# An authenticated internal URL
redis://USERNAME_HERE:PASSWORD_HERE@red-abc123:6379
```

> [External connections](#enabling-external-connections) always require authentication.

To enforce additional security or fulfill compliance requirements, your Key Value instance can require authentication for internal connections:

1. From your Key Value instance's **Info** page in the [Render Dashboard][dboard], scroll down to the **Connections** section and click **Enable Internal Authentication**:

> **Any existing connections that use your unauthenticated URL will break!**
>
>    Before enabling this feature, we strongly recommend migrating your existing connections to use an authenticated URL. [See below.](#migrating-unauthenticated-key-value-connections)

   [img]

2. A confirmation dialog appears. Review the advisories, then click **Enable Internal Authentication**.

After you confirm, Render restarts your Key Value instance (it will be unavailable for a few seconds).

After the restart:

- Your Key Value instance now requires authentication for all connections.
- In the Render Dashboard, your instance's internal connection URL now includes a username and password.

#### Migrating unauthenticated Key Value connections

Before you [require authentication](#requiring-auth-for-internal-connections) for internal Key Value connections, you can update all of your existing connections to use an authenticated URL. This will prevent those connections from breaking when you enable authentication.

1. Obtain your Key Value instance's _external_ connection URL from the **Connect** menu:

   [img]

> **External URL isn't shown?**
>
>    You first need to add at least one IP range to your instance's [access control list](#enabling-external-connections). To continue blocking all external connections, you can add the dummy IP range `0.0.0.0/32`.

2. Extract the password from your external connection URL. The password starts just after the colon (`:`) and ends just before the "at" symbol (`@`):

   ```
   rediss://user:PASSWORD_HERE@red-abc123:6379
   ```

3. For each service that connects to your Key Value instance with the internal URL, modify its connection string as shown below:

   ```sh
   # Before
   redis://red-abc123:6379

   # After
   redis://default:PASSWORD_HERE@red-abc123:6379
   ```

   Specifically, you add the username `default` and the password you extracted in the previous step. Every Key Value instance has a user named `default`, and this user can accept _any_ password until auth is required.

4. Redeploy your modified services (unless they automatically redeployed when you updated their configuration).

5. You can now proceed through the steps to [require authentication](#requiring-auth-for-internal-connections) for internal connections.

After your Key Value instance restarts with authentication enabled, the `default` user now _requires_ the exact password you provided. Because you've updated your connections accordingly, they remain functional.

### Connecting with CLI tools

The [`redis-cli`](https://redis.io/topics/rediscli) is a useful administrative tool for exploring and manipulating data on your Redis instance. There are 2 ways you can use `redis-cli` with your Redis instance:

- If you have a running non-Docker service, `redis-cli` will be available as part of the environment and is accessible from the service's Shell page. The service must be in the same region as the Redis instance. You can also [SSH into that service](ssh) and run `redis-cli` from there.

- You can run `redis-cli` locally on your machine. You first need to [install](https://redis.io/docs/getting-started/installation/) `redis-cli` onto your machine. A copy and pastable `redis-cli` command is available in the `External Access` section of your Redis settings. Note that you first need to [enable external connections](#enabling-external-connections) for your Redis instance.

> External connections are TLS secured. The Redis CLI command provided will include the `--tls` flag.

After you connect, you can set and get keys using various commands:

```
oregon-redis.render.com:6379> set "render_is_cool" true
OK
oregon-redis.render.com:6379> get "render_is_cool"
"true"
oregon-redis.render.com:6379> KEYS r*
1) "render_is_cool"
```

## Configure your Key Value instance

### Maxmemory policy

Your Key Value instance's **maxmemory policy** determines which data it evicts to free space when it reaches its memory limit. You select a policy on instance creation and can change it later.

- **For caching use cases,** we recommend using `allkeys-lru`.
- **For job queues,** we recommend using `noeviction` to ensure that queued jobs are not lost.
- **For other use cases,** select a policy from the table below based on your requirements.

You can select any of the following policies:

| Option | Description | Can memory fill up? |
|--------|--------|--------|
| `allkeys-lru` | Evict any key using approximated Least Recently Used (LRU). | No |
| `noeviction` | Don't evict data. Instead, return an error on write operations whenever the instance is out of memory. | Yes |
| `volatile-lru` | Evict using approximated LRU, only keys with an expire set. | Yes |
| `volatile-lfu` | Evict using approximated Least Frequently Used (LFU), only keys with an expire set. | Yes |
| `allkeys-lfu` | Evict any key using approximated LFU. | No |
| `volatile-random` | Remove a random key having an expire set. | Yes |
| `allkeys-random` | Remove a random key, any key. | No |
| `volatile-ttl` | Remove the key with the nearest expire time (minor TTL) | Yes |

### Changing instance types

You can upgrade your Key Value instance to a larger instance type with more RAM and a higher connection limit.

> **Note the following before you upgrade:**
>
> - It is not currently possible to downgrade a Key Value instance.
> - Your Key Value instance will be unavailable for a minute or two during the upgrade.
> - If you upgrade a Free Key Value instance, all of its data will be lost.
>   - This is because Free Key Value instances don't persist data to disk.

1. In the [Render Dashboard][dboard], open your instance's **Info** page and scroll down to the **Key Value Instance** section.

2. Under **Instance Type**, click **Update**.

3. Select a new instance type and click **Save Changes**.

> **Need an instance with more than 10 GB of RAM?**
>
> Please reach out to our support team in the [Render Dashboard][dboard].

### Blueprint configuration

As with your other services, you can manage your Key Value instances with [Blueprints](infrastructure-as-code), Render's infrastructure-as-code model. For details and examples, see the [Blueprint YAML Reference](blueprint-spec#render-key-value).

## Data persistence

Paid Key Value instances on Render write their state to disk once per second via the configuration `appendfsync everysec`. If a paid instance experiences an interruption (or if you [upgrade your instance type](#changing-instance-types)), you might lose up to one second of writes.

[Free Key Value instances](free#free-key-value) do _not_ persist data to disk.

## Metrics

Metrics for memory usage, CPU load, and active connections are available from your Key Value instance's Metrics page in the Render Dashboard:

[img]

For details, see [Service Metrics](service-metrics#available-metrics).

<redis-trademark-footnote />