08 Lambda Authorizer

title: Lambda Authorizers for Serverless API Security weight: 18 date: 2026-06-28 lastmod: 2026-06-28 description: Implement Lambda authorizers for serverless API authentication including JWT verification, custom token validation, and caching authorization decisions with IAM policies. tags: [api-development, serverless]

Lambda authorizers validate tokens and return IAM policies that grant or deny API Gateway access, supporting JWT verification, custom authentication logic, and caching authorization decisions to reduce latency.

```python
import json
import jwt

def lambda_handler(event, context):
    token = event["authorizationToken"].replace("Bearer ", "")

    try:
        payload = jwt.decode(token, "your-secret", algorithms=["HS256"])
        user_id = payload["sub"]
        role = payload.get("role", "user")
    except jwt.ExpiredSignatureError:
        return generate_policy("user", "Deny", event["methodArn"])
    except jwt.InvalidTokenError:
        return generate_policy("user", "Deny", event["methodArn"])

    # Grant access with user context
    policy = generate_policy(user_id, "Allow", event["methodArn"])
    policy["context"] = {"user_id": user_id, "role": role}
    return policy

def generate_policy(principal_id, effect, resource):
    return {
        "principalId": principal_id,
        "policyDocument": {
            "Version": "2012-10-17",
            "Statement": [{"Action": "execute-api:Invoke", "Effect": effect, "Resource": resource}]
        }
    }

What's Next

Now learn about Lambda DynamoDB integration in Building Serverless APIs.