diff --git a/.env.dist b/.env.dist
index aaa929c9..d359cf27 100644
--- a/.env.dist
+++ b/.env.dist
@@ -34,17 +34,17 @@ WEATHER_API_HOST="http://weather-mock:1083"
 
 SAY_INTENTIONS_API_HOST="http://sayintentions-mock:1085"
 
-AEROLOPA_FUNCTION_BASE_URL="http://functions-mock:1087/aerolopa-provider/aerolopa"
+AEROLOPA_FUNCTION_BASE_URL="http://functions-mock:1087"
 AEROLOPA_FUNCTION_SECRET="very-secret-token"
 
-OSM_FUNCTION_BASE_URL="http://functions-mock:1088/osm-provider/airport"
+OSM_FUNCTION_BASE_URL="http://functions-mock:1088"
 OSM_FUNCTION_SECRET="very-secret-token"
 
-POSTCARD_FUNCTION_BASE_URL="http://functions-mock:1089/postcard-generator/postcard"
+POSTCARD_FUNCTION_BASE_URL="http://functions-mock:1089"
 POSTCARD_FUNCTION_SECRET="very-secret-token"
 POSTCARD_ART_BASE_URL="http://functions-mock:1089/mypreflight-files"
 
-OCEANIC_TRACKS_FUNCTION_BASE_URL="http://functions-mock:1090/oceanic-tracks-provider/oceanic-tracks"
+OCEANIC_TRACKS_FUNCTION_BASE_URL="http://functions-mock:1090"
 OCEANIC_TRACKS_FUNCTION_SECRET="very-secret-token"
 
 DISCORD_GATEWAY_ENABLED="false"
diff --git a/AGENTS.md b/AGENTS.md
index 75596a1e..302141cd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,8 +14,8 @@ Anything about the product or business belongs in the knowledge base; this file
 
 - Run locally: `cp .env.dist .env`, then `docker compose up -d --build`. Packages, database schema and seed data are set up automatically. API docs are at <http://localhost/api>.
 - Test: `docker compose exec app npm run format`, then `npm run lint` and `npm run test:functional` (cucumber-js, `features/`) the same way. These are the steps CI runs.
-- Deploy: bump `package.json` `version` in every PR. Merging to `main` tags the version, pushes the image to GitHub Container Registry and deploys it to DigitalOcean.
-- Links in Discord messages and emails are `FRONTEND_BASE_URL` plus a path from the web app's route table (`app/routes.ts` in `mypreflight/app`). In production the variable lives only in the DigitalOcean app spec, and nothing here fails when the app renames a route, so check both when a link 404s.
+- Deploy: bump `package.json` `version` in every PR. Merging to `main` tags the version, pushes the image to GitHub Container Registry and deploys it to ECS on AWS through the OpenTofu stack in `infra/`.
+- Links in Discord messages and emails are `FRONTEND_BASE_URL` plus a path from the web app's route table (`app/routes.ts` in `mypreflight/app`). In production the variable is set in the task definition (`infra/locals.tf`), and nothing here fails when the app renames a route, so check both when a link 404s.
 
 When your change alters product behaviour, also open a PR to the knowledge base updating the matching file. When it ships something a pilot will notice, also open a PR to [mypreflight/landing](https://github.com/mypreflight/landing) adding a changelog entry with before and after screenshots; that repo's `AGENTS.md`, under "Changelog", says how.
 
@@ -80,13 +80,13 @@ Endpoints are **one controller class per endpoint** ("actions") under `infra/htt
 
 **Error handling:** every error surfaces through one global filter — `DomainExceptionFilter` in `src/core/errors/domain-exception.filter.ts`, registered in `main.ts` via `configureExceptionHandling(app)`. Throw typed domain errors that extend the category classes in `src/core/errors/domain-error.ts` (`BadRequestError`→400, `UnauthorizedError`→401, `ForbiddenError`→403, `NotFoundError`→404, `ConflictError`→409, `UnprocessableError`→422); define the concrete errors under each module's `model/error/*.error.ts` (e.g. `class FlightNotFoundError extends NotFoundError`). The filter maps the error's category to the HTTP status and emits one canonical body — `{ statusCode, error, message, violations? }` — where `statusCode` always equals the HTTP status and `error` is the reason phrase. Do **not** throw `@nestjs/common` HttpExceptions directly from domain, application, or infra code — every error is a typed class extending a `DomainError` category (defined per module in `model/error/*.error.ts`, or alongside a provider client). The only intentional framework-level exceptions left are the JWT/roles **guards** (their bare `401`/`403`) and the global **validation pipe** (`400` with a `violations` map); leave those as-is. The old `{ statusCode, error, message }` constant objects (`errors.dto.ts`) have been removed — never reintroduce that pattern. Note the canonical reason phrase for `422` is `"Unprocessable Content"` (from the filter), not Nest's default `"Unprocessable Entity"`.
 
-**External providers are mocked in dev:** `ADSB_API_HOST`, `SKYLINK_API_HOST`, `SIMBRIEF_API_HOST`, `WEATHER_API_HOST`, `GOOGLE_JWKS_URI` point at the single `mock` container in `compose.yaml` (Mockoon) through network aliases such as `adsb-mock`. Each environment file in `docker/mock/` runs on its own port (`1080`–`1090`), with larger response bodies in a folder named after it. The provider **functions** — `AEROLOPA_FUNCTION_BASE_URL`, `OSM_FUNCTION_BASE_URL`, `POSTCARD_FUNCTION_BASE_URL` and `OCEANIC_TRACKS_FUNCTION_BASE_URL` — use the `functions-mock` alias on ports `1087`, `1088`, `1089` and `1090`. Their function routes require the `X-Require-Whisk-Auth` secret and answer `401` without it, the way the platform does. `prisma/seed/resource/cabin-layout-versions.seed.ts` reads `docker/mock/functions/aerolopa.json` and its `aerolopa/` body files directly, so moving them breaks the seed. The web app's Vite dev server proxies postcard art to `localhost:1089`. Discord is split in two: `DISCORD_API_HOST` points the REST/OAuth client (`DiscordIdentityClient`) at `discord-mock`, while the bot **gateway** (`DiscordGateway`, discord.js) has no mock — it connects under `NODE_ENV=production` or `DISCORD_GATEWAY_ENABLED="true"` and refuses otherwise. Message delivery is gated on `NODE_ENV` alone, so outside production `TestDiscordClient` always writes each message to `test-data/discord/<type>_<flightId>.md`; `findMembership` answers `unknown` only while the gateway is off (enabling it makes the seeded membership scenarios report `not_member`, so keep the flag off when running the functional suite) — see **docs/DISCORD.md**.
+**External providers are mocked in dev:** `ADSB_API_HOST`, `SKYLINK_API_HOST`, `SIMBRIEF_API_HOST`, `WEATHER_API_HOST`, `GOOGLE_JWKS_URI` point at the single `mock` container in `compose.yaml` (Mockoon) through network aliases such as `adsb-mock`. Each environment file in `docker/mock/` runs on its own port (`1080`–`1090`), with larger response bodies in a folder named after it. The provider **functions** — `AEROLOPA_FUNCTION_BASE_URL`, `OSM_FUNCTION_BASE_URL`, `POSTCARD_FUNCTION_BASE_URL` and `OCEANIC_TRACKS_FUNCTION_BASE_URL` — use the `functions-mock` alias on ports `1087`, `1088`, `1089` and `1090`. Their function routes require `Authorization: Bearer <secret>` and answer `401` without it, the way the functions do. `prisma/seed/resource/cabin-layout-versions.seed.ts` reads `docker/mock/functions/aerolopa.json` and its `aerolopa/` body files directly, so moving them breaks the seed. The web app's Vite dev server proxies postcard art to `localhost:1089`. Discord is split in two: `DISCORD_API_HOST` points the REST/OAuth client (`DiscordIdentityClient`) at `discord-mock`, while the bot **gateway** (`DiscordGateway`, discord.js) has no mock — it connects under `NODE_ENV=production` or `DISCORD_GATEWAY_ENABLED="true"` and refuses otherwise. Message delivery is gated on `NODE_ENV` alone, so outside production `TestDiscordClient` always writes each message to `test-data/discord/<type>_<flightId>.md`; `findMembership` answers `unknown` only while the gateway is off (enabling it makes the seeded membership scenarios report `not_member`, so keep the flag off when running the functional suite) — see **docs/DISCORD.md**.
 
