Manage Serverless Message Queues with QStash

Covers serverless HTTP message queuing, scheduling, and delivery via Upstash QStash, anchored on eight principles: HTTP is the interface, since anything speaking HTTPS speaks QStash; endpoints must be public because QStash calls URLs from the cloud; signatures must always be verified; schedules are fire-and-forget cron handled by QStash; retries are built in but should be tuned per use case; delays are free from seconds to days; callbacks close the loop on delivery success or failure; and deduplication via message IDs prevents double-processing. Six patterns cover the surface: basic publishing (publishJSON with immediate, delay, or notBefore timing), cron-based scheduled jobs (schedules.create with cron syntax, list, delete), mandatory signature verification in the receiving endpoint (Receiver.verify() against the raw body, checking both currentSigningKey and nextSigningKey for seamless key rotation), delivery-status callbacks (callback/failureCallback URLs receiving sourceMessageId, status, and body), URL-group fan-out where one publish reaches every endpoint in a named group, and message deduplication via a custom deduplicationId or contentBasedDeduplication hash within a default 60-second window.

const schedule = await qstash.schedules.create({
  destination: 'https://myapp.com/api/cron/daily-report',
  cron: '0 9 * * *',  // Every day at 9 AM UTC
  body: JSON.stringify({ type: 'daily' }),
});

Use it for serverless scheduled jobs, delayed messages, reliable webhook fan-out, and HTTP-based async task delivery without managing queue infrastructure - not for complex multi-step workflows with checkpointing (routed to inngest), traditional Redis-backed worker queues (bullmq-specialist), event sourcing (event-architect), or heavier workflow orchestration (temporal-craftsman). It documents ten sharp edges, two at CRITICAL severity: skipping signature verification leaves a public endpoint open to forged messages from anyone who discovers the URL, and QStash can only reach public HTTPS URLs, never localhost or private IPs, so local development needs ngrok, a dev-mode direct-fetch bypass, or Vercel preview URLs. Eight more at HIGH/MEDIUM: a callback endpoint taking over 30 seconds triggers a QStash timeout and a duplicate retry; unmonitored publishing can hit plan rate limits, 500 messages/day on the free tier, during a burst; skipping deduplication on critical operations like charges lets a network retry double-send; reusing the same default retry count for both a critical payment webhook and a disposable analytics ping mismatches recovery needs; payloads should carry a reference such as an ID rather than the actual data, since QStash caps body size around 500KB; omitting callback/failureCallback means no feedback loop on whether a fire-and-forget message actually succeeded; cron schedules run in UTC, not local time, and get silently misread across daylight saving changes; and URL groups accumulate dead endpoints that waste retries once a service is deprecated.

Inputs are a destination URL, a JSON body, and optional delay, schedule, deduplication, or callback parameters; outputs are the publish response (a messageId) and, when configured, an async callback POST carrying sourceMessageId, status, and body for delivery tracking. Ten automated validation checks flag defects at CRITICAL/ERROR severity: missing signature verification in a webhook or callback handler, a Receiver missing either signing key, a hardcoded QStash token or signing key, a localhost URL passed to publishJSON, an http:// URL instead of https://, a publish call with no error handling, verifying a signature against parsed JSON instead of the required raw body (req.text()), and a schedule missing its destination URL.

Supports Next.js, Cloudflare Workers, Vercel Functions, AWS Lambda, and Netlify Functions as delivery targets, and pairs with Upstash Redis and Upstash Kafka. It defines five multi-skill workflows - Serverless Background Jobs, Reliable Webhooks with stripe-integration and supabase-backend, Scheduled Reports, Fan-out Notifications to email-systems and slack-bot-builder, and a Gradual Migration to Workflows path that moves multi-step flows to inngest while keeping simple schedules in QStash - and hands off to bullmq-specialist, event-architect, and temporal-craftsman for architectures beyond its scope.

Developers building serverless scheduled jobs, delayed tasks, or reliable webhook delivery who want managed HTTP-based queuing without running Redis or a worker process, and who need QStash's specific signature-verification, timeout, rate-limit, and UTC-scheduling gotchas handled correctly.