On-Demand Revalidation: revalidateTag vs revalidatePath

1// app/api/webhooks/cms/route.ts
2import { revalidateTag } from 'next/cache';
3import { NextRequest, NextResponse } from 'next/server';
4
5export async function POST(request: NextRequest) {
6  // 1. Authenticate secret token to prevent unauthorized cache purging attacks
7  const secret = request.headers.get('x-webhook-secret');
8  if (secret !== process.env.CMS_WEBHOOK_SECRET) {
9    return NextResponse.json({ message: 'Unauthorized' }, { status: 401 });
10  }
11
12  const payload = await request.json();
13  const { event, entity, id } = payload;
14
15  if (entity === 'product') {
16    // Surgically purges every query tagged with this product ID
17    // AND every list tagged with 'products'
18    revalidateTag(`product-${id}`);
19    revalidateTag('products-list');
20
21    return NextResponse.json({
22      revalidated: true,
23      tags: [`product-${id}`, 'products-list'],
24      timestamp: Date.now(),
25    });
26  }
27
28  return NextResponse.json({ message: 'No action taken' });
29}