Schedule a recurring Vercel Function via vercel.json cron and secure it against unauthorized invocation using CRON_SECRET

Documented steps

1. Create the function to run, e.g. app/api/cron/route.ts with `export function GET(request: NextRequest) {...}`.
2. Add a crons array to vercel.json: {"crons":[{"path":"/api/cron","schedule":"0 5 * * *"}]}; path must start with '/', schedule is a 5-field cron expression (minute hour day-of-month month day-of-week), always evaluated in UTC.
3. Respect cron expression limits: no MON/SUN/JAN/DEC aliases supported, and you cannot set both day-of-month and day-of-week simultaneously (one must be '*').
4. Add a CRON_SECRET environment variable in Project Settings > Environment Variables (random string, 16+ chars recommended).
5. Vercel automatically sends CRON_SECRET as `Authorization: Bearer <CRON_SECRET>` on every cron invocation — read request.headers.get('authorization'), compare to `Bearer ${process.env.CRON_SECRET}`, and return 401 on mismatch.
6. Deploy to production with `vercel deploy --prod` — crons only run against Production deployments, never Preview deployments.
7. Check plan limits: Hobby allows up to 100 cron jobs/project but restricted to once-per-day frequency with ±59 min timing precision; Pro/Enterprise allow once-per-minute frequency with per-minute precision (100 cron jobs/project on all plans).
8. Design handlers to be idempotent and consider a distributed lock (e.g. Redis) for long-running jobs, since Vercel cron delivery is best-effort — both missed and duplicate invocations can occur.
9. Official docs verified: https://vercel.com/docs/cron-jobs | https://vercel.com/docs/cron-jobs/quickstart | https://vercel.com/docs/cron-jobs/usage-and-pricing | Reference: https://vercel.com/docs/cron-jobs/manage-cron-jobs