You'll also need to explicitly specify which endpoints are private and require one of the api keys to be included in the request by adding a private boolean property to the http event object you want to set as private. "input": "$body", If no --stage flag is provided, the fallback dev will be used and result in ${file(./config.dev.json):CREDS}. You could somehow return the event from a call and save it in a JSON file or grab one from Amazon. For example: You can reference AWS-specific values as the source of your variables. "info": "OK" The best practice to ensure uniqueness is by parameterizing resource names with the name of the stage. What you can do in serverless.yml is: What this says is to use the stage CLI option if it exists, if not, use the default stage (which lives in provider.stage). To reference CLI options that you passed, use the ${opt: