Upstash QStash
Serverless HTTP message queue that delivers webhooks to any URL with built-in retry, delay, scheduling, and fan-out — no broker infrastructure required.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
HMAC request signing protects receiving endpoints from spoofed deliveries. TLS enforced. No per-topic ACLs — all topics share the same QStash token. Signing key rotation requires updating all receiving endpoints simultaneously.
⚡ Reliability
Best When
You need reliable, retryable HTTP delivery of tasks to serverless functions or webhooks without standing up or managing any queue infrastructure.
Avoid When
Your consumers cannot expose an HTTP endpoint (e.g., long-running background workers that pull from a queue), or you need ordered, exactly-once delivery guarantees.
Use Cases
- • Queue long-running agent subtasks as HTTP callbacks so the originating serverless function can return immediately without timeout risk
- • Schedule recurring agent jobs (cron) to trigger data collection, report generation, or model re-evaluation at defined intervals
- • Fan-out a single agent event to multiple downstream services simultaneously using QStash topics
- • Implement delayed retries when an external API is rate-limited — publish message with a delay of minutes or hours
- • Decouple agent pipeline stages by publishing intermediate results as messages rather than chaining synchronous HTTP calls
Not For
- • High-throughput streaming workloads requiring sub-millisecond delivery or millions of messages per second
- • Point-to-point consumer-pull queue patterns (Kafka/SQS model) — QStash pushes to HTTP endpoints, not polled by consumers
- • Message persistence beyond the retry window — QStash is not a durable event log like Kafka or Kinesis
Interface
Authentication
QStash token used as Bearer token. Receiving endpoints are verified via HMAC signature on the request body using a signing key — agents must validate this signature to prevent spoofed deliveries.
Pricing
No idle infrastructure cost. Message size limit is 1 MB on free tier, 10 MB on paid. Scheduling (cron) counts as a message per trigger.
Agent Metadata
Known Gotchas
- ⚠ Receiving endpoints must respond within 30 seconds or QStash marks the delivery as failed and retries — long agent tasks must acknowledge immediately and process asynchronously
- ⚠ HMAC signature validation of incoming messages is not optional for security — skipping it allows any actor to POST fake messages to your endpoint
- ⚠ Retry backoff is exponential but the maximum retry count is plan-limited — ensure retry count matches your fault tolerance needs before relying on auto-retry
- ⚠ QStash does not support message ordering — parallel deliveries may arrive out of sequence at the destination endpoint
- ⚠ Cron schedules use UTC timezone only; agents must convert expected local times carefully or risk off-by-one-hour bugs around DST transitions
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Upstash QStash.
Scores are editorial opinions as of 2026-03-06.