Pro plan · read-only

Website embeds & content webhooks

Show your Substack posts on your own site with CORS-friendly JSON and widgets, and get a webhook when you publish.

In one paragraph

Website embeds & content webhooks let you show your Substack posts on your own website through a cached, CORS-friendly JSON feed and drop-in widgets for latest posts, post cards and a full archive page. You connect by pasting your publication URL; we read your public RSS feed, so your site calls our cache instead of Substack directly. A post.published webhook fires when a new post appears, so you can cross-post to your site, LinkedIn or Slack.

Why people want this

“Between the Substack CORS blocks and Substack blocking Azure addresses, where the corporate website is hosted, there isn't a decent way of share Substack post information with the corporate website.”

r/Substack, 2025-09-08

“without APIs and webhooks, what happens on Substack stays on Substack.”

@denk_tweets on X, 2026-06-15

“substack doesn't use webhooks.”

@Ace_theSage on X, 2026-10-21

How it works

Paste your publication URL. We poll its public RSS feed and keep a cached, cleaned copy of your posts.
Fetch the JSON from your browser or server: CORS is open, and requests hit our cache, not Substack.
Or drop in a widget with one script tag: latest posts, a single post card, or a full archive page styled to your site.
For a headless CMS setup, render full posts on your own domain from the JSON, with a canonical link back to Substack.
Register a webhook URL to receive post.published when a new post appears, and send it on to your site build, LinkedIn or Slack.

Endpoints

Example responses are illustrative.

GET/v1/publications/{publication}/feed

Cached, CORS-enabled JSON of recent posts for client-side use. Public key, read-only.

Param	In	Type	Description
publication*	path	string	Your publication's subdomain or custom domain, e.g. yourpub.substack.com
limit	query	integer	1–50, default 10
tag	query	string	Only posts with this tag
key*	query	string	Your publishable (browser-safe) key

{
  "publication": "yourpub.substack.com",
  "cached_at": "2026-10-21T09:00:00Z",
  "posts": [
    {
      "title": "Why we moved our blog",
      "subtitle": "And what we learned in the first 90 days",
      "url": "https://yourpub.substack.com/p/why-we-moved-our-blog",
      "published_at": "2026-09-30T14:00:00Z",
      "cover_image": "https://cdn.newsletterapi.io/yourpub/img/7a1e.jpg",
      "excerpt": "We wanted one place to write…"
    }
  ]
}

GET/v1/publications/{publication}/posts/{slug}/card

Data for one post card (title, image, excerpt, author), for embeds and link previews.

Param	In	Type	Description
publication*	path	string	Your publication's subdomain or custom domain, e.g. yourpub.substack.com
slug*	path	string	The post slug

{
  "title": "Why we moved our blog",
  "author": "Alex Writer",
  "image": "https://cdn.newsletterapi.io/yourpub/img/7a1e.jpg",
  "excerpt": "We wanted one place to write…",
  "url": "https://yourpub.substack.com/p/why-we-moved-our-blog",
  "reading_minutes": 6
}

GET/v1/publications/{publication}/widgets/{widget}

Embed code for a widget: latest-posts, post-card or archive.

Param	In	Type	Description
publication*	path	string	Your publication's subdomain or custom domain, e.g. yourpub.substack.com
widget*	path	"latest-posts" \| "post-card" \| "archive"	Which widget
theme	query	"light" \| "dark" \| "auto"	Colour scheme, default auto

{
  "widget": "latest-posts",
  "html": "<div data-nlapi-widget=\"latest-posts\" data-publication=\"yourpub\" data-limit=\"3\"></div><script async src=\"https://cdn.newsletterapi.io/widgets.js\"></script>"
}

POST/v1/publications/{publication}/webhooks

Subscribe a URL to content events. Payloads are HMAC-signed.

Param	In	Type	Description
publication*	path	string	Your publication's subdomain or custom domain, e.g. yourpub.substack.com
url*	body	string	HTTPS endpoint to receive events
events*	body	string[]	Supported events: post.published, post.updated

{
  "id": "wh_51f0",
  "url": "https://example.com/hooks/substack",
  "events": [
    "post.published"
  ],
  "secret": "whsec_…",
  "sample_payload": {
    "type": "post.published",
    "publication": "yourpub.substack.com",
    "post": {
      "slug": "why-we-moved-our-blog",
      "title": "Why we moved our blog",
      "url": "https://yourpub.substack.com/p/why-we-moved-our-blog",
      "published_at": "2026-09-30T14:00:00Z"
    },
    "detected_at": "2026-09-30T14:04:10Z"
  }
}

DELETE/v1/publications/{publication}/webhooks/{id}

Remove a webhook subscription.

Param	In	Type	Description
publication*	path	string	Your publication's subdomain or custom domain, e.g. yourpub.substack.com
id*	path	string	Webhook id

{
  "id": "wh_51f0",
  "deleted": true
}

MCP tools for your AI agent

get_embed_code

Generate the embed snippet for a widget.

Try: “Give me the embed code for my three latest posts in dark mode.”

list_webhook_deliveries

Recent webhook deliveries with status codes and retries.

Try: “Did the webhook for my last post reach our website?”

What people will build with it

Company blog on your own domain

Show the latest Substack posts on your corporate site without CORS errors or blocked server IPs, because your site calls our cache.

Headless CMS

Write in Substack, render on your Next.js or Astro site from JSON, with canonical links back to the original post.

Cross-post on publish

Use post.published to rebuild your site, post to a Slack channel or prepare a LinkedIn share automatically.

Author pages and portfolios

Drop a post-card widget into a portfolio, speaker page or link-in-bio site.

Questions

Why can't I fetch Substack posts from my website directly?: Writers report that browser requests hit CORS restrictions and that some cloud hosting IP ranges get blocked. Our feed is served from our cache with CORS enabled, so your site never calls Substack directly.
How fast does post.published fire?: It is based on your public RSS feed, so it fires after we next poll the feed and see the new post, not at the exact moment you hit publish.
Can I show paid posts on my site?: Only what your RSS feed shows (a truncated preview) unless you upload your export. We recommend linking paid posts back to Substack so readers can subscribe.
Does it need my password?: No. We never ask for your Substack login or session. We read your public RSS feed and the export files you download from your own Substack settings and upload to us.
Is this affiliated with Substack?: No. newsletterapi.io is an independent tool for Substack writers. It is not made, endorsed or approved by Substack, Inc.
How do I get access?: Email hello@newsletterapi.io or use the Get access form, and we set up your account.