Cron Secret Tokens Setup Guide

This guide explains how to generate and configure secret tokens for cron jobs.

What Are Secret Tokens?

Secret tokens are random strings used to authenticate cron job requests. They prevent unauthorized access to your cron endpoints. Think of them as passwords for your automated jobs.

Generating Secret Tokens

You need to create strong, random strings for each secret. Here are several methods:

Method 1: Using OpenSSL (Recommended)

# Generate a 32-character random hex string
openssl rand -hex 32

# Or generate a 64-character base64 string
openssl rand -base64 64

Method 2: Using Node.js

# In your terminal
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

Method 3: Using Online Generators

• Random.org
• 1Password Generator
• LastPass Generator

Recommended length: 32-64 characters

Method 4: Using Python

python3 -c "import secrets; print(secrets.token_urlsafe(32))"

Required Secret Tokens

Based on your cron jobs, you need these secrets:

Required (Must Have)

1. WORKOUT_WINDOW_CRON_SECRET
   • Used by: Workout Window chains, Workout Window battles
   • Also used as fallback for: Chat analysis, Drops, DreamPro

Optional (Can Share or Use Separate)

2. CHAT_CRON_SECRET

   • Used by: Note analysis cron
   • Falls back to: WORKOUT_WINDOW_CRON_SECRET if not set

3. DROPS_CRON_SECRET

   • Used by: Daily drops generation, Monthly drops award
   • Falls back to: WORKOUT_WINDOW_CRON_SECRET or CHAT_CRON_SECRET if not set

4. ENCOURAGEMENT_DROPS_CRON_SECRET

   • Used by: Engagement processing
   • Falls back to: DROPS_CRON_SECRET or WORKOUT_WINDOW_CRON_SECRET if not set

5. SPOTIFY_SYNC_CRON_SECRET

   • Used by: Spotify sync cron
   • No fallback - must be set if using Spotify sync

6. DREAMPRO_CRON_SECRET

   • Used by: DreamPro step prompts
   • Falls back to: WORKOUT_WINDOW_CRON_SECRET if not set

Quick Setup (Simplest Approach)

Option 1: Use One Secret for Everything

Generate one secret and use it for all:

# Generate one secret
openssl rand -hex 32
# Example output: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

Then set these environment variables to the same value:

• WORKOUT_WINDOW_CRON_SECRET
• CHAT_CRON_SECRET
• DROPS_CRON_SECRET
• ENCOURAGEMENT_DROPS_CRON_SECRET
• SPOTIFY_SYNC_CRON_SECRET
• DREAMPRO_CRON_SECRET

Option 2: Use Separate Secrets (More Secure)

Generate a unique secret for each:

# Generate 6 different secrets
for i in {1..6}; do
  echo "Secret $i: $(openssl rand -hex 32)"
done

Where to Set Environment Variables

Vercel (Frontend)

1. Go to your Vercel project dashboard
2. Click Settings → Environment Variables
3. Add each variable:
   • Name: WORKOUT_WINDOW_CRON_SECRET
   • Value: your-generated-secret-here
   • Environment: Select all (Production, Preview, Development)
4. Repeat for all secrets
5. Important: After adding variables, redeploy your project

Railway (Backend)

1. Go to your Railway project dashboard
2. Click on your backend service
3. Go to Variables tab
4. Add each variable:
   • Key: WORKOUT_WINDOW_CRON_SECRET
   • Value: your-generated-secret-here
5. Repeat for all secrets
6. Railway will automatically redeploy when you add variables

Important: Keep Secrets in Sync

The same secret must be set in both Vercel AND Railway for each cron job to work.

For example:

• If WORKOUT_WINDOW_CRON_SECRET in Vercel is abc123
• Then WORKOUT_WINDOW_CRON_SECRET in Railway must also be abc123

Example Setup Script

Here's a script to generate all secrets at once:

#!/bin/bash

echo "Generating cron secrets..."
echo ""
echo "WORKOUT_WINDOW_CRON_SECRET=$(openssl rand -hex 32)"
echo "CHAT_CRON_SECRET=$(openssl rand -hex 32)"
echo "DROPS_CRON_SECRET=$(openssl rand -hex 32)"
echo "ENCOURAGEMENT_DROPS_CRON_SECRET=$(openssl rand -hex 32)"
echo "SPOTIFY_SYNC_CRON_SECRET=$(openssl rand -hex 32)"
echo "DREAMPRO_CRON_SECRET=$(openssl rand -hex 32)"
echo ""
echo "Copy these values to:"
echo "1. Vercel Environment Variables"
echo "2. Railway Environment Variables"

Save as generate-secrets.sh, make executable (chmod +x generate-secrets.sh), and run it.

Verification

After setting up secrets, test a cron endpoint:

# Test from your local machine (replace with your actual values)
curl -X POST https://your-frontend.vercel.app/api/cron/workout-window/generate-chains

# Should return either:
# - Success response (if secrets match)
# - 401 Unauthorized (if secrets don't match)
# - 500 error (if secret not configured)

Security Best Practices

1. Never commit secrets to git - They should only be in environment variables
2. Use different secrets for production and development if needed
3. Rotate secrets periodically (every 6-12 months)
4. Use strong random strings (at least 32 characters)
5. Don't share secrets in chat, email, or documentation

Troubleshooting

Error: "WORKOUT_WINDOW_CRON_SECRET not configured"

• Solution: Add the secret to Vercel environment variables and redeploy

Error: 401 Unauthorized

• Solution: Check that the secret in Vercel matches the secret in Railway

Error: Cron job not running

• Solution:
  1. Check Vercel dashboard → Cron Jobs tab
  2. Verify environment variables are set
  3. Check that NEXT_PUBLIC_API_URL is set correctly in Vercel

Quick Reference

Minimum setup: Just set WORKOUT_WINDOW_CRON_SECRET and most jobs will work (except Spotify sync if you use it).