AWS Lambda

In the AWS Lambda console, open your function and click the 'Configuration' tab, then 'Function URL' in the left sidebar. Click 'Create function URL.' Set Auth type to 'NONE' (you will add your own shared-secret header for security in the next step). Under CORS settings, if you plan to test in FlutterFlow's web Run mode (which runs in a browser), enable CORS: set 'Allow origin' to `*` or your specific domain, 'Allow headers' to `Content-Type, X-Api-Key` (or whatever header name you choose for your shared secret), and 'Allow methods' to `POST, GET, OPTIONS`. Click 'Save.' AWS displays the Function URL — it looks like `https://abcdef1234567890.lambda-url.us-east-1.on.aws/`. Copy this URL; you will use it as the base URL in FlutterFlow. Important: a Function URL with NONE auth is public by URL knowledge — anyone who knows the URL can call it. The shared-secret header you add in the next step is the access control layer. For production apps with sensitive data, consider placing the function behind API Gateway with API key validation instead.

1// Minimal Lambda handler that returns JSON
2// Runtime: Node.js 20.x
3exports.handler = async (event) => {
4  // Parse the request body from FlutterFlow
5  const body = JSON.parse(event.body || '{}');
6  const userInput = body.inputText || '';
7
8  // Verify the shared secret header
9  const secret = event.headers['x-api-key'] || '';
10  if (secret !== process.env.SHARED_SECRET) {
11    return {
12      statusCode: 401,
13      headers: { 'Content-Type': 'application/json' },
14      body: JSON.stringify({ error: 'Unauthorized' })
15    };
16  }
17
18  // Your business logic here
19  const result = `Processed: ${userInput}`;
20
21  return {
22    statusCode: 200,
23    headers: {
24      'Content-Type': 'application/json',
25      'Access-Control-Allow-Origin': '*'
26    },
27    body: JSON.stringify({ output: result })
28  };
29};

In your FlutterFlow project, click 'API Calls' in the left navigation toolbar (it looks like a plug or connection icon). Click '+ Add' and choose 'Create API Group.' Give the group a name that matches your Lambda function — for example 'LambdaBackend' or 'AIProxy.' In the 'Base URL' field, paste your Lambda Function URL: `https://abcdef1234567890.lambda-url.us-east-1.on.aws`. Do not include a trailing slash. Now add your shared-secret header to the API Group so it applies to all calls in this group. Click the 'Headers' tab inside the API Group editor. Click '+ Add Header,' set the name to `X-Api-Key` (or whatever header name you chose in your Lambda handler), and set the value type to 'Value' — then paste your shared secret value. Since this is a security header and FlutterFlow API Call headers ship in the compiled app, use a value that is not a high-privilege AWS credential — it is just a shared secret that gates access to your Lambda, not an AWS access key. Click 'Save.' The API Group is now configured as a container for individual API Calls that all share this base URL and auth header.

1{
2  "api_group_name": "LambdaBackend",
3  "base_url": "https://<your-function-url>.lambda-url.<region>.on.aws",
4  "headers": [
5    {
6      "name": "Content-Type",
7      "value": "application/json"
8    },
9    {
10      "name": "X-Api-Key",
11      "value": "<your-shared-secret>"
12    }
13  ]
14}

Inside the 'LambdaBackend' API Group, click '+ Add' and choose 'Create API Call.' Name the call descriptively — for example 'ProcessUserInput.' Set the method to POST. In the 'Endpoint' field, enter the path after your base URL: if your function handles everything at the root, leave this blank or enter `/`. Click the 'Variables' tab. Here you define the dynamic parts of your request that will be filled in from app state at runtime. Click '+ Add Variable,' name it `inputText` (matching the field name your Lambda expects in the request body), set its type to String, and mark it as required. Now click the 'Body' tab and set the body type to JSON. In the JSON body field, reference your variable using double curly brace syntax: `{ "inputText": "{{inputText}}" }`. FlutterFlow will substitute the variable at runtime. Click 'Response & Test.' Scroll down to the 'Test' section and enter a test value for inputText. Click 'Test API Call.' If your Lambda is running correctly, the response panel shows the JSON your function returned. Click 'Generate JSON Paths' to let FlutterFlow automatically create JSON path extractors for each field in the response (for example, `$.output` maps to the 'output' field). These paths let you bind response data to widgets.

1{
2  "api_call_name": "ProcessUserInput",
3  "method": "POST",
4  "endpoint": "/",
5  "variables": [
6    { "name": "inputText", "type": "String", "required": true }
7  ],
8  "body": {
9    "inputText": "{{inputText}}"
10  },
11  "response_json_paths": [
12    { "field": "output", "path": "$.output", "type": "String" }
13  ]
14}

Now wire the API Call to your app's UI. Navigate to the page where you want the Lambda call to happen — for example, a page with a TextField for input and a Button to submit. Click the Button to select it. In the right panel, click 'Actions' to open the Actions panel, then click '+ Add Action.' In the action picker, choose 'Backend/Database → API Request.' In the dropdown, select your API Group ('LambdaBackend') and then your specific call ('ProcessUserInput'). A field for each variable you defined appears. For the `inputText` variable, click the variable picker (the orange square icon) and choose 'Widget State → [YourTextField] → Value' to pull the text the user typed. Click 'Confirm.' Now add a second action to store or display the result: after the API Call action, add 'Update App State' or set a page variable using the response data. Choose the JSON path you extracted (for example, '$.output') as the value. Bind a Text widget on the page to this state variable so the Lambda result appears when the call completes. In the Action Flow Editor, you can also add an 'Is Loading' state to show a loading spinner while the call is in flight — important for Lambda cold starts, which can add 1–3 seconds to the first call of a function that has been idle.

If your app will see real user traffic, consider replacing the Function URL with API Gateway for better access control. In the AWS console, go to API Gateway → Create API → REST API. Define a resource (for example, `/process`) and a POST method. Set the integration type to 'Lambda Function' and point it at your function. Under 'Method Request,' enable 'API Key Required.' In the API Gateway console, create a Usage Plan with throttling limits (for example, 1,000 requests per second, 10,000 per day) and an API key. Associate the API key with the Usage Plan and the Usage Plan with your stage. The client (FlutterFlow) now sends the API key in the `X-Api-Key` header — API Gateway validates it before the request reaches Lambda, preventing unauthorized calls even if the key leaks. Update your FlutterFlow API Group base URL to the API Gateway invoke URL (looks like `https://<api-id>.execute-api.<region>.amazonaws.com/<stage>`). This setup gives you throttling, per-key quotas, CloudWatch logging, and the ability to rotate keys without redeploying Lambda. If you want help designing the API Gateway auth layer, RapidDev's team builds FlutterFlow + AWS integrations regularly — free scoping call at rapidevelopers.com/contact.