CRON_SECRET Generator

Generated by your browser with the Web Crypto API. Nothing is sent to a server, nothing is stored, and reloading the page throws this value away.

CRON_SECRET=

Goes in .env.local for local development and in your hosting provider environment variables for production. Never commit it.

// app/api/cron/route.ts
export async function GET(request: Request) {
  const auth = request.headers.get('authorization');

  if (auth !== `Bearer ${process.env.CRON_SECRET}`) {
    return new Response('Unauthorized', { status: 401 });
  }

  // your scheduled work here

  return Response.json({ ok: true });
}

On Vercel, a Cron job sends this header automatically once CRON_SECRET is set. For a hardened comparison, use crypto.timingSafeEqual on equal-length buffers rather than !==.

openssl rand -hex 32
openssl rand -base64 32

Same entropy, same source of randomness. Use whichever you trust more.

1. Generate a secret: pick a format and length. 32 random bytes is a strong default.
2. Copy it: the value is created in your browser and never leaves the page.
3. Add it to your environment: .env.local locally, your provider environment variables in production.
4. Verify it in your cron route: reject anything whose Authorization header is not a match, returning 401.
5. Redeploy: environment variable changes take effect on the next deploy.
6. Rotate periodically: on a schedule, and immediately after any suspected exposure.