Nakodo is a background product. A customer sets a campaign up once, and after that the work happens while nobody is looking: searching, reading, writing, sending, cleaning up after itself. The page that explains it to customers is how it works , and none of what it describes is triggered by a request from a browser.

So there has to be a clock. Ours is nine lines:

{ "$schema" : "https://openapi.vercel.sh/vercel.json" , "crons" : [ { "path" : "/api/cron/pipeline" , "schedule" : "*/5 * * * *" }, { "path" : "/api/cron/outreach" , "schedule" : "*/5 * * * *" }, { "path" : "/api/cron/maintenance" , "schedule" : "15 9 * * *" }, { "path" : "/api/cron/indexnow" , "schedule" : "20 * * * *" } ] }

Enter fullscreen mode

Exit fullscreen mode

That is 288 plus 288 plus 24 plus 1, so 601 invocations a day, and every one of them is a plain GET to a URL that anybody can type.

You can try them

They are live, so this is reproducible:

$ curl -s -o /dev/null -w '%{http_code}\n' https://nakodo.app/api/cron/pipeline 401 $…