Authentication

credentials sets an ACL user and its password on every topology; password is the legacy AUTH with a password and no user.

The client logs in on every connection it opens, the subscriptions' own included, and again after each reconnect. credentials names an ACL user, which Redis 6 and later and Valkey check against the user's rules. password logs in as the default user, the form a server configured with requirepass expects. A standalone URL may carry the pair itself (redis://worker:pass@host:6379), and a pair set with credentials wins over it. A cluster seed list and a sentinel list carry no password, so credentials is how those topologies log in.

A login the server refuses fails startup. The generated document never carries the password. A password that changes while the service runs comes from a credential_provider.

Example

The service logs in as the ACL user worker, with a password from the environment.

Macros

examples/redis_broker_auth.rs

/// The ACL user `worker`; its password comes from the environment, never from the source.
fn broker(url: &str, password: &str) -> RedisBroker {
    RedisBroker::standalone(url).credentials("worker", password)
}

#[ruststream::app]
fn app() -> impl App<State = ()> {
    let password = env::var("REDIS_PASSWORD").unwrap_or_default();
    service(broker("redis://localhost:6379", &password))
}

Manual

examples/manual/redis_broker_auth.rs

/// The ACL user `worker`; its password comes from the environment, never from the source.
fn broker(url: &str, password: &str) -> RedisBroker {
    RedisBroker::standalone(url).credentials("worker", password)
}

fn app() -> impl App<State = ()> {
    let password = env::var("REDIS_PASSWORD").unwrap_or_default();
    service(broker("redis://localhost:6379", &password))
}