-**AeroLOPA (`src/core/provider/aerolopa/`):** seat maps come from a DigitalOcean Function in the sibling `mypreflight-aerolopa-provider` repo — the API side is an HTTP client and nothing else (no persistence, no scraping). One `GET` carries `op=seatmap|resolve|configurations` plus an `X-Require-Whisk-Auth` secret; `AerolopaClient` exposes `getSeatMap(slug)`, `resolve(airline, aircraft, includeSeatMaps?)` and `listConfigurations()`. `type/aerolopa.types.ts` is **hand-written** and mirrors the vendored `aerolopa.openapi.json` by hand — there is no codegen and no CI drift gate, so when the contract changes, update both (keep the types comment-free; the descriptive prose belongs in the contract). Upstream error codes map to typed errors in `error/aerolopa.error.ts`: `SEAT_MAP_NOT_FOUND`/`SEAT_MAP_UNREADABLE` only on calls that carry a slug, everything else (rejected secret, timeout, upstream 5xx) collapses into `AerolopaUnavailableError`. AeroLOPA is keyed by airline + cabin configuration with **no registration index**, so `resolve()` is often `ambiguous` — the plan is a curated cabin-configuration field on the aircraft rather than a per-request lookup.
+**AeroLOPA (`src/core/provider/aerolopa/`):** seat maps come from an AWS Lambda function in the sibling `mypreflight-aerolopa-provider` repo — the API side is an HTTP client and nothing else (no persistence, no scraping). One `GET` carries `op=seatmap|resolve|configurations` plus the function secret as `Authorization: Bearer`; `AerolopaClient` exposes `getSeatMap(slug)`, `resolve(airline, aircraft, includeSeatMaps?)` and `listConfigurations()`. `type/aerolopa.types.ts` is **hand-written** and mirrors the vendored `aerolopa.openapi.json` by hand — there is no codegen and no CI drift gate, so when the contract changes, update both (keep the types comment-free; the descriptive prose belongs in the contract). Upstream error codes map to typed errors in `error/aerolopa.error.ts`: `SEAT_MAP_NOT_FOUND`/`SEAT_MAP_UNREADABLE` only on calls that carry a slug, everything else (rejected secret, timeout, upstream 5xx) collapses into `AerolopaUnavailableError`. AeroLOPA is keyed by airline + cabin configuration with **no registration index**, so `resolve()` is often `ambiguous` — the plan is a curated cabin-configuration field on the aircraft rather than a per-request lookup.
 
-**OpenStreetMap (`src/core/provider/osm/`):** airport infrastructure — boundary, runways, terminals, parking positions and gates — comes from a DigitalOcean Function in the sibling `osm-provider` repo, and the API side is an HTTP client and nothing else. `OsmClient.pullAirport(icao)` is a read: the function holds no credentials for this API and writes nothing. `type/osm.types.ts` is **hand-written** and mirrors the vendored `osm.openapi.json` by hand, exactly as the AeroLOPA types do — no codegen, no drift gate, so update both together. `AERODROME_NOT_FOUND` and `RESULT_TOO_LARGE` map to typed errors; everything else (rejected secret, timeout, Overpass down, a bare `404` from something that is not the function) collapses into `OsmProviderUnavailableError`.
+**OpenStreetMap (`src/core/provider/osm/`):** airport infrastructure — boundary, runways, terminals, parking positions and gates — comes from an AWS Lambda function in the sibling `osm-provider` repo, and the API side is an HTTP client and nothing else. `OsmClient.pullAirport(icao)` is a read: the function holds no credentials for this API and writes nothing. `type/osm.types.ts` is **hand-written** and mirrors the vendored `osm.openapi.json` by hand, exactly as the AeroLOPA types do — no codegen, no drift gate, so update both together. `AERODROME_NOT_FOUND` and `RESULT_TOO_LARGE` map to typed errors; everything else (rejected secret, timeout, Overpass down, a bare `404` from something that is not the function) collapses into `OsmProviderUnavailableError`.
 
-**Oceanic tracks (`src/core/provider/oceanic-tracks/`):** today's organised oceanic tracks come from a DigitalOcean Function in the sibling `oceanic-tracks-provider` repo, which holds the FAA NOTAM service key, reads the track messages and places every fix. The API side is an HTTP client and nothing else. `OceanicTracksClient.listTracks()` takes no arguments. `type/oceanic-tracks.types.ts` is **hand-written** and mirrors the vendored `oceanic-tracks.openapi.json` by hand, exactly as the AeroLOPA types do, so update both together. Every failure (rejected secret, timeout, the FAA down or refusing) collapses into `OceanicTracksUnavailableError`. The `oceanic-tracks` module serves the tracks at `GET api/v1/oceanic-track` without sign-in and keeps the function's raw answer in the global cache for 15 minutes (`CACHE_KEYS.OCEANIC_TRACKS`), mapping it on every read. That cache is what keeps the FAA's limit of one data pull every 3 minutes however many people open the map, so don't shorten it or add a second caller.
+**Oceanic tracks (`src/core/provider/oceanic-tracks/`):** today's organised oceanic tracks come from an AWS Lambda function in the sibling `oceanic-tracks-provider` repo, which holds the FAA NOTAM service key, reads the track messages and places every fix. The API side is an HTTP client and nothing else. `OceanicTracksClient.listTracks()` takes no arguments. `type/oceanic-tracks.types.ts` is **hand-written** and mirrors the vendored `oceanic-tracks.openapi.json` by hand, exactly as the AeroLOPA types do, so update both together. Every failure (rejected secret, timeout, the FAA down or refusing) collapses into `OceanicTracksUnavailableError`. The `oceanic-tracks` module serves the tracks at `GET api/v1/oceanic-track` without sign-in and keeps the function's raw answer in the global cache for 15 minutes (`CACHE_KEYS.OCEANIC_TRACKS`), mapping it on every read. That cache is what keeps the FAA's limit of one data pull every 3 minutes however many people open the map, so don't shorten it or add a second caller.
 
 **The OpenStreetMap data upgrade (`airports` module, `airport/:id/enrich`):** an operations user `GET`s `enrich`, which reads OpenStreetMap, compares it against the airport and answers a proposal — one selectable change per record, each with a stable `<resource>:<label>` key, a status of `added`/`removed`/`updated`/`not-changed`, the fields that would be written with current beside proposed, and the `requires` a dependency needs. Nothing is written. The pull is retained in the global cache for an hour (`airportOsmPullCacheKey`), so a repeated review costs Overpass nothing; `?refresh=true` insists on fresh data. `POST`ing the same path with the keys the reviewer accepted applies exactly those: it rebuilds the proposal from the retained pull rather than trusting the request, so what lands is what was reviewed, and it answers `409` when no pull is held. Pushing a `removed` key **deletes** that record — which is why nothing is ever applied unselected.
 
diff --git a/README.md b/README.md
index bcf5f6de..ddc7f017 100644
--- a/README.md
+++ b/README.md
@@ -111,7 +111,7 @@ openssl ec -in private.key -pubout -out public.key
 This project uses [semantic versioning](https://semver.org/spec/v2.0.0.html).
 
