PostTTS REST API

{
  "voices": [
    { "id": "woman",       "label": "Hoa (Female, young)",    "gender": "female" },
    { "id": "woman-news",  "label": "Linh (Female, mid-age)", "gender": "female" },
    { "id": "woman-story", "label": "Mai (Female, elderly)",  "gender": "female" },
    { "id": "man",         "label": "Minh (Male, young)",     "gender": "male"   },
    { "id": "man-formal",  "label": "Duc (Male, mid-age)",    "gender": "male"   },
    { "id": "man-calm",    "label": "Thanh (Male, elderly)",  "gender": "male"   }
  ]
}

// Poll GET /api/v1/posts/:id/audio until ready.
// Exponential backoff: 5s, 10s, 20s, 40s, cap at 60s. Give up after ~10 minutes.
async function waitForAudio(postId, apiKey, { maxMs = 600_000 } = {}) {
  const deadline = Date.now() + maxMs;
  let delay = 5_000;
  while (Date.now() < deadline) {
    const res = await fetch(
      `https://posttts.com/api/v1/posts/${postId}/audio`,
      { headers: { Authorization: `Bearer ${apiKey}` } },
    );
    const body = await res.json();
    if (body.status === 'ready')  return body;
    if (body.status === 'failed') throw new Error(body.error ?? 'conversion failed');

    await new Promise((r) => setTimeout(r, delay));
    delay = Math.min(delay * 2, 60_000);
  }
  throw new Error('timed out waiting for audio');
}

// Example: submit a long post, then wait for completion.
const createRes = await fetch('https://posttts.com/api/v1/posts/convert', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.POSTTTS_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    site_id: 'site_01HX...',
    url: 'https://yourblog.com/posts/long-read',
    text: veryLongArticleText,
    voice: 'woman',
  }),
});
const { id } = await createRes.json(); // 202 Accepted, status: S
"processing"
const ready = await waitForAudio(id, process.env.POSTTTS_API_KEY);
console.log(ready.audio_url);

{
  "id": "evt_7kQ2fV9pLmN4",
  "object": "event",
  "type": "article.processing.completed",
  "created_at": "2026-04-16T14: N
32: 18.421Z",
  "delivery_attempt": 1,
  "data": {
    "object": {
      "id": "post_01HX9FJK2V6M3P7Z",
      "site_id": "site_01HX8M2QK4T7VR9D",
      "url": "https://yourblog.com/posts/hello-world",
      "title": "Hello World",
      "status": "ready",
      "voice": "woman",
      "audio_url": "https://audio.posttts.com/u/123/post_01HX9F.m4a?exp=1713277938&sig=…",
      "audio_duration": 312,
      "char_count": 4820,
      "processing_ms": 1840,
      "synthesis_ms": 1420,
      "upload_ms": 310,
      "error_message": null,
      "created_at": "2026-04-16T14: N
32: 16.003Z",
      "updated_at": "2026-04-16T14: N
32: 18.418Z"
    }
  }
}

import express from 'express';
import crypto from 'node:crypto';

const app = express();
const SECRET = process.env.POSTTTS_WEBHOOK_SECRET; // whsec_…

// IMPORTANT: read the raw body — not the parsed JSON — so the HMAC matches.
app.post(
  '/webhooks/posttts',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const header = req.header('x-webhook-signature') ?? '';
    const parts = Object.fromEntries(
      header.split(',').map((p) => p.split('=')),
    );
    const t = Number(parts.t);
    const v1 = parts.v1;

    // Reject stale timestamps (>5 min) to block replay attacks.
    if (!t || Math.abs(Date.now() / 1000 - t) > 300) {
      return res.status(400).send('stale timestamp');
    }

    const raw = req.body.toString('utf8');
    const mac = crypto
      .createHmac('sha256', SECRET)
      .update(`${t}.${raw}`)
      .digest()
      .subarray(0, 16)        // truncate to 128 bits
      .toString('hex');

    const ok =
      v1.length === mac.length &&
      crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(mac));
    if (!ok) return res.status(401).send('bad signature');

    const event = JSON.parse(raw);
    // Handle event.type — idempotent on X-Webhook-Event-Id.
    console.log(event.type, event.data.object.id);
    res.status(200).send('ok');
  },
);

app.listen(3000);