Netlify Functions 2026-08-31

Use these rules for the modern Netlify serverless Functions API as documented on 2026-08-31: JavaScript or TypeScript handlers using web Request and Response, including background, scheduled, and platform-event functions. Apply Lambda compatibility guidance to named handler(event, context) exports and Go functions; Edge Functions use a separate runtime and API.

Runtime and deployment boundary

• Select a supported Node.js runtime deliberately; Node.js 22 and 24 are supported LTS choices, while Node.js 20 has reached end of support. Prefer Node.js 24 for new work and verify the runtime actually deployed instead of assuming it matches local development.
• Set AWS_LAMBDA_JS_RUNTIME, such as nodejs24.x, through the Netlify UI, CLI, or API and redeploy to apply it; setting it in netlify.toml does not configure the function runtime. Without an override, Netlify follows the build's eligible Lambda Node.js version or falls back to Node.js 24; versions nearing deprecation are ineligible.
• Keep the functions directory outside the publish directory. Review every function entry point and generated bundle, and narrowly configure included_files and external_node_modules so credentials, private data, development handlers, and unintended files are not shipped.
• Keep user, tenant, token, request, and authorization state local to each invocation. Call getContext() only within an active request; never cache its result or an authenticated user in module-level state.
• Treat temporary files as disposable, allocate isolated paths, and remove sensitive temporary data when