 This project has configured continuous integration and continuous deployment pipelines. It uses GitHub Actions to
-automatically build, test and deploy the app to the DigitalOcean. You can find the configuration in `.github/workflows`
+automatically build, test and deploy the app to AWS. You can find the configuration in `.github/workflows`
 directory.
 
 ## Contact
diff --git a/docker/mock/functions/aerolopa.json b/docker/mock/functions/aerolopa.json
index fb3b0fc9..a2b41f96 100644
--- a/docker/mock/functions/aerolopa.json
+++ b/docker/mock/functions/aerolopa.json
@@ -13,14 +13,14 @@
       "type": "http",
       "documentation": "",
       "method": "get",
-      "endpoint": "aerolopa-provider/aerolopa/seatmap",
+      "endpoint": "seatmap",
       "responses": [
         {
           "uuid": "0d80de1b-8e6f-4fc6-ac3f-e348fe0fff55",
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=lo-7m8-1, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=lo-7m8-1, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -48,8 +48,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -66,7 +66,7 @@
           "body": "{\"error\":{\"code\":\"SEAT_MAP_NOT_FOUND\",\"message\":\"Seat map for configuration zz-999 does not exist.\",\"status\":404}}",
           "latency": 0,
           "statusCode": 404,
-          "label": "op=seatmap, slug=zz-999, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=zz-999, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -94,8 +94,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -112,7 +112,7 @@
           "body": "{\"error\":{\"code\":\"AEROLOPA_UNAVAILABLE\",\"message\":\"AeroLOPA is unavailable.\",\"status\":502}}",
           "latency": 0,
           "statusCode": 502,
-          "label": "op=seatmap, slug=boom, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=boom, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -140,8 +140,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -158,7 +158,7 @@
           "body": "{\"airlineIata\":\"LH\",\"aircraftIata\":\"32N\",\"candidateCount\":1,\"ambiguous\":false,\"candidates\":[\"lh-32n\"],\"seatMaps\":[]}",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=resolve, airline=LH, aircraft=32N, includeSeatMaps=false, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=resolve, airline=LH, aircraft=32N, includeSeatMaps=false, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -200,8 +200,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -218,7 +218,7 @@
           "body": "{\"airlineIata\":\"LO\",\"aircraftIata\":\"7M8\",\"candidateCount\":3,\"ambiguous\":true,\"candidates\":[\"lo-7m8-1\",\"lo-7m8-2\",\"lo-7m8-3\"],\"seatMaps\":[]}",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=resolve, airline=LO, aircraft=7M8, includeSeatMaps=false, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=resolve, airline=LO, aircraft=7M8, includeSeatMaps=false, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -260,8 +260,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -278,7 +278,7 @@
           "body": "{\"airlineIata\":\"BA\",\"aircraftIata\":\"744\",\"candidateCount\":0,\"ambiguous\":false,\"candidates\":[],\"seatMaps\":[]}",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=resolve, airline=BA, aircraft=744, includeSeatMaps=false, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=resolve, airline=BA, aircraft=744, includeSeatMaps=false, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -320,8 +320,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -338,7 +338,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=resolve, airline=LO, aircraft=7M8, includeSeatMaps=true, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=resolve, airline=LO, aircraft=7M8, includeSeatMaps=true, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -380,8 +380,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -398,7 +398,7 @@
           "body": "{\"error\":{\"code\":\"SEAT_MAP_UNREADABLE\",\"message\":\"Seat map payload for configuration unreadable could not be read.\",\"status\":502}}",
           "latency": 0,
           "statusCode": 502,
-          "label": "op=seatmap, slug=unreadable, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=unreadable, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -426,8 +426,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -444,7 +444,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=configurations, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=configurations, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -465,8 +465,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -483,7 +483,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=lh-32n, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=lh-32n, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -511,8 +511,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -529,7 +529,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=aa-77w, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=aa-77w, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -557,8 +557,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -575,7 +575,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=de-321, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=de-321, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -603,8 +603,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -621,7 +621,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=kl-738, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=kl-738, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -649,8 +649,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -667,7 +667,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=kl-77w, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=kl-77w, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -695,8 +695,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -713,7 +713,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=fi-752-1, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=fi-752-1, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -741,8 +741,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -759,7 +759,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=lh-74h-m, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=lh-74h-m, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -787,8 +787,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -805,7 +805,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "op=seatmap, slug=lh-74h-u, X-Require-Whisk-Auth: very-secret-token",
+          "label": "op=seatmap, slug=lh-74h-u, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -833,8 +833,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -880,14 +880,14 @@
       "type": "http",
       "documentation": "",
       "method": "get",
-      "endpoint": "aerolopa-provider/aerolopa/layouts",
+      "endpoint": "layouts",
       "responses": [
         {
           "uuid": "844a0274-3e65-41cf-ba19-c66521893efa",
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "X-Require-Whisk-Auth: very-secret-token",
+          "label": "Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -901,8 +901,8 @@
           "rules": [
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
diff --git a/docker/mock/functions/oceanic-tracks.json b/docker/mock/functions/oceanic-tracks.json
index 950ee59c..82ec53d4 100644
--- a/docker/mock/functions/oceanic-tracks.json
+++ b/docker/mock/functions/oceanic-tracks.json
@@ -13,14 +13,14 @@
       "type": "http",
       "documentation": "",
       "method": "get",
-      "endpoint": "oceanic-tracks-provider/oceanic-tracks/tracks",
+      "endpoint": "tracks",
       "responses": [
         {
           "uuid": "32143c9c-3902-4470-8706-808de73dc8e1",
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "X-Require-Whisk-Auth: very-secret-token",
+          "label": "Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -34,8 +34,8 @@
           "rules": [
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
diff --git a/docker/mock/functions/osm.json b/docker/mock/functions/osm.json
index 35dbfbd8..5582623f 100644
--- a/docker/mock/functions/osm.json
+++ b/docker/mock/functions/osm.json
@@ -13,14 +13,14 @@
       "type": "http",
       "documentation": "",
       "method": "get",
-      "endpoint": "osm-provider/airport/pull",
+      "endpoint": "pull",
       "responses": [
         {
           "uuid": "9fa38780-0f03-45db-9751-52dbbf3d78fb",
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "icao=EDDW, X-Require-Whisk-Auth: very-secret-token",
+          "label": "icao=EDDW, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -41,8 +41,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -59,7 +59,7 @@
           "body": "{\"error\":{\"code\":\"AERODROME_NOT_FOUND\",\"message\":\"OpenStreetMap has no aerodrome tagged with the ICAO code CYYT.\",\"status\":404}}",
           "latency": 0,
           "statusCode": 404,
-          "label": "icao=CYYT, X-Require-Whisk-Auth: very-secret-token",
+          "label": "icao=CYYT, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -80,8 +80,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -98,7 +98,7 @@
           "body": "{\"error\":{\"code\":\"OVERPASS_UNAVAILABLE\",\"message\":\"Every Overpass mirror is unavailable.\",\"status\":502}}",
           "latency": 0,
           "statusCode": 502,
-          "label": "icao=EDDF, X-Require-Whisk-Auth: very-secret-token",
+          "label": "icao=EDDF, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -119,8 +119,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
diff --git a/docker/mock/functions/postcard.json b/docker/mock/functions/postcard.json
index 1d909d2d..1a40fb42 100644
--- a/docker/mock/functions/postcard.json
+++ b/docker/mock/functions/postcard.json
@@ -373,14 +373,14 @@
       "type": "http",
       "documentation": "",
       "method": "get",
-      "endpoint": "postcard-generator/postcard/city",
+      "endpoint": "city",
       "responses": [
         {
           "uuid": "538900af-625b-4516-8859-80ac96b3291c",
           "body": "{\"error\":{\"code\":\"BAD_REQUEST\",\"message\":\"Parameter city may only contain Latin letters, digits, spaces, apostrophes and dots.\",\"status\":400}}",
           "latency": 0,
           "statusCode": 400,
-          "label": "city=北京, X-Require-Whisk-Auth: very-secret-token",
+          "label": "city=北京, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -401,8 +401,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -419,7 +419,7 @@
           "body": "{\"code\":\"9dc953214622ec06d8db424c91245cee\",\"error\":\"Response not yet ready.\"}",
           "latency": 0,
           "statusCode": 202,
-          "label": "uuid=0b5f2f18-9c3a-4b7e-8d21-6a4f0c9e7b53, X-Require-Whisk-Auth: very-secret-token",
+          "label": "uuid=0b5f2f18-9c3a-4b7e-8d21-6a4f0c9e7b53, Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -440,8 +440,8 @@
             },
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
@@ -458,7 +458,7 @@
           "body": "",
           "latency": 0,
           "statusCode": 200,
-          "label": "X-Require-Whisk-Auth: very-secret-token",
+          "label": "Authorization: Bearer very-secret-token",
           "headers": [
             {
               "key": "Content-Type",
@@ -472,8 +472,8 @@
           "rules": [
             {
               "target": "header",
-              "modifier": "X-Require-Whisk-Auth",
-              "value": "very-secret-token",
+              "modifier": "Authorization",
+              "value": "Bearer very-secret-token",
               "invert": false,
               "operator": "equals"
             }
diff --git a/package-lock.json b/package-lock.json
index 5bd46f85..e66b083d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "flight-tracker-api",
-  "version": "3.80.4",
+  "version": "3.80.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "flight-tracker-api",
-      "version": "3.80.4",
+      "version": "3.80.5",
       "license": "Unlicense",
       "dependencies": {
         "@faker-js/faker": "^10.6.0",
diff --git a/package.json b/package.json
index 7c4dfd37..32892606 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "flight-tracker-api",
-  "version": "3.80.4",
+  "version": "3.80.5",
   "private": true,
   "homepage": "https://mypreflight.io",
   "author": "mypreflight",
diff --git a/prisma/seed/resource/cabin-layout-versions.seed.ts b/prisma/seed/resource/cabin-layout-versions.seed.ts
index 5ff8e1bb..b78c0869 100644
--- a/prisma/seed/resource/cabin-layout-versions.seed.ts
+++ b/prisma/seed/resource/cabin-layout-versions.seed.ts
@@ -113,7 +113,7 @@ export async function loadCabinLayoutVersions(
 
