AWS Lambda Primer

Architecture

Client → API Gateway (HTTPS) → Lambda (Node.js 20.x) → Upstash KV for rate-limit counters. The Lambda validates Ed25519 license tokens, checks hardware-fingerprint replay, and returns a signed session grant.

Cold-Start Budget

• 128 MB memory — cheapest tier, ~200 ms init
• Provisioned concurrency optional for latency-sensitive paths
• Keep deployment package under 5 MB (no native deps)
• Use @vercel/functions helpers for parity with Vercel edge

Handler Skeleton

export async function handler(event) {
  const { license, fingerprint } = JSON.parse(event.body);
  const valid = await verifyEd25519(license);
  if (!valid) return { statusCode: 403 };
  const grant = signSessionGrant(fingerprint);
  return { statusCode: 200, body: JSON.stringify(grant) };
}

Environment Variables

Store NIMBUS_PUBLIC_KEY and UPSTASH_REDIS_URL in Lambda environment variables. Never hard-code secrets.