AUTH

Authenticates the connection.

Browse all commands · Upstream source documentation

Reference field	Value
Canonical name	`AUTH`
Catalog group	Connection commands
Upstream since	1.0.0 — upstream Redis/module version, not an ffkv release
Pinned catalog	Redis 8.10.0

Syntax

AUTH [username] password

ffkv behavior and limits

Connection state, selected database, authentication and protocol negotiation belong to the same persistent connection. RESP2 is the default; HELLO 3 selects RESP3. Streamed/unknown-length RESP3 frames are not supported.

Source: README.md:96–120, 391–395; tests/bdd/features/connections.feature.

All requests share the 8 MiB framing/1,024-argument ingress limit; normal RESP replies have 64 MiB wire/logical budgets with bounded nesting/value counts. Management and Lua origins impose smaller budgets. These are not a process RSS cap. Catalog inclusion is not exhaustive option or wire-format parity. See limits and compatibility.

Upstream metadata

The following fields come from the pinned Redis metadata, not measured ffkv performance or an assertion that ffkv enforces every upstream flag. Running COMMAND INFO/COMMAND DOCS describe the current engine.

Upstream Redis complexity: O(N) where N is the number of passwords defined for the user

Upstream arity: -2 (includes the command name; a negative number is a minimum).

Command flags: NOSCRIPT, LOADING, STALE, FAST, NO_AUTH, SENTINEL, ALLOW_BUSY.

ACL categories: CONNECTION.

Argument structure

Argument	Type	Constraints / metadata
`username`	string	optional; since: 6.0.0
`password`	string	Required

Additional pinned upstream metadata

{
  "group": "connection",
  "since": "1.0.0",
  "history": [
    [
      "6.0.0",
      "Added ACL style (username and password)."
    ]
  ]
}

Metadata source · Local snapshot: src/command_metadata.json, key auth.

BDD coverage and source examples

These are source observations, not a test run performed by this documentation build. A tag identifies scenario intent; an extracted vector identifies a command invocation, which may intentionally produce an error. Scenarios may require setup, multiple connections, persistence, cluster nodes or native-module fixtures.

ACL LOG records only the rejected command, key or channel (Scenario Outline) — tests/bdd/features/client_control_repair.feature:344; invocation observed.
Nested Lua key denial retains the calling identity and Lua context — tests/bdd/features/client_control_repair.feature:380; invocation observed.
EXEC reauthorization logs denials in transaction context after an ACL update — tests/bdd/features/client_control_repair.feature:406; invocation observed.
Native module callbacks cannot hide command denials from ACL LOG — tests/bdd/features/client_control_repair.feature:448; invocation observed.
Dynamic index namespace denials are logged without logging visibility filtering — tests/bdd/features/client_control_repair.feature:474; invocation observed.
Dynamic document deletion denials identify only the rejected document — tests/bdd/features/client_control_repair.feature:533; invocation observed.
A denied actual SORT lookup logs the resource and leaves STORE unchanged — tests/bdd/features/client_control_repair.feature:621; invocation observed.
Authentication changes the current user on a persistent connection — tests/bdd/features/connections.feature:4; command tag and invocation observed.
Password-only authentication requires a default password without changing the prior identity on failure — tests/bdd/features/connections.feature:28; command tag and invocation observed.
ACLs authorize prefix namespaces rather than the index name — tests/bdd/features/search.feature:985; invocation observed.
Read-only document grants never authorize DROPINDEX DD deletion — tests/bdd/features/search.feature:1196; invocation observed.
Matching a literal prefix probe does not authorize a whole index namespace — tests/bdd/features/search.feature:1225; invocation observed.
Monitor emits actual failed requests but redacts credential arguments — tests/bdd/features/server.feature:449; invocation observed.
Native registered command flags participate in ACL authorization — tests/bdd/features/server.feature:782; invocation observed.
Native key metadata enforces ACL key patterns and nested Call permissions — tests/bdd/features/server.feature:874; invocation observed.
Existing authenticated sessions observe incremental ACL changes — tests/bdd/features/server.feature:991; invocation observed.
Off blocks new authentication without revoking existing sessions — tests/bdd/features/server.feature:1036; invocation observed.
Password removal and resetpass revoke credentials rather than allowing empty passwords — tests/bdd/features/server.feature:1073; invocation observed.
Hashed passwords are genuine credentials and can be removed by hash — tests/bdd/features/server.feature:1107; invocation observed.
Selectors expose their real rules and cannot combine permissions across selectors — tests/bdd/features/server.feature:1136; invocation observed.
Read and write key patterns independently constrain the same command grant — tests/bdd/features/server.feature:1179; invocation observed.
PubSub command grants cannot borrow channel grants from another selector — tests/bdd/features/server.feature:1221; invocation observed.
ACL log records failed authentication without disclosing supplied passwords — tests/bdd/features/server.feature:1309; invocation observed.
Saved ACL rules reload atomically and survive a server restart — tests/bdd/features/server.feature:1385; invocation observed.
Queue admission checks command ACLs even when script key counts are malformed — tests/bdd/features/transactions_runtime.feature:271; invocation observed.
Script key ACLs are checked at queue admission and rechecked during execution — tests/bdd/features/transactions_runtime.feature:314; invocation observed.

Extracted command vectors

The following JSON arrays are the test harness’s argument vectors, not shell commands. Numeric arguments are converted by the harness; objects of the form {"base64":"…"} represent decoded binary bytes, not a literal JSON command argument. Preserve scenario setup and connection ordering. See the CLI guide for shell quoting and binary stdin. No reply is invented or inferred.

Password-only authentication requires a default password without changing the prior identity on failure — tests/bdd/features/connections.feature:75 (client “application” executes:)

[
  "AUTH",
  "configured"
]

Next source assertion: the reply equals:

"OK"

Authentication changes the current user on a persistent connection — tests/bdd/features/connections.feature:10 (client “application” executes:)

[
  "AUTH",
  "app",
  "secret"
]

Next source assertion: the reply equals:

"OK"

Password removal and resetpass revoke credentials rather than allowing empty passwords — tests/bdd/features/server.feature:1084 (client “new-password” executes:)

[
  "AUTH",
  "rotating",
  "new"
]

Next source assertion: the reply equals:

"OK"