Skip to content

docs: setup.md cron section covers both authenticated cron routes #145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vlad-ko merged 2 commits into from
Jul 9, 2026
Merged

docs: setup.md cron section covers both authenticated cron routes #145

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c0721a
docs: setup.md cron section covers both authenticated cron routes
vlad-ko Jul 9, 2026
31bbf12
docs: CRON_SECRET required-column label covers both cron consumers
vlad-ko Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions docs/setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,8 @@ The repo ships a `vercel.json` that schedules the recovery sweep — the endpoin
```json
{
"crons": [
{ "path": "/api/cron/sweep", "schedule": "*/5 * * * *" }
{ "path": "/api/cron/sweep", "schedule": "*/5 * * * *" },
{ "path": "/api/cron/code-index", "schedule": "*/5 * * * *" }
]
}
```
Expand All @@ -186,7 +187,7 @@ Vercel picks this up automatically on deploy — but the sweep authenticates eve
vercel env add CRON_SECRET # any long random string, e.g. `openssl rand -hex 32`
```

Vercel sends `Authorization: Bearer $CRON_SECRET` with each cron invocation; the sweep **denies all requests** (401) when the variable is unset — a missing secret disables recovery rather than exposing the endpoint.
Vercel sends `Authorization: Bearer $CRON_SECRET` with each cron invocation; **both cron routes** (`/api/cron/sweep` and `/api/cron/code-index`) **deny all requests** (401) when the variable is unset — a missing secret disables recovery and code indexing rather than exposing the endpoints.

> **Hobby plan note**: Hobby allows at most one cron invocation per day, so the `*/5` schedule degrades to roughly daily. Recovery stays **correct** on any cadence — the sweep's decisions depend only on marker age, never on how often it runs — you just wait longer for a stuck question to be retried. On Pro the 5-minute cadence applies as written.

Expand Down Expand Up @@ -268,7 +269,7 @@ If the bot does not respond, check the [Troubleshooting Guide](./troubleshooting
| `UPSTASH_VECTOR_REST_TOKEN` | Optional | `ABcD3...` | Token for the Vector index -- both must be set or neither |
| `KV_REST_API_URL` | Legacy | `https://...upstash.io` | Read as a fallback by `@upstash/redis` for projects that still provision "Vercel KV" |
| `KV_REST_API_TOKEN` | Legacy | `AaB1Cc2...` | Read as a fallback — either pair works |
| `CRON_SECRET` | Yes (for recovery) | `f3a9...64 hex chars` | Auth for `/api/cron/sweep` (Vercel Cron sends it as a Bearer token). Unset = sweep denies all requests, recovery disabled |
| `CRON_SECRET` | Yes (for recovery + code index) | `f3a9...64 hex chars` | Auth for both `/api/cron/*` routes — sweep and code-index (Vercel Cron sends it as a Bearer token). Unset = both deny all requests: recovery and code indexing disabled |

## Security Notes

Expand Down
Loading