# Classic Redis clients with Upstash: TLS always on, token is the password
## The two rules
1. TLS is on and cannot be turned off. Every client must connect with
TLS enabled.
2. There is no separate password. The token from the console Connect tab
is the password. When a client asks for a password, paste the token.
## Per-client setup
Node (ioredis):
const Redis = require("ioredis");
const client = new Redis({
host: "YOUR_ENDPOINT",
port: 6379,
username: "default",
tls: {},
});
await client.auth("YOUR_TOKEN");
The rediss:// URL scheme also works, but keep credentials out of URLs
you log or commit.
Python (redis-py):
import redis
r = redis.Redis(host="YOUR_ENDPOINT", port=6379, ssl=True)
r.auth("YOUR_TOKEN")
Java (jedis):
Jedis jedis = new Jedis("YOUR_ENDPOINT", YOUR_PORT, true);
jedis.auth("YOUR_TOKEN");
PHP (phpredis):
$redis = new Redis();
$redis->connect("YOUR_ENDPOINT", YOUR_PORT);
$redis->auth("YOUR_TOKEN");
Some PHP builds need explicit TLS stream options; check your phpredis
TLS docs if the handshake fails.
## Read-only token
The console also offers a read-only token. Over RESP it is the password
for the default_ro user and can only run read commands.