Thanks for your question! You’re absolutely spot on, auth is a really hard problem to get right! When it comes to JAMstack, auth can be handled using any auth as a service library like Auth0, Okta or Netlify Identity, which is an auth service we offer to Netlify users. As for API keys and making sure those don’t get leaked, serverless functions as you mentioned are really handy for that. Netlify support env variables, so you could pass in API keys to your functions that way. You could also use a service like AWS Parameter Store to store your secrets, and I believe that integrates nicely with the Serverless Framework, if you choose to go down that path. The downside to the approaches ,mentioned of course if that it’s possible for malicious users to abuse functions since environment variables can become exposed as a result. One way to potentially counteract this is to make sure that your function end points are not “guessable”, meaning that you could do a redirect so accessing /api actually routes to /.netlify/functions/WHATEVERFUNCTIONNAME which performs an API call to whatever service you're trying to access. Hope this helps!