# Calling Upstash Redis from web and mobile clients
## The rule
Only the read-only token may ship in client-side code. The standard
token has full privilege and must stay server side. If a standard token
leaks into a shipped bundle, reset the database password in the console
immediately to revoke it.
## Pattern: cache-aside from the client
1. Client checks Redis with the read-only token - GET product:123.
2. Hit: render it.
3. Miss: call your API, which reads the source of truth with the
standard token, writes the result back to Redis with a TTL, and
returns it.
The client never writes. Your API owns all writes and invalidation.
## Latency
Browsers and phones are far from your database region. Two options:
- Use a Global database so reads route to the nearest read region.
- Accept the round trip and set generous TTLs so repeat views never
leave the device cache.
## What the read-only token cannot do
Writes, obviously. Less obviously: SCAN and KEYS are blocked too, so
client code cannot enumerate your keyspace. Design your key layout so
clients always know the exact keys they need.