 function readSeatMap(slug: string): AerolopaSeatMap {
   const response = mock.routes
-    .filter((route) => route.endpoint.endsWith('/aerolopa/seatmap'))
+    .filter((route) => route.endpoint === 'seatmap')
     .flatMap((route) => route.responses)
     .find((candidate) =>
       candidate.rules.some(
diff --git a/src/core/provider/aerolopa/aerolopa.openapi.json b/src/core/provider/aerolopa/aerolopa.openapi.json
index 7e9d2c44..e36d3538 100644
--- a/src/core/provider/aerolopa/aerolopa.openapi.json
+++ b/src/core/provider/aerolopa/aerolopa.openapi.json
@@ -2,8 +2,8 @@
   "openapi": "3.1.0",
   "info": {
     "title": "MyPreflight AeroLOPA provider",
-    "description": "DigitalOcean Functions returning AeroLOPA seat maps, cabin configurations, and the index of published layouts.\n\nDeployed as a functions component of the `mypreflight` App Platform app. Every request must carry the `X-Require-Whisk-Auth` header declared as `webSecure` in project.yml; the platform rejects the request before the function runs otherwise.",
-    "version": "1.0.0",
+    "description": "An AWS Lambda function returning AeroLOPA seat maps, cabin configurations, and the index of published layouts.\n\nServed from one Lambda Function URL that routes `/seatmap` and `/layouts`. Every request must carry the shared function secret as `Authorization: Bearer <secret>`; the function answers 401 before reading anything otherwise.",
+    "version": "2.0.0",
     "license": {
       "name": "Unlicense",
       "url": "https://opensource.org/licenses/Unlicense"
@@ -11,8 +11,14 @@
   },
   "servers": [
     {
-      "url": "https://<app-host>/aerolopa",
-      "description": "App Platform ingress route"
+      "url": "https://{urlId}.lambda-url.eu-central-1.on.aws",
+      "description": "The Lambda Function URL, published at the SSM parameter /mypreflight/aerolopa-provider/url",
+      "variables": {
+        "urlId": {
+          "default": "function-url-id",
+          "description": "The Function URL's generated identifier"
+        }
+      }
     },
     {
       "url": "http://localhost:3001",
@@ -20,7 +26,7 @@
     }
   ],
   "paths": {
-    "/aerolopa/seatmap": {
+    "/seatmap": {
       "get": {
         "summary": "Look up seat maps and cabin configurations",
         "description": "The operation is taken from `op`, or inferred: `slug` implies seatmap, `airline` with `aircraft` implies resolve.",
@@ -108,7 +114,14 @@
             }
           },
           "401": {
-            "description": "Missing or wrong X-Require-Whisk-Auth header; rejected by the platform"
+            "description": "Missing or wrong bearer token, answered by the function before it reads anything",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           },
           "404": {
             "description": "No such configuration",
@@ -141,24 +154,12 @@
             }
           }
         }
-      },
-      "servers": [
-        {
-          "url": "http://localhost:3001",
-          "description": "Local development server for the seatmap function"
-        }
-      ]
+      }
     },
-    "/aerolopa/layouts": {
-      "servers": [
-        {
-          "url": "http://localhost:3002",
-          "description": "Local development server for the layouts function"
-        }
-      ],
+    "/layouts": {
       "get": {
         "summary": "List every published cabin layout",
-        "description": "Returns the identifier of every cabin layout AeroLOPA publishes, with the airline and aircraft IATA codes parsed out of it and the trailing discriminator that separates several layouts of the same airline and type.\n\nThe whole index comes from a single sitemap read, so the call is cheap and takes no parameters. Nothing here requires fetching a seat map: for cabins, seats, or aircraft names, follow up with `/aerolopa/seatmap?slug=<id>`.\n\nThe index is cached in the function instance for 24 hours.",
+        "description": "Returns the identifier of every cabin layout AeroLOPA publishes, with the airline and aircraft IATA codes parsed out of it and the trailing discriminator that separates several layouts of the same airline and type.\n\nThe whole index comes from a single sitemap read, so the call is cheap and takes no parameters. Nothing here requires fetching a seat map: for cabins, seats, or aircraft names, follow up with `/seatmap?slug=<id>`.\n\nThe index is cached in the function instance for 24 hours.",
         "operationId": "listLayouts",
         "responses": {
           "200": {
@@ -172,7 +173,14 @@
             }
           },
           "401": {
-            "description": "Missing or wrong X-Require-Whisk-Auth header; rejected by the platform"
+            "description": "Missing or wrong bearer token, answered by the function before it reads anything",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           },
           "500": {
             "description": "Unexpected failure",
@@ -215,6 +223,7 @@
                   "SEAT_MAP_NOT_FOUND",
                   "AEROLOPA_UNAVAILABLE",
                   "SEAT_MAP_UNREADABLE",
+                  "UNAUTHORIZED",
                   "NOT_FOUND",
                   "METHOD_NOT_ALLOWED",
                   "INTERNAL_ERROR"
@@ -631,7 +640,7 @@
         "properties": {
           "id": {
             "type": "string",
-            "description": "The AeroLOPA slug; pass it as `slug` to /aerolopa/seatmap.",
+            "description": "The AeroLOPA slug; pass it as `slug` to /seatmap.",
             "examples": ["lo-7m8-1"]
           },
           "airlineIata": {
@@ -651,16 +660,16 @@
       }
     },
     "securitySchemes": {
-      "whiskAuth": {
-        "type": "apiKey",
-        "in": "header",
-        "name": "X-Require-Whisk-Auth"
+      "bearerAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "description": "The shared function secret, published at the SSM parameter /mypreflight/aerolopa-provider/secret"
       }
     }
   },
   "security": [
     {
-      "whiskAuth": []
+      "bearerAuth": []
     }
   ]
 }
diff --git a/src/core/provider/aerolopa/client/aerolopa.client.spec.ts b/src/core/provider/aerolopa/client/aerolopa.client.spec.ts
index f4398c55..dc83b81b 100644
--- a/src/core/provider/aerolopa/client/aerolopa.client.spec.ts
+++ b/src/core/provider/aerolopa/client/aerolopa.client.spec.ts
@@ -6,7 +6,7 @@ import {
   SeatMapUnreadableError,
 } from '../error/aerolopa.error';
 
