Vercel cron jobs — syntax, examples & limits

{
  "$schema": "https://openapi.vercel.sh/vercel.json",
  "crons": [
    {
      "path": "/api/cron/daily-digest",
      "schedule": "0 9 * * *"
    },
    {
      "path": "/api/cron/heartbeat",
      "schedule": "*/15 * * * *"
    }
  ]
}

The path must point to a Next.js API route or edge function. Vercel POSTs to it on the schedule with the cron secret in the Authorization header.

// app/api/cron/daily-digest/route.ts (App Router)
export async function POST(request: Request) {
  const auth = request.headers.get('authorization');
  if (auth !== `Bearer ${process.env.CRON_SECRET}`) {
    return new Response('Unauthorized', { status: 401 });
  }
  await sendDailyDigest();
  return Response.json({ ok: true });
}

Without the auth check, any external request could trigger your cron logic. The CRON_SECRET is provisioned by Vercel automatically — you don't have to set it yourself.

• 0 0 * * * — daily at 00:00 UTC (Hobby plan supported).
• 0 9 * * * — daily at 09:00 UTC.
• 0 9 * * 1-5 — weekday morning (Pro plan).
• */15 * * * * — every 15 minutes (Pro plan).
• */5 * * * * — every 5 minutes (Pro plan).
• 0 0 1 * * — first of every month at midnight.
• 0 0 L * * — Vercel does NOT support L. Use the multi-cron pattern instead.

• UTC only — convert local times manually.
• Hobby plan caps frequency — at most once-per-day. Upgrade to Pro for tighter cadences.
• Cold starts — the cron route runs as a regular serverless function. Cold-start latency may dominate short jobs.
• 10s default timeout — increase via maxDuration if your job runs longer.
• No L / W / # / ? — Vercel uses standard 5-field Unix cron only.