Cron Secret Generator

A CRON_SECRET is a random token that protects your cron job endpoints from unauthorized access. Cron routes are ordinary HTTP endpoints — without a secret, anyone who discovers the URL can trigger your scheduled jobs, drain your quotas, or corrupt your data.

The scheduler sends the secret in the Authorization header of every cron request, and your endpoint rejects any request that doesn't carry it. A 32-byte random value is the widely recommended strength — the same as Vercel's official documentation suggests.

1. Add the generated key as a CRON_SECRET environment variable in your Vercel project settings.

2. Declare your cron schedule in vercel.json:

{
  "crons": [
    { "path": "/api/cron/daily-report", "schedule": "0 5 * * *" }
  ]
}

3. Verify the Authorization header in your route handler:

// app/api/cron/daily-report/route.ts
import { NextResponse } from "next/server";

export async function GET(request: Request) {
  const authHeader = request.headers.get("authorization");
  if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  // ... run your scheduled job here

  return NextResponse.json({ ok: true });
}

Self-hosted platforms like Dokploy and Coolify don't inject the Authorization header for you — schedule a curl command that sends it explicitly:

curl -X GET "https://your-app.com/api/cron/daily-report" \
  -H "Authorization: Bearer $CRON_SECRET"

Read the full cron jobs setup guide in the NEXTY.DEV docs