-const BASE_URL = 'https://faas.example/aerolopa-provider/aerolopa';
+const BASE_URL = 'https://faas.example';
 
 const SEATMAP_URL = `${BASE_URL}/seatmap`;
 
@@ -43,7 +43,7 @@ describe('AerolopaClient', () => {
 
     const [url, init] = fetchMock.mock.calls[0];
     expect(url).toBe(`${SEATMAP_URL}?op=seatmap&slug=lh-32n`);
-    expect(init.headers['X-Require-Whisk-Auth']).toBe(SECRET);
+    expect(init.headers.Authorization).toBe(`Bearer ${SECRET}`);
   });
 
   it('upper cases the codes when resolving', async () => {
diff --git a/src/core/provider/aerolopa/client/aerolopa.client.ts b/src/core/provider/aerolopa/client/aerolopa.client.ts
index c7233e5c..aabe524f 100644
--- a/src/core/provider/aerolopa/client/aerolopa.client.ts
+++ b/src/core/provider/aerolopa/client/aerolopa.client.ts
@@ -78,7 +78,7 @@ export class AerolopaClient {
         {
           headers: {
             Accept: 'application/json',
-            'X-Require-Whisk-Auth': this.functionSecret,
+            Authorization: `Bearer ${this.functionSecret}`,
           },
         },
         FETCH_OPTIONS,
diff --git a/src/core/provider/aerolopa/type/aerolopa.types.ts b/src/core/provider/aerolopa/type/aerolopa.types.ts
index a604cca9..8fdbf78b 100644
--- a/src/core/provider/aerolopa/type/aerolopa.types.ts
+++ b/src/core/provider/aerolopa/type/aerolopa.types.ts
@@ -10,6 +10,7 @@ export type CommentSeverity = 'minor' | 'moderate' | 'major';
 
 export type AerolopaErrorCode =
   | 'BAD_REQUEST'
+  | 'UNAUTHORIZED'
   | 'SEAT_MAP_NOT_FOUND'
   | 'AEROLOPA_UNAVAILABLE'
   | 'SEAT_MAP_UNREADABLE'
diff --git a/src/core/provider/oceanic-tracks/client/oceanic-tracks.client.spec.ts b/src/core/provider/oceanic-tracks/client/oceanic-tracks.client.spec.ts
index caee0650..5d70a2f1 100644
--- a/src/core/provider/oceanic-tracks/client/oceanic-tracks.client.spec.ts
+++ b/src/core/provider/oceanic-tracks/client/oceanic-tracks.client.spec.ts
@@ -2,7 +2,7 @@ import { OceanicTracksClient } from './oceanic-tracks.client';
 import { OceanicTracksSet } from '../type/oceanic-tracks.types';
 import { OceanicTracksUnavailableError } from '../error/oceanic-tracks.error';
 
-const BASE_URL = 'https://faas.example/oceanic-tracks-provider/oceanic-tracks';
+const BASE_URL = 'https://faas.example';
 
 const SECRET = 'shared-secret';
 
@@ -54,7 +54,7 @@ describe('OceanicTracksClient', () => {
 
     const [url, init] = fetchMock.mock.calls[0];
     expect(url).toBe(`${BASE_URL}/tracks`);
-    expect(init.headers['X-Require-Whisk-Auth']).toBe(SECRET);
+    expect(init.headers.Authorization).toBe(`Bearer ${SECRET}`);
   });
 
