TL;DR

Vercel Cron triggers HTTP GETs (or POSTs) on a schedule. Rotor schedules + HTTP callback mode replace it — with no 1-cron-per-day Hobby cap and no per-project Pro ceiling. Your existing /api/cron/* handlers work as-is; Rotor becomes the scheduler that calls them.

At Rotor Free ($0) you get unlimited schedules against a 10k/mo execution budget — vs. Vercel Hobby's hard 1 cron per day limit.

Pricing at a glance

Architecture mapping

No handler-side changes required: Vercel Cron already hits an HTTP route on your app. Rotor does the same thing — you just change what authenticates the incoming request (HMAC instead of bearer).

Before / After

{
  "crons": [
    {
      "path": "/api/cron/cleanup",
      "schedule": "0 */6 * * *"
    },
    {
      "path": "/api/cron/daily-digest",
      "schedule": "0 12 * * *"
    }
  ]
}

# 1. Create one queue per cron, pointing at your existing handler URL
curl -X POST https://api.rotor.sh/v1/queues \
  -H "Authorization: Bearer $ROTOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"cron-cleanup"}'
 
curl -X PATCH https://api.rotor.sh/v1/queues/cron-cleanup \
  -H "Authorization: Bearer $ROTOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "callback_url": "https://your-app.vercel.app/api/cron/cleanup",
    "rotate_callback_secret": true
  }'
# Response returns callback_secret ONCE — save to env var ROTOR_CALLBACK_SECRET.
 
# 2. Attach a schedule
curl -X POST https://api.rotor.sh/v1/schedules \
  -H "Authorization: Bearer $ROTOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "queue": "cron-cleanup",
    "cron": "0 */6 * * *",
    "timezone": "UTC"
  }'

Delete the crons array from vercel.json once the Rotor schedule is live. Your handler route stays exactly where it is.

Timezone — read this first

Supported timezone values: any IANA zone name (e.g. UTC, America/New_York, Europe/London, Asia/Tokyo). See the full list at IANA tz database.

Signature verification

Vercel Cron authenticates callbacks via the CRON_SECRET env var + bearer header:

// Before: Vercel Cron handler
export async function GET(req: Request) {
  const auth = req.headers.get("authorization");
  if (auth !== `Bearer ${process.env.CRON_SECRET}`) {
    return new Response("unauthorized", { status: 401 });
  }
  // ...do cron work
}

Rotor authenticates via HMAC signature on the request body — stronger because it binds the signature to the exact payload, preventing replay with altered bodies. See the full Webhook Signature Verification reference for Node, Python, Go, and Ruby.

// After: Rotor callback handler
import { createHmac, timingSafeEqual } from "node:crypto";
 
export async function POST(req: Request) {
  const body = await req.text();
  if (!verifyRotorSignature(req.headers, body)) {
    return new Response("unauthorized", { status: 401 });
  }
  const jobId = req.headers.get("x-rotor-job-id");
  // ...do cron work (same as before); use jobId for idempotency if needed
  return new Response("ok");
}
 
function verifyRotorSignature(headers: Headers, body: string): boolean {
  const id = headers.get("x-rotor-job-id") ?? "";
  const ts = headers.get("x-rotor-timestamp") ?? "";
  const sig = headers.get("x-rotor-signature") ?? "";
  if (!id || !ts || !sig) return false;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
 
  const expected = `v1,${createHmac("sha256", process.env.ROTOR_CALLBACK_SECRET!)
    .update(`${id}.${ts}.${body}`)
    .digest("base64")}`;
  const a = Buffer.from(expected);
  const b = Buffer.from(sig);
  return a.length === b.length && timingSafeEqual(a, b);
}

Request method changes: Vercel Cron sends GET. Rotor sends POST with a JSON body (empty {} for schedules with no payload). Update your route handler from GET to POST — or accept both if you want to leave Vercel Cron running in parallel during migration.

Auth migration cheatsheet

Automated import

We ship a small script that reads your vercel.json, extracts the crons[] array, and emits the Rotor queue + schedule configuration as JSON-lines.

# Run it
npx tsx docs/scripts/import-from-vercel-cron.ts ./vercel.json

Example input and output:

// vercel.json
{
  "crons": [
    { "path": "/api/cron/cleanup", "schedule": "0 */6 * * *" },
    { "path": "/api/cron/daily-digest", "schedule": "0 12 * * *" }
  ]
}

// stdout — one object per line
{"type":"queue","config":{"name":"cron-cleanup","callback_url":"https://YOUR_DOMAIN/api/cron/cleanup"}}
{"type":"schedule","config":{"queue":"cron-cleanup","cron":"0 */6 * * *","timezone":"UTC"}}
{"type":"queue","config":{"name":"cron-daily-digest","callback_url":"https://YOUR_DOMAIN/api/cron/daily-digest"}}
{"type":"schedule","config":{"queue":"cron-daily-digest","cron":"0 12 * * *","timezone":"UTC"}}

After running the script:

1. Search-and-replace YOUR_DOMAIN with your actual production host (e.g. your-app.vercel.app).
2. Replay the type:queue lines as POST /v1/queues + PATCH .../callback_url.
3. Replay the type:schedule lines as POST /v1/schedules.
4. Verify one scheduled execution fires and hits your handler, then remove the crons array from vercel.json.

Next steps

1. Start a Pro trial — 14 days, no credit card.
2. Install the SDK: pnpm add @rotorsh/sdk — see the Node.js quickstart.
3. Join the Anthropic Discord — #rotor channel for migration help.