402cron vs Upstash QStash

402cron

A public OpenAPI 3.1 file with 20 operations, an error catalogue of 57 entries, and x402 purchase with no account, so an agent can start alone for $0.02. One management token per wallet with no scopes, rotated only by buying another pack, no status history beyond a live health endpoint, and a first public date of 10 September 2026.

Upstash QStash

A public OpenAPI 3.1 file covers 43 operations, and publishing has no per-second limit, deduplication IDs and a dead letter queue with replay. Each region has one full-access token and one read-only token, and the token may travel in the URL. The Markdown pricing page contradicts itself on whether retries are billed.

402cron

1. Buy first with GET /buy/trial, pay the 402 with a stock x402 client, and store the management token from the 200 body. It's shown once; losing it costs another purchase with ?rotate=1.
2. Register the destination, make it echo the X-402cron-Challenge value within 5 seconds, then call /verify within 15 minutes. A fixed-response catch URL can't pass.
3. Branch on the error code and the HTTP status, never on message. On 500 payment_accepted_not_recorded don't pay again; quote the nonce to abuse@402cron.com.
4. Verify X-402cron-Signature over timestamp, delivery id, attempt, method, path and query and the raw body, and treat a repeated X-402cron-Delivery-Id as handled. Delivery is at least once.
5. Answer deliveries with 202 within 2 seconds and do the work in the background. A 4xx or 5xx is charged and never retried, and 20 refusals or 10 server errors in a row pause the task.
6. Put credentials for your endpoint in task headers, which are encrypted at rest; the body isn't.

Upstash QStash

1. Use the regional host that matches the token. qstash.upstash.io is the EU region, and US tokens work only on qstash-us-east-1.upstash.io
2. Send Upstash-Deduplication-Id on every publish so a retried request isn't queued twice. The window is 10 minutes
3. Budget for retries. Per the pricing FAQ each delivery attempt is billed as a message, so set Upstash-Retries deliberately
4. Give monitoring agents the read-only token, and set Upstash-Redact-Fields on publish, because that token still reads message bodies and headers
5. Make the destination idempotent on Upstash-Message-Id. Delivery is at least once, and duplicates can follow a server restart