If your team needs a small API for payment webhooks and a few nightly jobs, and nobody wants to run a server for it, this is for you. Nitro on Vercel is a good fit, once three settings are right.
When is Nitro the right size for the job?
In plain words, Nitro is a small server for code with no pages: the part that receives a payment notice or sends the morning reminders. Technically, it is a small TypeScript server. Vercel describes it as "a full-stack framework with TypeScript-first support" with filesystem routing, built-in caching and multi-driver storage, and says it enables "deployments from the same codebase to any platform with output sizes under 1MB". It is also the server engine under Nuxt and the way Vercel runs TanStack Start.
On Vercel it deploys "with zero configuration". Each server route becomes a Vercel Function on Fluid compute, so it scales with traffic and you pay for the CPU it uses.
Our rule: if the job is a handful of routes and scheduled tasks with no pages, such as webhooks from a payment gateway, a nightly export, or a feed another site reads, Nitro is the right size. If people log in and use screens, pick a full framework instead.
What breaks first with scheduled jobs?
Three things, and none of them shows up in testing. The job runs, so everyone assumes it is fine.
The endpoint is open without a secret. Vercel's docs say you secure cron jobs "by adding an environment variable called CRON_SECRET", which Vercel then sends as an Authorization header on each call. Nitro registers its own cron handler on Vercel. An issue opened on 21 August 2026 points out that this handler checks the secret only when CRON_SECRET is set, so without it "any configured scheduled task can be executed on demand, repeatedly". The reporter filed it as a hardening suggestion, not a vulnerability claim, and a maintainer replied that Nitro matches Vercel, where the secret is optional. The fix on your side is one variable: set it.
The clock is UTC. Vercel's cron docs say "the timezone is always UTC". Dubai is four hours ahead, so a reminder you want at 7:00 in Dubai is 0 3 * * *.
Hobby will not do. Hobby is for non-commercial, personal use only. It also limits cron jobs to once a day, and a job set for 1:00 can run any time up to 1:59. Pro and Enterprise run as often as once a minute, with per-minute precision. Every plan allows 100 cron jobs per project.
How do you cache answers that change once a day?
So that a list that changes once a day is not rebuilt for every visitor, which keeps it fast and the bill flat. Some routes return the same answer all day: a delivery rate table, a list of available units, a price list another site reads. Nitro on Vercel can serve those with Incremental Static Regeneration (ISR), so the function runs once and the cached answer is served after that.
You set isr on the route in nitro.config.ts, with an expiration in seconds or none at all. To refresh it on demand, for example when your team changes a price, you set a BYPASS_TOKEN and send a request with the x-prerender-revalidate header. If the route takes a query string such as ?area=marina, list it in allowQuery so each area is cached on its own.
For performance by route, Vercel says Nitro 2.12 or later with a compatibility date of 2025-07-15 or later sends routing hints to Observability. Set it, so you can see which route is slow.
What does it cost to run, as of 16 October 2026?
Under a dollar of usage for the example below, by our arithmetic. Vercel says cron jobs are included in all plans and are billed as the functions they call.
In one line: USD 20 a month for each deploying seat, and well under a dollar of usage for the sample below, inside the included credit. Our arithmetic for the property manager below, from list prices at Mumbai rates, not a measured bill. Assume one reminder job a night for 30 nights, each using 60 s of Active CPU with 2 GB held for 90 s, and 3,000 payment webhooks a month at 100 ms of CPU and 300 ms held. That is 0.58 CPU hours (USD 0.08), 2 GB-hours (USD 0.02) and almost no invocation cost: about USD 0.10, inside the USD 20 credit.
We are not a Vercel partner and earn nothing from your Vercel bill. Our own site runs on Netlify. What stays portable: Nitro builds the same code for other hosts. What is Vercel's: the cron schedule, CRON_SECRET handling and the ISR cache.
The detail that keeps the bill small: Vercel says time spent waiting on a database or another API "does not count towards active CPU time". A webhook that waits two seconds for a payment gateway pays for the milliseconds of work, not the wait. Set a sensible maximum duration anyway. Pro allows 300 seconds by default and up to 800.
Region matters more than price. Functions run in Washington, D.C. (iad1) unless you change it, and there is no region in the UAE or Saudi Arabia. Put the API in the region nearest your database; for Gulf teams that is often Mumbai (bom1).
What does this look like for a property manager?
Take a sample Dubai property manager that wants rent reminders sent each morning and payments marked as they arrive. This is an illustration, not a client story.
- 0103:00 UTC (07:00 Dubai). Vercel calls the cron endpoint with the secret. Nitro checks it and runs the reminder task.
- 02The task reads which rents fall due in three days from the property system and sends each tenant a reminder through the company's WhatsApp provider.
- 03A tenant pays. The payment gateway calls the Nitro webhook, which checks the gateway's signature and marks the rent paid.
- 04A cached route serves the list of vacant units to the website, refreshed with the bypass token when the leasing team changes it.
- 05Each morning the operations lead reads one log line per task: how many reminders, how many failed, and why.
If the real gap is that leases and payments live in spreadsheets, an API will not fix it. See how we work with property management teams, and Mindcat Lease for one schedule per lease.
What goes on the security questionnaire?
Vercel splits the answers in its shared responsibility model, read on 16 October 2026. Here is who writes each line.
If a contract says data must be processed inside the UAE, Vercel cannot meet it today. Say so before you sign, not after.
For a bad month, set Spend Management. Vercel sends alerts at 50%, 75% and 100% of the amount you set, and pauses production when you reach it if Pause Production Deployments is on. A budget alone does not stop usage, and the check can lag by several minutes. If a change breaks the site, Instant Rollback on Pro returns production to any earlier production deployment from the dashboard; environment variable changes are not rolled back with it. For the jobs here, add one line: the cron endpoint checks CRON_SECRET, and webhooks check the sender signature.
What do you check before the first night?
- 01CRON_SECRET is set in production, a random string of 16 characters or more, as Vercel recommends.
- 02Every schedule is written in UTC, with the local time in a comment next to it.
- 03The team is on Pro, so jobs can run more than once a day and on time.
- 04Webhooks check the sender's signature, not just the URL.
- 05The function region sits next to the database it reads.
- 06Someone named reads the failure line each morning.
If your nightly job is one export a week that a person can run by hand in five minutes, keep doing it by hand until it hurts.
What happens on the first call?
We call the method Preview every change: each change gets its own preview link, someone on your side approves it on a phone, then it goes live, and any release can be rolled back. Send us the jobs and webhooks you need and where they run today. The written assessment is free and says what to build, what to keep and what it costs to run. The first build week is a fixed AED/SAR 14,900, and a Run plan keeps the jobs watched afterwards. More on how we build and run this work is on our Vercel page.
