Promptwatch Logo

QStash

QStash is a platform for building event-driven applications.
QStash
Webhook

What is QStash?

QStash is Upstash's HTTP message delivery service. A publisher sends a message and destination URL to QStash, which stores the message before calling that destination immediately, after a delay, or on a schedule. The request in the destination's logs represents a message chosen by the publisher, not a page that QStash discovered while browsing.

Every delivery includes a JWT in the Upstash-Signature header. The token is signed with the account's QStash signing key and contains claims for the issuer, destination URL, validity window, and SHA-256 hash of the raw body. Upstash provides current and next signing keys so receivers can continue verifying requests during rotation.

A destination signals success with a 2xx response. QStash retries unsuccessful delivery three times by default, and the publisher can change the count or delay. Because a response can be lost after the destination has already acted, handlers must be prepared to receive the same message again.

QStash moves application messages to explicit URLs. This delivery does not make the destination's content available to AI search or training systems. Robots.txt is not part of the protocol.

Not relevant for AI search

Is QStash relevant for AI search?

No. QStash is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

QStash is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle QStash

Expose the destination route only when the application expects QStash messages. Use the official QStash Receiver with both the current and next signing keys, and pass it the untouched body, Upstash-Signature value, and public destination URL. A manual verifier must also check the iss, sub, exp, nbf, and body-hash claims.

Reject a missing or invalid JWT before parsing the message into a business action. Make the action idempotent, then return 2xx once the message has been accepted. If the endpoint needs more time after a failure, QStash supports retry configuration at publish time and honors documented retry response headers.

When delivery is no longer wanted, remove the publisher, schedule, or callback configuration and close the route. Matching the QStash user agent does not authenticate the sender, and robots.txt cannot block a queued HTTP message.

Examples

  • A serverless application publishes an order ID to QStash so a worker endpoint can process it after the checkout response has finished.
  • A scheduled QStash message calls a maintenance route, whose handler verifies the JWT against the current and next signing keys.
  • A destination returns 503, and QStash retries the stored message without requiring the publisher to send it again.

Frequently asked questions about QStash

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

It delivers the HTTP method, headers, and body supplied by a publisher to the publisher's chosen destination URL.

Be the brand AI recommends

Monitor your brand's visibility across ChatGPT, Claude, Perplexity, and Gemini. Get actionable insights and create content that gets cited by AI search engines.

Promptwatch Dashboard