Spend Management setup.

[fckngold]

Summary

I could not find step-by-step instructions on how to set up spend limits on Vercel. Therefore, I want to clarify one nuance in order to be sure that I did everything right and at the same time help those people who will face the same problem in the future.

Example

No response

Steps to Reproduce

So what did I do step by step:
– I made a token in my personal account settings. Let's call it PAUSE_SECRET
– On the team's Billing page set a limit in the Spend Management section. In the webhook input I set url https://mysite.com/api/pause-endpoint?token=PAUSE_SECRET. When installing the webhook Vercel gave me another token for verification, let's call it WEBHOOK_SECRET
– On Environment Variables page added the WEBHOOK_SECRET to the project environment variables
– In the project folder (/pages/api) I created a file(pause-endpoint.js) with this code

import crypto from 'node:crypto';

async function verifySignature(request) {
    const payload = await request.text();
    const signature = crypto.createHmac('sha1', process.env.WEBHOOK_SECRET).update(payload).digest('hex');

    return signature === request.headers['x-vercel-signature'];
}

export default async function handler(request, response) {
    const token = request.query.token;
    const verifiedSignature = verifySignature(request);

    if (verifiedSignature) {
        const result = await fetch('https://api.vercel.com/v1/projects/%prjID%/pause?teamId=%teamID%', {
            'method': 'post',
            'headers': {
                'Content-Type': 'application/json',
                'Authorization': `Bearer ${token}`
            }
        });
        const data = await result.json();

        return response.status(200).json(data);
    } else {
        return response.status(403).end();
    }
}

Thus if the limit is triggered Vercel will send a POST request to my url. Then I check the signature that it is really a Vercel, then I take the token from the request url and make a pause request. Is that right? Or should I save PAUSE_SECRET in my env variables and substitute it from there (and not take it from the request url)? But then how to understand that the request that Vercel made (in case of exceeding the limit) is exactly what I need? Do I need to take some status code from the request? On the page I didn't find anything suitable. Thanks.

[mpandzo]

@fckngold you store the token in your env keys.

You find information about the webhook payload here:
https://vercel.com/docs/accounts/spend-management#webhook-payload

Vercel will automatically and instantly send a [HTTPS POST request](https://vercel.com/docs/accounts/spend-management#webhook-payload) to the URL that you provide when the following events happen:

[When a spend amount reaches 100%](https://vercel.com/docs/accounts/spend-management#spend-amount)
[At the end of your billing cycle](https://vercel.com/docs/accounts/spend-management#end-of-billing-cycle)

You may find the following useful:

https://gist.github.com/borispoehland/2738d2edd62e83f332260a80eb5a9335
https://github.com/marcelmeulemans/pause-vercel-projects

Keep in mind, both of the above do not add a Content-Type header that is actually required per the docs: https://vercel.com/docs/projects/overview#pausing-a-project

Ensure that your Content-Type header is set to application/json

In addition, the pause-vercel-projects actually takes into account the incoming payload which determines whether the budget has been surpassed or whether you are at the end of the billing cycle. If you used only the code from the gist you'd end up pausing the project every month.