Upstash REST 401 Unauthorized: missing or invalid token, prefer the Bearer header

Upstash REST 401 Unauthorized

What you see

HTTP 401 with an auth error body. The command never executed.

Causes

1. No token sent at all. The SDK was constructed without url/token, or Redis.fromEnv() ran with the env vars unset.

2. Wrong token - truncated copy, token from a different database, or a token that was revoked by a password reset.

3. The _token query param got mangled: some HTTP clients or proxies strip query strings on redirects. The REST URL should not redirect, but check you are hitting the exact console URL.

Confirm

curl -X POST https://YOURRESTURL/ping \ -H "your auth header echo

200 with {"result":"PONG"} clears the token. Anything else, re-copy it from the console.

Fix

• Set UPSTASHREDISRESTURL and UPSTASHREDISRESTTOKEN in the environment and use Redis.fromEnv().

• Prefer the Authorization header over the _token query param. Query params land in access logs and are easier to leak.

• In Cloudflare Workers, make sure the secrets were set with wrangler secret put and that fromEnv receives env in module workers.

Verify

The ping above returns PONG, and your app code performs a GET successfully.

Verified against Upstash REST API docs: 401 Unauthorized is returned when authentication fails, token missing or invalid; auth via Authorization Bearer header or _token request parameter. Source: https://upstash.com/docs/redis/features/restapi