How SpaceZero leverages Cloudflare Pages Functions for serverless backend with zero cold starts and automatic global distribution.
SpaceZero's backend runs on Cloudflare Pages Functions — the edge runtime.
Unlike AWS Lambda or Vercel Functions, Cloudflare's V8 isolates have zero cold starts. Every request executes immediately.
Your code runs in 300+ data centers worldwide. Users hit the nearest edge.
Standard Web APIs: fetch, Request, Response, Headers, URL, crypto, WebSocket.
functions/
├── api/
│ ├── auth/
│ │ ├── check-user.ts
│ │ └── send-email.ts
│ ├── newsletter.ts
│ ├── webhooks/
│ │ └── gumroad.ts
│ └── health.ts
└── lib/
├── supabase.ts
├── rateLimit.ts
├── validation.ts
└── security.ts
// functions/api/auth/check-user.ts
import { getAdminSupabaseClient } from '../lib/supabase';
import { validateJsonBody, createErrorResponse } from '../lib/validation';
import { rateLimit } from '../../lib/rateLimit';
export async function onRequestPost({ request, env }) {
const limitResult = rateLimit({ request }, { maxRequests: 10, windowMs: 60_000 });
if (limitResult.limited) return limitResult.response!;
const { data: body, error } = await validateJsonBody<{ email: string }>(request, {
email: { type: 'string', required: true },
});
if (error || !body) return createErrorResponse(400, 'Invalid request body');
const supabase = getAdminSupabaseClient(env);
if (!supabase) return createErrorResponse(500, 'Server configuration error');
const { data, error: listError } = await supabase.auth.admin.listUsers();
if (listError) return createErrorResponse(500, 'Failed to check user');
const users = data.users || [];
return Response.json({ exists: users.some((u) => u.email.toLowerCase() === body.email.toLowerCase()) });
}
import { rateLimit } from '../lib/rateLimit';
const limitResult = rateLimit({ request }, { maxRequests: 10, windowMs: 60_000 });
if (limitResult.limited) return limitResult.response!;
import { validateJsonBody, createErrorResponse } from '../lib/validation';
const { data: body, error } = await validateJsonBody<{ email: string }>(request, {
email: { type: 'string', required: true },
});
if (error || !body) return createErrorResponse(400, 'Invalid request body');
import { validateUrlForSSRFSafety } from '../lib/security';
const { valid, reason } = validateUrlForSSRFSafety(userProvidedUrl);
if (!valid) {
return createErrorResponse(400, reason ?? 'URL not allowed');
}
Client-safe (VITE_ prefix) → available in browser Server-only → Cloudflare Pages secrets
# Cloudflare Pages Dashboard → Settings → Environment Variables
SUPABASE_SERVICE_ROLE_KEY=xxx
GUMROAD_WEBHOOK_SECRET=xxx
RESEND_API_KEY=xxx
npm run build
# Connect repo to Cloudflare Pages
# Build command: npm run build
# Output directory: dist
wrangler dev