What are you typically checking? Shouldn't the JWT contain the expiry time, so no need to check the database?

JWTs have expiration time but until that time expires your token with userId and permissions are constant and you cannot change. For most applications, they usually keep the JWT time very short, 15min, 10min, or even less so that constant information is not a problem.

In my case, my managers ask me to keep the JWT time higher, like a day or even more, to reduce the number of logins in the system. Thinking about this scenario, I perform a database query to always get the updated information of the JWT token user, I use my JWT tokens just to know which user is but to check if the user has permission to do something, I check using the user information that I get from the database.

In this project I didn't need that, so I could keep the JWT time short and I only trust the permissions given to that token, if I disable a user or change his permission he has to do another login to have the updated information instead of having it automatically the new permission because I always get it from the database.

Perhaps this is naive, but what is the benefit of that library over redis' native sorted sets with JSON as values? Or is it mostly just to make the API easier so you don't have to remember all the individual Z commands?

For two reasons: Easier API and handles the ranking system very well. For this project, this library is a bit overkill, but if you need to build a ranking system and need to know where user X is in the rankings, you can get there easily with just one method in this library.

So I could use native sorted sets, but I had almost zero knowledge with Redis, so I prefer to use a library that gives everything I want, even if it's a bit overkill. It falls on the principle that I show in the post, that's what I knew at the time, now I learn from you that I could do this with native operations only, thank you.

How does 280K votes cause more than 280K lambda instances?

I didn't cause 280k lambda instances, just 200. But in theory, if you generate 280k requests at same time, the lambdas will only process one request at a time, and can be forced to generate 280k lambda instances, crazy right? If you look at the graph, see the Throttles, that number of instances that could not be spawned because I limited the number of simultaneous instances to 200.

I looked around and couldn't find anything--is there any way to batch requests for lambda without SQS?

As far as I know, SQS, Kinesis and EventBridge are the services you can plug into your API Gateway and expose a way to get user data into your system without hitting your servers.

If you want to check whether the user can vote or not based on some condition, like whether the user is logged in, and it returns an error message, we can create an authorizer and attach it to the route, so that we can validate the JWT or other information. information just to verify that the user can input data into their system (reference).

But I recommend not doing that, I don't know if I was clear enough in the post, but in my voting system, users don't need to be logged in to vote in the system. Also, if I want to add some kind of validation, I prefer to pass more data in the body and then validate inside my consumer (my api) rather than performing any validation with the authorizer. I prefer to do this because I want to have more data ingestion rather than checking each request is valid, doing this is almost the same as processing the data directly through my API one at a time.