   it.each(['NMS_UNAVAILABLE', 'FIX_DIRECTORY_UNAVAILABLE'])(
diff --git a/src/core/provider/oceanic-tracks/client/oceanic-tracks.client.ts b/src/core/provider/oceanic-tracks/client/oceanic-tracks.client.ts
index 9d37577b..e16caaa5 100644
--- a/src/core/provider/oceanic-tracks/client/oceanic-tracks.client.ts
+++ b/src/core/provider/oceanic-tracks/client/oceanic-tracks.client.ts
@@ -28,7 +28,7 @@ export class OceanicTracksClient {
         {
           headers: {
             Accept: 'application/json',
-            'X-Require-Whisk-Auth': this.functionSecret,
+            Authorization: `Bearer ${this.functionSecret}`,
           },
         },
         FETCH_OPTIONS,
diff --git a/src/core/provider/oceanic-tracks/oceanic-tracks.openapi.json b/src/core/provider/oceanic-tracks/oceanic-tracks.openapi.json
index 47f1dc4b..bb594425 100644
--- a/src/core/provider/oceanic-tracks/oceanic-tracks.openapi.json
+++ b/src/core/provider/oceanic-tracks/oceanic-tracks.openapi.json
@@ -2,8 +2,8 @@
   "openapi": "3.1.0",
   "info": {
     "title": "MyPreflight oceanic tracks provider",
-    "description": "A DigitalOcean Function returning today's organised oceanic tracks, with every fix placed on the map. It currently serves the Pacific tracks (PACOTS) from the FAA NOTAM Management Service.\n\nDeployed as a functions component of the `mypreflight` App Platform app. Every request must carry the `X-Require-Whisk-Auth` header declared as `webSecure` in project.yml; the platform rejects the request before the function runs otherwise.",
-    "version": "1.0.0",
+    "description": "An AWS Lambda function returning today's organised oceanic tracks, with every fix placed on the map. It currently serves the Pacific tracks (PACOTS) from the FAA NOTAM Management Service.\n\nServed from a Lambda Function URL. Every request must carry the function secret as `Authorization: Bearer <secret>`; the function answers 401 before doing anything else otherwise.",
+    "version": "2.0.0",
     "license": {
       "name": "Unlicense",
       "url": "https://opensource.org/licenses/Unlicense"
@@ -11,8 +11,14 @@
   },
   "servers": [
     {
-      "url": "https://<app-host>/oceanic-tracks-provider",
-      "description": "App Platform ingress route"
+      "url": "https://{urlId}.lambda-url.eu-central-1.on.aws",
+      "description": "The Lambda Function URL, published at the SSM parameter /mypreflight/oceanic-tracks-provider/url",
+      "variables": {
+        "urlId": {
+          "default": "function-url-id",
+          "description": "The Function URL's identifier"
+        }
+      }
     },
     {
       "url": "http://localhost:3020",
@@ -21,11 +27,11 @@
   ],
   "security": [
     {
-      "whiskAuth": []
+      "bearerAuth": []
     }
   ],
   "paths": {
-    "/oceanic-tracks/tracks": {
+    "/tracks": {
       "get": {
         "summary": "List today's oceanic tracks",
         "description": "Returns every track currently published, westbound PACOTS from Oakland (KZAK) and eastbound PACOTS from Fukuoka (RJJJ), each with its validity, route, the fixes placed on the map and the raw message.\n\nPoints written as latitude and longitude are placed from their own text. Named fixes and navaids are placed from the FAA's published aeronautical data; a name that exists in more than one place takes the one nearest its neighbours on the track, and a fix nobody can place is listed in `unresolvedFixes` rather than guessed.\n\nThe function takes no arguments. The assembled tracks are cached in the function instance for 5 minutes, and fix positions for 24 hours, which keeps the function well inside the FAA's limit of one data pull every 3 minutes.",
@@ -42,7 +48,22 @@
             }
           },
           "401": {
-            "description": "Missing or wrong X-Require-Whisk-Auth header; rejected by the platform"
+            "description": "Missing or wrong bearer token; the function refuses the request with UNAUTHORIZED",
+            "headers": {
+              "WWW-Authenticate": {
+                "schema": {
+                  "type": "string",
+                  "const": "Bearer"
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           },
           "500": {
             "description": "The FAA credentials are not configured, or an unexpected failure",
@@ -70,10 +91,10 @@
   },
   "components": {
     "securitySchemes": {
-      "whiskAuth": {
-        "type": "apiKey",
-        "in": "header",
-        "name": "X-Require-Whisk-Auth"
+      "bearerAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "description": "The function secret, generated by the OpenTofu stack and published at the SSM parameter /mypreflight/oceanic-tracks-provider/secret"
       }
     },
     "schemas": {
@@ -88,6 +109,7 @@
               "code": {
                 "type": "string",
                 "enum": [
+                  "UNAUTHORIZED",
                   "NMS_UNAVAILABLE",
                   "FIX_DIRECTORY_UNAVAILABLE",
                   "NMS_NOT_CONFIGURED",
diff --git a/src/core/provider/oceanic-tracks/type/oceanic-tracks.types.ts b/src/core/provider/oceanic-tracks/type/oceanic-tracks.types.ts
index 545ac3ba..8b91eafc 100644
--- a/src/core/provider/oceanic-tracks/type/oceanic-tracks.types.ts
+++ b/src/core/provider/oceanic-tracks/type/oceanic-tracks.types.ts
@@ -1,4 +1,5 @@
 export type OceanicTracksErrorCode =
+  | 'UNAUTHORIZED'
   | 'NMS_UNAVAILABLE'
   | 'FIX_DIRECTORY_UNAVAILABLE'
   | 'NMS_NOT_CONFIGURED'
diff --git a/src/core/provider/osm/client/osm.client.spec.ts b/src/core/provider/osm/client/osm.client.spec.ts
index d3f09fb8..0398885b 100644
--- a/src/core/provider/osm/client/osm.client.spec.ts
+++ b/src/core/provider/osm/client/osm.client.spec.ts
@@ -6,7 +6,7 @@ import {
   OsmProviderUnavailableError,
 } from '../error/osm.error';
 
-const BASE_URL = 'https://faas.example/osm-provider/airport';
+const BASE_URL = 'https://faas.example';
 
 const PULL_URL = `${BASE_URL}/pull`;
 
@@ -48,7 +48,7 @@ describe('OsmClient', () => {
 
     const [url, init] = fetchMock.mock.calls[0];
     expect(url).toBe(`${PULL_URL}?icao=EDDW`);
-    expect(init.headers['X-Require-Whisk-Auth']).toBe(SECRET);
+    expect(init.headers.Authorization).toBe(`Bearer ${SECRET}`);
   });
 
