Cron

Schedule signed HTTP calls to your app (5-field cron), define jobs in code, and schedule one-off tasks.

mybase POSTs a signed JSON request to a URL of your app on a schedule. Your app verifies the signature with @mybase-dev/sdk/cron.

mybase cron enable shop                 # prints the signing secret → MYBASE_CRON_SECRET
mybase cron create shop nightly --schedule "0 3 * * *" --url https://shop.example.com/api/cron
mybase cron run shop nightly            # run now
mybase cron runs shop nightly           # recent results

Schedules are 5-field cron (minute precision), in UTC unless --tz is given.
Retries on network errors, timeouts, 429, and 5xx: after 10 s, 60 s, 5 min.
Ticks missed while mybase is down are not replayed. One-off tasks are: overdue ones run at boot.
Each call has X-Mybase-Signature: t=…,v1=… (HMAC-SHA256). See signatures.

Jobs in code

Declare jobs in mybase.config.ts and sync them (code jobs can only be changed by sync; dashboard jobs are left alone):

mybase cron sync --dry-run
mybase cron sync

Guides: handling calls, jobs in code, one-off tasks.

Security

Verify every call with cronHandler or verifyCronRequest; an unverified endpoint can be called by anyone.
Jobs can't call loopback, cloud metadata, or mybase's own containers; set MYBASE_OUTBOUND=public on a cloud server to refuse private addresses too. Responses are stored, so never return secrets.

More: Security best practices.

Agent notes

The cron secret is the one stored secret: get it with mybase cron secret <project>; rotate with --rotate (then update the app).
Your endpoint must be reachable from the mybase server.
Prefer mybase.config.ts + sync for jobs the app depends on, so they're reviewed with the code.

Storage (S3)

Use a project's S3 bucket with any S3 client; serve public files from the public/ prefix.

Queues

SQS-style standard and FIFO queues with visibility timeouts, long polling, batches, and dead-letter queues.

On this page

Jobs in code Security Agent notes