Building apps
What is server functions (edge functions)?
Server functions are pieces of your application's code that run on a server rather than in the user's browser, which is what makes them the only safe place for secrets and for logic a user must not be able to change.
New to Bolt? Sign up free.
Technical definition
A server function is a unit of server-side code invoked on demand, without a persistent server to manage. The platform provisions the runtime for the duration of the call and bills by invocation and execution time rather than by uptime. Edge functions are the same model deployed to locations near the user to reduce latency.
Because execution happens in an environment the client cannot inspect, a server function can hold credentials, enforce authorization, and validate input in ways browser code cannot.
In plain terms
A server function is code that runs on a computer you control instead of on your customer's device.
That difference is the entire point. Anything your customer should not see or be able to change has to run here.
Why it matters
What belongs in a server function is a short and important list:
- API keys and secrets. Anything in browser code is readable by anyone using your site.
- Payment logic. The price a charge is created with must be decided on the server, never accepted from the browser.
- Permission checks. A check the user's own device performs can be bypassed by that user.
- Input validation. Validate in the browser for a good experience, and again on the server because that is the check that counts.
- Incoming webhooks. These arrive server-to-server and need signature verification.
- Scheduled work. Nightly reports, reminders, and cleanup.
The reasoning is one sentence: the browser belongs to the user. Anything running there can be read and modified by them, so it can inform decisions but never enforce them.
On cost, the pay-per-invocation model is cheap at small scale and worth watching at large scale, particularly for functions called on every page load.
