Providers / Upstash

Databases

Upstash API keys and credentials

What every Upstash credential a founder holds does, whether it expires, and what tends to break. Each fact links to Upstash's own docs.

Last checked 2026-11-06 · upstash.com

At a glance

Each credential

Developer API key (email + API key, HTTP Basic auth)

• Not documented

Used as HTTP Basic auth: account email as username, API key as password, against the Management API (for example https://api.upstash.com/v2/redis/databases). Created and managed in the Upstash Console. The API docs page does not describe creation, rotation, revocation, or expiry.

Upstash docs

Redis REST token (Standard and Read Only)

• Not documented
• Can be scoped

Two tokens per database: Standard (full access) and Read Only (enabled with the Read-Only Token switch). Copy from Console, Connect section, REST tab (UPSTASH_REDIS_REST_TOKEN). ACL users can get a token with ACL RESTTOKEN and it carries that user's permissions. Resetting the database password revokes both tokens. No expiry is documented for REST tokens (the 72-hour wording applies to databases created via /start-redis, not tokens).

Upstash docs

Redis database password

• Not documented
• Full access only

Resetting it revokes both REST tokens, per the REST API docs, so update every consumer afterwards. The reset steps for the password itself were not confirmed from an official page.

Upstash docs

Upstash Console login

• Not documented

Console sign-in. Not an API credential. Session policy not researched.

What usually goes wrong

• Resetting the database password revokes both REST tokens, so every app using REST breaks until it gets the new token
• Read Only token used by a service that writes, returning permission errors
• Developer API key in CI config with no documented expiry or rotation process

Renewals and billing

• Upstash plan. Plan and billing cadence not researched.

Not researched.

What Upstash's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

• Developer API key creation, rotation, revocation, and expiry (not on the fetched pages)
• QStash token lifecycle (not researched)
• Whether a Redis REST token can be regenerated without resetting the database password
• Redis database password reset steps from an official Upstash page
• Console login policy
• Billing model, usage API, and plan cadence

Rotating or replacing a Upstash key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Sources

• upstash.com/docs/devops/developer-api/authentication
• upstash.com/docs/devops/developer-api/overview
• upstash.com/docs/redis/features/restapi

Related providers

Keep track of every Upstash key

StackHangar stores your Upstash keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.