author here... I have nothing against CoffeeScript, so that's not really a blocker. For access keys, so far I stored them as stage variables in the API Gateway

author here... I have nothing against CoffeeScript, so that's not really a blocker. For access keys, so far I stored them as stage variables in the API Gateway config. Claudia adds all stage variables to the env key of the request passed to the Node.js handler. That way, they are instantly available to your function, but never shared with Web clients. I'm not entirely sure how secure this is, but the use cases I used it for are not highly risky. This is, I imagine, equivalent to storing them in the ENV variables for heroku services. (what I migrated from) one additional benefit of stage vars is that you can use different values for production, dev and testing, and it all works out of the box.