# Calling Upstash Redis from web and mobile clients

## The rule

Only the read-only token may ship in client-side code. The standard
token has full privilege and must stay server side. If a standard token
leaks into a shipped bundle, reset the database password in the console
immediately to revoke it.

## Pattern: cache-aside from the client

1. Client checks Redis with the read-only token -  GET product:123.
2. Hit: render it.
3. Miss: call your API, which reads the source of truth with the
   standard token, writes the result back to Redis with a TTL, and
   returns it.

The client never writes. Your API owns all writes and invalidation.

## Latency

Browsers and phones are far from your database region. Two options:

- Use a Global database so reads route to the nearest read region.
- Accept the round trip and set generous TTLs so repeat views never
  leave the device cache.

## What the read-only token cannot do

Writes, obviously. Less obviously: SCAN and KEYS are blocked too, so
client code cannot enumerate your keyspace. Design your key layout so
clients always know the exact keys they need.