Cron Jobs

Rules

• Vercel Cron: define in vercel.json with { "crons": [{ "path": "/api/cron/task", "schedule": "0 * * * *" }] }
• Secure cron endpoints: verify Authorization: Bearer ${CRON_SECRET} header — prevent unauthorized invocations
• Idempotent handlers — cron jobs can fire twice; always check if work was already done
• Timeout awareness: Vercel functions timeout at 10s (hobby) / 60s (pro) — offload long tasks to queues
• Inngest for complex scheduling: inngest.createFunction({ id: "...", cron: "0 9 * * *" }, handler)
• node-cron for self-hosted: cron.schedule("*/5 * * * *", task) — only for persistent servers
• Crontab syntax: minute hour day month weekday — use https://crontab.guru to verify
• Log every run with start time, end time, success/failure, items processed
• Error handling: wrap in try/catch, report failures to logging/alerting, don't let one failure stop the next run

Patterns

// vercel.json
{
  "crons": [
    { "path": "/api/cron/daily-report", "schedule": "0 9 * * *" },
    { "path": "/api/cron/cleanup", "schedule": "0 0 * * 0" }
  ]
}

// Cron route handler
export async function GET(req: Request) {
  const authHeader = req.headers.get("authorization");
  if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {
    return new Response("Unauthorized", { status: 401 });
  }

  try {
    const result = await runScheduledTask();
    return Response.json({ success: true, processed: result.count });
  } catch (error) {
    console.error("Cron job failed:", error);
    return Response.json({ success: false, error: String(error) }, { status: 500 });
  }
}

Common Schedules

Avoid

• Exposing cron endpoints without auth — anyone could trigger them
• Long-running work inside the handler — offload to a queue for tasks > 10s
• Assuming exact timing — cron jobs can be delayed; design for idempotency
• Forgetting error handling — one uncaught error should not break the schedule