Upstash Security Best Practices
Secure your Upstash databases with these essential practices. From token management to encryption.
Verify your app follows these best practices automatically.
Upstash provides serverless Redis and Kafka with per-request pricing. These practices help you secure your serverless data stores properly.
Quick Wins
Security Best Practices
#1Use REST API Tokens Appropriately
criticalUpstash provides REST tokens for serverless access. Understand the security implications.
Implementation
Use read-only tokens where possible, never expose tokens in client-side code
#2Store Tokens in Environment Variables
criticalNever hardcode Upstash tokens. Use environment variables for all deployments.
Implementation
Set UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN as env vars
#3Enable TLS Encryption
highEnsure all connections to Upstash use TLS encryption.
Implementation
Use TLS endpoint URLs, verify SSL in connection strings
#4Use Separate Databases per Environment
highDon't share Redis databases between production and development.
Implementation
Create separate Upstash databases for dev/staging/prod
#5Implement Rate Limiting
highUse Upstash rate limiting to protect your APIs from abuse.
Implementation
Use @upstash/ratelimit library for API endpoint protection
#6Monitor Usage and Costs
mediumSet up alerts for unusual usage patterns that might indicate abuse.
Implementation
Configure usage alerts in Upstash dashboard
Common Mistakes to Avoid
Tokens in client-side code
Anyone can see and use your tokens
Only use Upstash tokens server-side, use API routes
Shared database across environments
Development can affect production data
Create separate databases for each environment
No rate limiting on public APIs
APIs can be abused, increasing costs
Use @upstash/ratelimit to protect endpoints
Verify Your Upstash App Security
Following best practices is the first step. Verify your app is actually secure with a comprehensive security scan.
Get Starter ScanFrequently Asked Questions
Is Upstash secure?
Yes, Upstash encrypts data at rest and in transit. Security depends on proper token management - never expose tokens client-side and use separate databases per environment.
Can I use Upstash tokens in browser code?
No, never expose Upstash tokens in client-side code. Use server-side API routes to access Upstash, then expose only the data you need to the client.
How do I protect my APIs with Upstash?
Use @upstash/ratelimit to implement rate limiting on your API routes. This prevents abuse and controls costs by limiting requests per user/IP.
Related Upstash Security Resources
Similar Platforms
Last updated: January 2026