Drive your scheduled jobs from your own code: a REST API with scoped keys and per-key rate limits, the full execution history of every run, and signed webhooks when something happens.
API keys
The Cron REST API lets your own backend do everything the dashboard does with your scheduled jobs: create and edit them, run one immediately, and read what happened on every past run.
Open your project in the Cron dashboard and create an API key under API keys. The secret is shown once, when the key is created, and never again — store it somewhere safe. A key belongs to a single project, so the project is implied by the key and never has to be sent.
Authenticate every request with HTTP Basic auth carrying only the key secret, base64-encoded, in the Authorization header.
# The Authorization header is HTTP Basic auth carrying only the key secret,
# with no username and no colon.
Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)Every endpoint lives under https://api.cron.cool. Requests made with a key are rate limited per key; going over the limit returns 429.
Quick start
List the jobs of your project, schedule a new one, then read its execution history.
# List the cron jobs of the project the key belongs to
curl https://api.cron.cool/api/jobs \
-H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)"
# Create a job that calls your endpoint every five minutes.
# expression is an EventBridge Scheduler expression — rate(5 minutes) or
# cron(0/5 * * * ? *), not a five-field unix crontab line.
curl -X POST https://api.cron.cool/api/jobs \
-H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)" \
-H "Content-Type: application/json" \
-d '{
"name": "warm-cache",
"type": "webhook",
"expression": "rate(5 minutes)",
"url": "https://example.com/warm-cache",
"httpMethod": "POST",
"contentType": "application/json",
"input": { "reason": "scheduled warm-up" }
}'
# Read the last executions of that job
curl https://api.cron.cool/api/jobs/JOB_ID/executions?limit=20 \
-H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)"Browse the full API reference — every endpoint with its parameters, request body, responses and required scope.
CLI
The same projects, jobs and execution status are available from your terminal through the croncool CLI. Install it globally with npm, or run it ad hoc with npx.
Authentication is one command: croncool login opens your browser to sign in to your Croncool account and stores a session for later commands — no API key to paste.
# Install once, globally
npm install -g croncool
# or run it ad hoc without installing
npx croncool --help
# Log in — opens your browser to sign in and stores a session
croncool login
# List your projects with their ids
croncool projects list
# The jobs of one project, with schedule and id
croncool jobs list --projectId PROJECT_ID
# One job's schedule, target and last execution status
croncool jobs read JOB_ID
# Fire a job right now
croncool jobs execute JOB_IDThe CLI is open source at github.com/croncool/cli and published as croncool on npm. Run any command with --help to see its options.
Scopes
Each key carries a list of scopes, so an integration that only needs to watch your jobs never gets the ability to change them. New keys start read-only; widen them explicitly in the dashboard. A request whose key is missing the scope an endpoint requires is refused with 403.
The workflows:read and workflows:write scopes gate the endpoints the hosted workflow runtime calls on your behalf. The reference at /api/ covers the job and webhook subscription endpoints you call yourself; the workflow endpoints are not part of it.
MCP connector
Croncool’s remote MCP connector lets an assistant inspect the projects, jobs, executions, durable workflows and webhook delivery health already available to your signed-in organization. Add the same production URL in any host that supports remote MCP over HTTP:
https://mcp.cron.cool/mcpChoose the host’s option to add a custom connector or MCP server, paste that URL, then complete Croncool’s OAuth sign-in and consent screen. Never paste an API key into a conversation. OAuth keeps every call inside the organization and scopes approved for that signed-in account.
Connector results use field-by-field allowlists. Job request inputs, target URL userinfo, paths, queries and fragments, execution response bodies and errors, workflow inputs and outputs, webhook endpoint paths and queries, signing secrets, credentials, tokens and organization ownership fields are never model-visible. Target and webhook destinations are reduced to their HTTP or HTTPS origin.
run_job is the only state-changing connector tool. It invokes the request already configured on one exact job. That downstream service can write data, send messages, charge for work or trigger another third party. Croncool does not add an idempotency key or application timeout, so the outcome can be unknown after a transport timeout and repeating the call can duplicate effects. The assistant must first show the exact job and target origin, ask for explicit confirmation, invoke it once, and use get_job_runs to check the recorded outcome instead of retrying automatically.
Agent Skills
Croncool ships Agent Skills — guides following the agentskills.io standard that teach coding agents how to inspect and operate scheduled jobs with the croncool CLI and the MCP connector, instead of guessing at commands and tools.
# Install the Croncool skills into your coding agent
npx skills add croncool/skillsOne command installs the skills into Claude Code, Cursor, Codex, Gemini CLI and any other agent that follows the Skills standard. The CLI also bundles the same guides, version-matched to the commands it ships: croncool skills get <name> prints one on demand.
The skills are open source at github.com/croncool/skills. Claude users can also install the Croncool Claude plugin, which bundles the connector together with the skills: github.com/croncool/claude-plugin.
Webhooks
Add a webhook subscription to your project and Cron POSTs the events you picked to your server as they happen.
POST https://your-server.com/cron-webhook
X-Croncool-Event: job.executed
X-Croncool-Signature: t=1719000000,v1=<hmac-sha256 hex>
Content-Type: application/json
{
"event": "job.executed",
"timestamp": 1719000000,
"data": { "...": "..." }
}Every delivery carries an X-Croncool-Signature header of the form t=timestamp,v1=signature, where the signature is an HMAC-SHA256 of timestamp.body keyed by the subscription secret shown to you once when the subscription was created. Recompute it over the raw body and compare before trusting the payload.
import crypto from 'node:crypto'
// body must be the RAW request body, byte for byte
function verify(header, body, secret) {
const [t, v1] = (header || '').split(',').map(part => part.split('=')[1])
if (!t || !v1) return false
const expected = crypto
.createHmac('sha256', secret)
.update(`${t}.${body}`)
.digest('hex')
// timingSafeEqual throws on a length mismatch, so a malformed signature
// has to be rejected before the comparison rather than by it.
if (v1.length !== expected.length) return false
return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))
}Delivery is one best-effort attempt with a five second timeout and no retries, so respond 2xx quickly and do the work asynchronously. An endpoint that fails twenty times in a row is disabled automatically and has to be re-enabled in the dashboard.
Start building