Client-side writes fail on Upstash: the read-only token cant write, move writes server side

TL;DR: Writes from web or mobile clients fail because only the read-only token is exposed there. Move writes behind your API. Confirm Run the same write with the standard token from server side. Fix Move the write behind your API: 1.

The fix

Diagnosing write failures from web and mobile clients

Symptom

Client-side code can GET but every SET, INCR, or DEL fails with a permission error.

Cause

The client holds the read-only token, which is the only token that may ship in client code. It cannot write by design. If writes ever worked from the client, someone shipped the standard token - treat that as a leak, not a feature.

Confirm

Run the same write with the standard token from server side. Success there proves the token scope is the cause.

Fix

Move the write behind your API:

1. Client calls your API endpoint.

2. Your server validates the request, then writes to Redis with the standard token.

3. Optionally return the new value so the client can update its local state without a second read.

For counters and likes, consider an API endpoint that does the INCR and returns the count: one round trip, no client-side Redis writes.

Audit after a leak

If the standard token was ever in shipped client code, reset the database password in the console to revoke it, then re-issue and redistribute. Assume the old token is compromised.

Verify

Client reads succeed, client writes fail closed, and all mutations flow through your API with the standard token.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Client-side writes fail on Upstash.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Client-side behavior.

Verified against Upstash REST security docs: read-only token permits read commands only; the standard token must never be exposed publicly; revocation via password reset. Source: https://upstash.com/docs/redis/features/restapi