   it('upper cases the ICAO code', async () => {
diff --git a/src/core/provider/osm/client/osm.client.ts b/src/core/provider/osm/client/osm.client.ts
index 2402adda..ceacfb9e 100644
--- a/src/core/provider/osm/client/osm.client.ts
+++ b/src/core/provider/osm/client/osm.client.ts
@@ -66,7 +66,7 @@ export class OsmClient {
         {
           headers: {
             Accept: 'application/json',
-            'X-Require-Whisk-Auth': this.functionSecret,
+            Authorization: `Bearer ${this.functionSecret}`,
           },
         },
         FETCH_OPTIONS,
diff --git a/src/core/provider/osm/osm.openapi.json b/src/core/provider/osm/osm.openapi.json
index 91404165..91ed629b 100644
--- a/src/core/provider/osm/osm.openapi.json
+++ b/src/core/provider/osm/osm.openapi.json
@@ -2,8 +2,8 @@
   "openapi": "3.1.0",
   "info": {
     "title": "MyPreflight OpenStreetMap provider",
-    "description": "A DigitalOcean Function returning one airport's infrastructure \u2014 boundary, runways, terminals, parking positions and gates \u2014 read from OpenStreetMap through the Overpass API and transformed into the platform's common airport format.\n\nRead-only by design: the function holds no Flight Tracker credentials and writes nothing. The backend keeps the answer in memory, an operator reviews it, and only then does the backend write it into the airport model.\n\nDeployed as a functions component of the `mypreflight` App Platform app. Every request must carry the `X-Require-Whisk-Auth` header declared as `webSecure` in project.yml; the platform rejects the request before the function runs otherwise.",
-    "version": "1.0.0",
+    "description": "An AWS Lambda function returning one airport's infrastructure \u2014 boundary, runways, terminals, parking positions and gates \u2014 read from OpenStreetMap through the Overpass API and transformed into the platform's common airport format.\n\nRead-only by design: the function holds no Flight Tracker credentials and writes nothing. The backend keeps the answer in memory, an operator reviews it, and only then does the backend write it into the airport model.\n\nServed from a Lambda Function URL. Every request must carry the function secret as a bearer token in the `Authorization` header; the function refuses the request with `401` before doing anything else otherwise.",
+    "version": "2.0.0",
     "license": {
       "name": "Unlicense",
       "url": "https://opensource.org/licenses/Unlicense"
@@ -11,8 +11,13 @@
   },
   "servers": [
     {
-      "url": "https://<app-host>/osm",
-      "description": "App Platform ingress route"
+      "url": "https://{urlId}.lambda-url.eu-central-1.on.aws",
+      "description": "The Lambda Function URL, published at the SSM parameter /mypreflight/osm-provider/url",
+      "variables": {
+        "urlId": {
+          "default": "function-url-id"
+        }
+      }
     },
     {
       "url": "http://localhost:3003",
@@ -20,10 +25,10 @@
     }
   ],
   "paths": {
-    "/airport/pull": {
+    "/pull": {
       "get": {
         "summary": "Pull one airport's infrastructure from OpenStreetMap",
-        "description": "Queries Overpass for everything tagged `aeroway` inside the aerodrome whose `icao` tag matches, then transforms it into the common format: runways split per landing direction, stands and gates assigned to their nearest terminal, and each gate linked to the stand it boards onto.\n\nAn aerodrome mapped as a bare node encloses no area, so the client falls back to searching a 8 km radius around it. Nothing is cached \u2014 the backend holds the answer for its review flow, and a second cache here would only serve an operator stale data after they fixed something in OpenStreetMap.\n\n`POST` behaves identically; the platform merges a JSON body into the same arguments.",
+        "description": "Queries Overpass for everything tagged `aeroway` inside the aerodrome whose `icao` tag matches, then transforms it into the common format: runways split per landing direction, stands and gates assigned to their nearest terminal, and each gate linked to the stand it boards onto.\n\nAn aerodrome mapped as a bare node encloses no area, so the client falls back to searching a 8 km radius around it. Nothing is cached \u2014 the backend holds the answer for its review flow, and a second cache here would only serve an operator stale data after they fixed something in OpenStreetMap.\n\n`POST` behaves identically, with the same query parameters.",
         "operationId": "pullAirport",
         "parameters": [
           {
@@ -41,7 +46,7 @@
             "name": "include",
             "in": "query",
             "required": false,
-            "description": "Comma-separated sections to narrow the response to, for staying under the 1 MB result cap on a large hub. The identity fields (`icaoCode`, `name`, `source`) always travel.",
+            "description": "Comma-separated sections to narrow the response to, for staying under the 5 MB result cap on a large hub. The identity fields (`icaoCode`, `name`, `source`) always travel.",
             "schema": {
               "type": "array",
               "items": {
@@ -81,7 +86,14 @@
             }
           },
           "401": {
-            "description": "Missing or wrong X-Require-Whisk-Auth header; rejected by the platform"
+            "description": "Missing or wrong bearer token in the `Authorization` header, answered by the function with `UNAUTHORIZED`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           },
           "404": {
             "description": "OpenStreetMap has no aerodrome tagged with that ICAO code",
@@ -104,7 +116,7 @@
             }
           },
           "413": {
-            "description": "The airport would not fit in a function result; narrow it with `include`",
+            "description": "The airport would not fit under the 5 MB result cap; narrow it with `include`",
             "content": {
               "application/json": {
                 "schema": {
@@ -137,40 +149,42 @@
       },
       "post": {
         "summary": "Pull one airport's infrastructure from OpenStreetMap",
-        "description": "Identical to `GET`; the arguments may arrive as a JSON body instead of a query string.",
+        "description": "Identical to `GET`, with the same query parameters.",
         "operationId": "pullAirportPost",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": ["icao"],
-                "properties": {
-                  "icao": {
-                    "type": "string",
-                    "pattern": "^[A-Za-z]{4}$",
-                    "examples": ["EDDF"]
-                  },
-                  "include": {
-                    "type": "array",
-                    "items": {
-                      "type": "string",
-                      "enum": [
-                        "location",
-                        "shape",
-                        "runways",
-                        "terminals",
-                        "parkingPositions",
-                        "gates"
-                      ]
-                    }
-                  }
-                }
-              }
+        "parameters": [
+          {
+            "name": "icao",
+            "in": "query",
+            "required": true,
+            "description": "Four-letter ICAO code, matched against the aerodrome's `icao` tag. Case-insensitive.",
+            "schema": {
+              "type": "string",
+              "pattern": "^[A-Za-z]{4}$",
+              "examples": ["EDDF"]
+            }
+          },
+          {
+            "name": "include",
+            "in": "query",
+            "required": false,
+            "description": "Comma-separated sections to narrow the response to, for staying under the 5 MB result cap on a large hub. The identity fields (`icaoCode`, `name`, `source`) always travel.",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "location",
+                  "shape",
+                  "runways",
+                  "terminals",
+                  "parkingPositions",
+                  "gates"
+                ]
+              },
+              "examples": [["runways", "terminals"]]
             }
           }
-        },
+        ],
         "responses": {
           "200": {
             "description": "The airport, in the common format",
@@ -191,6 +205,66 @@
                 }
               }
             }
+          },
+          "401": {
+            "description": "Missing or wrong bearer token in the `Authorization` header, answered by the function with `UNAUTHORIZED`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "OpenStreetMap has no aerodrome tagged with that ICAO code",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "405": {
+            "description": "A method other than GET or POST",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "413": {
+            "description": "The airport would not fit under the 5 MB result cap; narrow it with `include`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Unexpected failure",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
+          "502": {
+            "description": "Every Overpass mirror is unreachable or answering unusably",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
           }
         }
       }
@@ -210,6 +284,7 @@
                 "type": "string",
                 "enum": [
                   "BAD_REQUEST",
+                  "UNAUTHORIZED",
                   "METHOD_NOT_ALLOWED",
                   "AERODROME_NOT_FOUND",
                   "OVERPASS_UNAVAILABLE",
@@ -307,7 +382,7 @@
         "properties": {
           "shortName": {
             "type": "string",
-            "description": "From the OSM `ref`, else initials of the name. At most 8 characters, unique within the airport.",
+            "description": "From a `Terminal 1` / `Terminal A` name (`T1`, `A`), else the OSM `ref`, else initials of the name. At most 8 characters, unique within the airport.",
             "examples": ["T1"]
           },
           "fullName": {
@@ -499,7 +574,7 @@
           },
           "name": {
             "type": ["string", "null"],
-            "description": "As OpenStreetMap names the aerodrome; null when it carries no usable name."
+            "description": "As OpenStreetMap names the aerodrome, shortened for a display column: a trailing `Airport` is dropped and `International Airport` becomes `Intl`. Null when the aerodrome carries no usable name."
           },
           "source": {
             "type": "string",
@@ -564,16 +639,16 @@
       }
     },
     "securitySchemes": {
-      "whiskAuth": {
-        "type": "apiKey",
-        "in": "header",
-        "name": "X-Require-Whisk-Auth"
+      "bearerAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "description": "The function secret, exported at the SSM parameter /mypreflight/osm-provider/secret."
       }
     }
   },
   "security": [
     {
-      "whiskAuth": []
+      "bearerAuth": []
     }
   ]
 }
diff --git a/src/core/provider/osm/type/osm.types.ts b/src/core/provider/osm/type/osm.types.ts
index 3f1ad5ee..59d4ac48 100644
--- a/src/core/provider/osm/type/osm.types.ts
+++ b/src/core/provider/osm/type/osm.types.ts
@@ -1,5 +1,6 @@
 export type OsmErrorCode =
   | 'BAD_REQUEST'
+  | 'UNAUTHORIZED'
   | 'METHOD_NOT_ALLOWED'
   | 'AERODROME_NOT_FOUND'
   | 'OVERPASS_UNAVAILABLE'
diff --git a/src/core/provider/postcard/client/postcard.client.spec.ts b/src/core/provider/postcard/client/postcard.client.spec.ts
index de46b925..1ba2b1a0 100644
--- a/src/core/provider/postcard/client/postcard.client.spec.ts
+++ b/src/core/provider/postcard/client/postcard.client.spec.ts
@@ -6,7 +6,7 @@ import {
   PostcardRejectedError,
 } from '../error/postcard.error';
 
-const BASE_URL = 'https://faas.example/postcard-generator/postcard';
+const BASE_URL = 'https://faas.example';
 
 const ART_BASE_URL = 'https://files.example';
 
