-divider-light-2: hsl(var(--neutral-h-s) 50% / 0.1);
   --vp-c-divider-dark-1: hsl(var(--neutral-h-s) 50% / 0.5);
   --vp-c-divider-dark-2: hsl(var(--neutral-h-s) 50% / 0.33);
 

docs/introduction.md

@@ -8,9 +8,9 @@ Any application that supports [the Micropub protocol](https://micropub.spec.indi
 
 ```sh
 POST /micropub HTTP/1.1
-Host: indiekit.mywebsite.com
+Host: indiekit.website.example
 Content-Type: application/x-www-form-urlencoded
-Authorization: Bearer XXXXXXX
+Authorization: Bearer [ACCESS_TOKEN]
 
 h=entry
 &content=Hello+world
@@ -39,22 +39,27 @@ Note the `mp-syndicate-to` property in the above example. If you’ve configured
 You can then send a second `POST` request, this time to `https://indiekit.website.example/syndicate` along with your access token which you can find on your server’s status page:
 
 ```sh
-POST /syndicate HTTP/1.1
-Host: indiekit.mywebsite.com
-Content-Type: application/x-www-form-urlencoded
-
-token=XXXXXXX
+POST /syndicate?token=[ACCESS_TOKEN] HTTP/1.1
+Host: indiekit.website.example
+Accept: application/json
 ```
 
-This will tell Indiekit to syndicate the most recent un-syndicated post to the third-party websites listed in the front matter.
+This will tell Indiekit to syndicate the most recent un-syndicated post to the third-party websites listed in a post’s front matter.
 
 ::: tip
 
 ### Use an outgoing webhook on Netlify
 
-Netlify allows [posting to an outgoing webhook](https://docs.netlify.com/site-deploys/notifications/#outgoing-webhooks) once a deploy has succeeded.
+If you are using [Netlify](https://www.netlify.com) to host your website, you can send a notification to the syndication endpoint once a deployment has been completed.
+
+First, create an environment variable for your Indiekit server called `WEBHOOK_SECRET` and give it a secret, hard-to-guess value.
+
+Then on Netlify, in your site’s ‘Build & Deploy’ settings, add an [outgoing webhook](https://docs.netlify.com/site-deploys/notifications/#outgoing-webhooks) with the following values:
+
+* **Event to listen for:** ‘Deploy succeeded’
+* **URL to notify:** `[YOUR_INDIEKIT_URL]/syndicate`
+* **JWS secret token:** The same value you used for `WEBHOOK_SECRET`
 
-In ‘URL to notify’, enter your server’s syndication endpoint with your access token as the `token` parameter, for example: `https://indiekit.website.example/syndicate?token=XXXXXXX`.
 :::
 
 Once this has been completed, Indiekit will update the post, replacing `mp-syndicate-to` with a `syndication` property listing the location of each syndicated copy:

packages/endpoint-posts/includes/endpoint-posts-syndicate.njk

@@ -1,6 +1,6 @@
 <form action="{{ application._syndicationEndpointPath }}" method="post">
   {{ input({
-    name: "token",
+    name: "access_token",
     type: "hidden",
     value: token
   }) | indent(2) }}

packages/endpoint-syndicate/README.md

@@ -27,5 +27,47 @@ Add `@indiekit/endpoint-syndicate` to your list of plug-ins, specifying options
 
 ## Supported endpoint queries
 
-- Access token (required): `/syndicate?token=XXXXXXX`
-- URL to syndicate: `/syndicate?token=XXXXXXX&source_url=https%3A%2F%2Fwebsite.example%2Fposts%2F1`
+- URL to syndicate: `/syndicate?source_url=https%3A%2F%2Fwebsite.example%2Fposts%2F1`
+
+## Authorization
+
+Authorization is needed to update posts with any syndicated URLs. This can be done in a few different ways:
+
+### Query string
+
+Include your server’s access token as the `token` query:
+
+```http
+POST /syndicate?token=[ACCESS_TOKEN] HTTP/1.1
+Host: indiekit.website.example
+Accept: application/json
+```
+
+You can find an access token on your server’s status page.
+
+### Form body
+
+Include a value for `access_token` in your form submission:
+
+```http
+POST /syndicate HTTP/1.1
+Host: indiekit.website.example
+Content-type: application/x-www-form-urlencoded
+Accept: application/json
+
+access_token=[ACCESS_TOKEN]
+```
+
+You can find an access token on your server’s status page.
+
+### Using a webhook secret (Netlify only)
+
+If you are using [Netlify](https://www.netlify.com) to host your website, you can send a notification to the syndication endpoint once a deployment has been completed.
+
+First, create an environment variable for your Indiekit server called `WEBHOOK_SECRET` and give it a secret, hard-to-guess value.
+
+Then on Netlify, in your site’s ‘Build & Deploy’ settings, add an [outgoing webhook](https://docs.netlify.com/site-deploys/notifications/#outgoing-webhooks) with the following values:
+
+- **Event to listen for:** ‘Deploy succeeded’
+- **URL to notify:** `[YOUR_INDIEKIT_URL]/syndicate`
+- **JWS secret token:** The same value you used for `WEBHOOK_SECRET`

packages/endpoint-syndicate/index.js

@@ -13,7 +13,7 @@ export default class SyndicateEndpoint {
     this.mountPath = this.options.mountPath;
   }
 
-  get routes() {
+  get routesPublic() {
     router.post("/", syndicateController.post);
 
     return router;