An open-source, self-hosted production monitor for Next.js and Vercel applications. SquareDevDoctor combines synthetic API checks, request history, webhook inspection, automatic incident records, deployment context, and outage/recovery alerts.
The included configuration monitors Miss Pia Hair's Square booking integration, but the code is designed to be adapted for other applications.
- Validated HTTP health probes with status, latency, and response-shape checks
- Retained API/probe event history
- Generic webhook ingestion with secret verification
- Native Square HMAC-SHA256 webhook verification
- Payload redaction for common sensitive fields
- Automatic incident opening and recovery tracking
- Email alerts through Resend
- Slack, Discord, Teams, or custom notifications through an outgoing webhook
- Latest Vercel production deployment context
- Password-protected dashboard
- Redis-compatible persistence in production and zero-setup in-memory storage locally
npm install
cp .env.example .env.local
npm run devOpen http://localhost:3000 and sign in using MONITOR_USERNAME and MONITOR_PASSWORD.
Set KV_REST_API_URL and KV_REST_API_TOKEN to an Upstash-compatible Redis REST endpoint. Without them, SquareDevDoctor runs normally but history lasts only for the current server process.
Configure either or both:
ALERT_WEBHOOK_URL: Slack, Discord, Teams, automation platform, or custom receiver.RESEND_API_KEY,ALERT_EMAIL_TO, and optionallyALERT_EMAIL_FROM: outage and recovery email.
Alerts are sent only on state transitions, rather than on every scheduled check. An incident is opened on the first failure and resolved when all checks recover.
Generic services post to:
POST /api/webhooks/{source}
X-SquareDevDoctor-Secret: your-WEBHOOK_INGEST_SECRET
Square posts to /api/webhooks/square. Configure SQUARE_WEBHOOK_SIGNATURE_KEY and the exact public endpoint as SQUARE_WEBHOOK_NOTIFICATION_URL. SquareDevDoctor validates x-square-hmacsha256-signature before accepting the event.
Webhook payload fields matching tokens, secrets, passwords, authorization, cookies, cards, email, phone, or addresses are redacted before storage.
vercel.json contains a daily check compatible with the Hobby plan. Vercel Pro can change it to every five minutes:
{ "path": "/api/check", "schedule": "*/5 * * * *" }Set CRON_SECRET; Vercel supplies it as the bearer token for cron invocations. For stronger availability, run the same authenticated route from a second external uptime service so a Vercel-wide failure can still alert you.
- Use a narrowly scoped, read-only Vercel token.
- Never place the monitored application's Square access token in SquareDevDoctor.
- Rotate dashboard, ingest, cron, and webhook signing secrets.
- Keep the dashboard private even though the source code is public.
- See SECURITY.md before exposing webhook ingestion publicly.
MIT