@@ -75,7 +75,7 @@ describe('PostcardClient', () => {
     expect(url).toBe(
       `${BASE_URL}/city?city=Munich&country=Germany&continent=Europe&uuid=${UUID}`,
     );
-    expect(init.headers['X-Require-Whisk-Auth']).toBe(SECRET);
+    expect(init.headers.Authorization).toBe(`Bearer ${SECRET}`);
   });
 
   it('reports art it did not wait for as not drawn yet', async () => {
@@ -85,7 +85,7 @@ describe('PostcardClient', () => {
         size: '1152x1536',
         key: `postcards/${UUID}.jpg`,
         url: `${ART_BASE_URL}/postcards/${UUID}.jpg`,
-        handoff: { mode: 'activation' },
+        handoff: { mode: 'invocation' },
       }),
     );
 
@@ -104,7 +104,11 @@ describe('PostcardClient', () => {
     fetchMock = jest.spyOn(global, 'fetch').mockResolvedValue(
       jsonResponse(200, {
         ...generated,
-        handoff: { mode: 'inline', reason: 'no public endpoint configured' },
+        handoff: {
+          mode: 'inline',
+          reason:
+            'https://lambda.eu-central-1.amazonaws.com/2015-03-31/functions/postcard-generator/invocations answered 429 TooManyRequestsException',
+        },
       }),
     );
 
diff --git a/src/core/provider/postcard/client/postcard.client.ts b/src/core/provider/postcard/client/postcard.client.ts
index 962ba041..1d35f0c6 100644
--- a/src/core/provider/postcard/client/postcard.client.ts
+++ b/src/core/provider/postcard/client/postcard.client.ts
@@ -82,7 +82,7 @@ export class PostcardClient {
         {
           headers: {
             Accept: 'application/json',
-            'X-Require-Whisk-Auth': this.functionSecret,
+            Authorization: `Bearer ${this.functionSecret}`,
           },
         },
         FETCH_OPTIONS,
diff --git a/src/core/provider/postcard/postcard.openapi.json b/src/core/provider/postcard/postcard.openapi.json
index f343c4e5..5c3c4cee 100644
--- a/src/core/provider/postcard/postcard.openapi.json
+++ b/src/core/provider/postcard/postcard.openapi.json
@@ -2,14 +2,14 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Postcard generator",
-    "version": "1.0.0",
+    "version": "2.0.0",
     "description": "Draws a collectible postcard for a city and stores it in object storage. The caller names the object, so the stored location is known before the response arrives. A render outlives any request, so the generator answers 202 and draws in the background; the caller polls the stored location."
   },
   "paths": {
     "/city": {
       "get": {
         "summary": "Draw a postcard for a city and store it",
-        "description": "These four parameters are the whole surface: the size, the quality, the format and the prompt are the generator's own configuration, so nothing this client sends decides what is drawn or what it costs. The generator validates the request, hands the render to a background activation and answers 202 at once, so 202 is the normal answer and 200 only arrives when the hand-off failed and the render happened inline. Either answer names the stored location, which the caller can also derive from the uuid it sent. A 202 carrying a code and no key comes from the platform rather than the generator and means the same thing. Neither answer means the art exists yet, so the caller confirms the object separately.",
+        "description": "These four parameters are the whole surface: the size, the quality, the format and the prompt are the generator's own configuration, so nothing this client sends decides what is drawn or what it costs. The generator validates the request, hands the render to an asynchronous invocation of itself and answers 202 at once, so 202 is the normal answer and 200 only arrives when the hand-off failed and the render happened inline. Either answer names the stored location, which the caller can also derive from the uuid it sent. Neither answer means the art exists yet, so the caller confirms the object separately.",
         "parameters": [
           {
             "name": "city",
@@ -53,7 +53,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Drawn and stored inline, because every hand-off route refused the render. `handoff.reason` says why, and is the only account of it: the generator's own logs are not retrievable.",
+            "description": "Drawn and stored inline, because the hand-off was refused. `handoff.reason` says why, and is the only account of it: the generator's own logs are not retrievable.",
             "content": {
               "application/json": {
                 "schema": { "$ref": "#/components/schemas/PostcardGenerated" }
@@ -61,15 +61,10 @@
             }
           },
           "202": {
-            "description": "Accepted; the render is running in the background and the art does not exist yet. The normal answer. `handoff.mode` names the route it went out on. A body carrying a code and no key is the platform saying the same thing.",
+            "description": "Accepted; the render is running in the background and the art does not exist yet. The normal answer. `handoff.mode` names the route it went out on.",
             "content": {
               "application/json": {
-                "schema": {
-                  "oneOf": [
-                    { "$ref": "#/components/schemas/PostcardAccepted" },
-                    { "$ref": "#/components/schemas/PlatformError" }
-                  ]
-                }
+                "schema": { "$ref": "#/components/schemas/PostcardAccepted" }
               }
             }
           },
@@ -82,10 +77,10 @@
             }
           },
           "401": {
-            "description": "The shared secret was rejected by the platform before the function ran.",
+            "description": "Missing or wrong bearer token.",
             "content": {
               "application/json": {
-                "schema": { "$ref": "#/components/schemas/PlatformError" }
+                "schema": { "$ref": "#/components/schemas/FunctionError" }
               }
             }
           }
@@ -95,10 +90,10 @@
   },
   "components": {
     "securitySchemes": {
-      "whiskAuth": {
-        "type": "apiKey",
-        "in": "header",
-        "name": "X-Require-Whisk-Auth"
+      "bearerAuth": {
+        "type": "http",
+        "scheme": "bearer",
+        "description": "The function secret, published at the SSM parameter /mypreflight/postcard-generator/secret."
       }
     },
     "schemas": {
@@ -143,7 +138,7 @@
         "type": "object",
         "required": ["mode"],
         "properties": {
-          "mode": { "type": "string", "enum": ["activation", "web", "inline"] },
+          "mode": { "type": "string", "enum": ["invocation", "inline"] },
           "reason": { "type": "string" }
         }
       },
@@ -186,19 +181,15 @@
             "type": "object",
             "required": ["code", "message", "status"],
             "properties": {
-              "code": { "type": "string", "enum": ["BAD_REQUEST"] },
+              "code": {
+                "type": "string",
+                "enum": ["BAD_REQUEST", "UNAUTHORIZED"]
+              },
               "message": { "type": "string" },
               "status": { "type": "integer" }
             }
           }
         }
-      },
-      "PlatformError": {
-        "type": "object",
-        "properties": {
-          "code": { "type": "string" },
-          "error": { "type": "string" }
-        }
       }
     }
   }
diff --git a/src/core/provider/postcard/type/postcard.types.ts b/src/core/provider/postcard/type/postcard.types.ts
index e63b9e13..b2f1aee4 100644
--- a/src/core/provider/postcard/type/postcard.types.ts
+++ b/src/core/provider/postcard/type/postcard.types.ts
@@ -9,7 +9,7 @@ export type PostcardRequest = {
   uuid: string;
 };
 
-export type PostcardHandoffMode = 'activation' | 'web' | 'inline';
+export type PostcardHandoffMode = 'invocation' | 'inline';
 
 export type PostcardHandoff = {
   mode: PostcardHandoffMode;
@@ -47,7 +47,7 @@ export type PostcardGeneratedBody = {
   handoff?: PostcardHandoff;
 };
 
-export type PostcardErrorCode = 'BAD_REQUEST';
+export type PostcardErrorCode = 'BAD_REQUEST' | 'UNAUTHORIZED';
 
 export type PostcardErrorBody = {
   error: {