Agent-friendly CLI for managing Upstash resources from your terminal or CI/CD pipelines.

You can find the Github Repository here.

Installation#

npm i -g @upstash/cli

For agents, install the Upstash Skill instead. It bundles Upstash docs with the upstash CLI so your agent can implement and debug against your resources without filling up its context window:

npx skills add upstash/skills

Free Redis without an account#

If you are an AI agent and need a Redis DB to use or experiment with, you don't need an Upstash account:

upstash start-redis

This is the only command that works unauthenticated. It sends a POST request to https://upstash.com/start-redis and prints markdown with the credentials and a quickstart. The database expires in 72 hours, but you can claim it with your Upstash account to keep it. Especially useful for AI agents that need scratch storage on the fly. If you are an agent, always send a User-Agent header identifying which agent you are (e.g. claude-code, cursor, codex, opencode) on every request you make to this API.

Pass --id to re-fetch the credentials of a database you created earlier:

upstash start-redis --id $DB_ID

Authentication#

Every command that touches your account needs credentials. There are two kinds: a browser login with your Upstash account, or a developer API key. Set them using whichever method fits your workflow.

Signs in with your Upstash account through the browser and saves the session to ~/.config/upstash/config.json (taken from $XDG_CONFIG_HOME).

upstash login --oauth

The consent page asks which account to use (personal or one team) and whether the login should be read-only. The choice applies to the whole login: run upstash login --oauth again to switch teams or turn read-only off. Pass --no-browser to print the login URL instead of opening a browser, for example over SSH.

A browser login has a few limits:

team create, team delete, team add-member and team remove-member need an API key login.
Teams that require MFA reject browser logins.
A read-only login refuses write commands and returns only read-only database credentials.

upstash logout revokes the login on the server. The CLI stays listed in the console under Account → OAuth Clients until you remove it there.

2. Saved API key#

Grab a developer API key from the Upstash Console under Account → API Keys, then save it once per machine:

upstash login

3. Environment variables#

The CLI reads UPSTASH_EMAIL and UPSTASH_API_KEY from the process environment, and also auto-loads them from a .env file in the current directory. This is the recommended setup for CI and agents.

# Exported in your shell or CIexport UPSTASH_EMAIL=you@example.comexport UPSTASH_API_KEY=your_api_key

# Or defined in the .env file of your current working directory (loaded automatically)UPSTASH_EMAIL=you@example.comUPSTASH_API_KEY=your_api_key

Use --env-path to point at a different file:

upstash --env-path .dev.vars redis list

4. Per-command flags#

Override whatever is set above for a single invocation. Handy for scripts that switch between accounts.

upstash --email you@example.com --api-key your_api_key redis list

Note

When credentials come from multiple sources, precedence is:

flags > environment variables > .env > saved login (browser or API key)

Run upstash whoami to see which credentials the CLI is using. For a browser login it also reports the team and whether the login is read-only.

Usage#

upstash start-redis  # free temporary Redis database, no account neededupstash redis   # Redis databasesupstash team    # Teams and membersupstash vector  # Vector indexesupstash search  # Search indexesupstash qstash  # QStash instancesupstash blob    # Blob buckets

Use --help on any command or subcommand for details:

upstash --helpupstash redis --helpupstash redis create --help

Output#

All successful output is JSON, except start-redis, which prints markdown. Pipe JSON output to jq for filtering:

upstash redis list | jq '.[].database_id'upstash vector list | jq '.[] | {id, name, region}'upstash qstash list | jq '.[] | {id, region}'upstash team members --team-id $TEAM_ID | jq '.[].member_email'

Use --dry-run on destructive commands (delete, remove-member) to preview the action before executing it.

Redis#

Core#

upstash redis listupstash redis get --db-id $DB_IDupstash redis get --db-id $DB_ID --hide-credentialsupstash redis create --name $NAME --region $REGIONupstash redis create --name $NAME --region $REGION --read-regions $REGION_1 $REGION_2upstash redis delete --db-id $DB_ID --dry-runupstash redis delete --db-id $DB_IDupstash redis rename --db-id $DB_ID --name $NEW_NAMEupstash redis reset-password --db-id $DB_IDupstash redis stats --db-id $DB_ID

Configuration#

upstash redis enable-tls --db-id $DB_IDupstash redis enable-eviction --db-id $DB_IDupstash redis disable-eviction --db-id $DB_IDupstash redis enable-autoupgrade --db-id $DB_IDupstash redis disable-autoupgrade --db-id $DB_IDupstash redis change-plan --db-id $DB_ID --plan $PLAN        # free, payg, pro, paidupstash redis update-budget --db-id $DB_ID --budget $BUDGET_CENTSupstash redis update-regions --db-id $DB_ID --read-regions $REGION_1 $REGION_2upstash redis move-to-team --db-id $DB_ID --team-id $TEAM_ID

Backups#

upstash redis backup list --db-id $DB_IDupstash redis backup create --db-id $DB_ID --name $NAMEupstash redis backup delete --db-id $DB_ID --backup-id $BACKUP_ID --dry-runupstash redis backup delete --db-id $DB_ID --backup-id $BACKUP_IDupstash redis backup restore --db-id $DB_ID --backup-id $BACKUP_IDupstash redis backup enable-daily --db-id $DB_IDupstash redis backup disable-daily --db-id $DB_ID

Execute Redis commands directly#

redis exec runs commands straight against the Redis REST API. It uses the database token, not your Developer API key. Get endpoint and rest_token from upstash redis get --db-id $DB_ID.

upstash redis exec --db-url $REDIS_URL --db-token $REDIS_TOKEN SET key valueupstash redis exec --db-url $REDIS_URL --db-token $REDIS_TOKEN GET keyupstash redis exec --db-url $REDIS_URL --db-token $REDIS_TOKEN --json '["SET","key","value"]'

--db-url and --db-token can be omitted if UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN are set via environment variable or .env file.

Team#

upstash team listupstash team create --name $NAMEupstash team create --name $NAME --copy-ccupstash team delete --team-id $TEAM_ID --dry-runupstash team delete --team-id $TEAM_IDupstash team members --team-id $TEAM_IDupstash team add-member --team-id $TEAM_ID --member-email $EMAIL --role $ROLEupstash team remove-member --team-id $TEAM_ID --member-email $EMAIL --dry-runupstash team remove-member --team-id $TEAM_ID --member-email $EMAIL

Vector#

upstash vector listupstash vector get --index-id $INDEX_IDupstash vector create --name $NAME --region $REGION --similarity-function $FUNCTION --dimension-count $DIMENSIONupstash vector delete --index-id $INDEX_ID --dry-runupstash vector delete --index-id $INDEX_IDupstash vector rename --index-id $INDEX_ID --name $NEW_NAMEupstash vector reset-password --index-id $INDEX_IDupstash vector set-plan --index-id $INDEX_ID --plan $PLAN          # free, payg, fixedupstash vector transfer --index-id $INDEX_ID --target-account $TARGET_ACCOUNT_IDupstash vector statsupstash vector index-stats --index-id $INDEX_IDupstash vector index-stats --index-id $INDEX_ID --period $PERIOD   # 1h, 3h, 12h, 1d, 3d, 7d, 30d

Search#

upstash search listupstash search get --index-id $INDEX_IDupstash search create --name $NAME --region $REGION --type $INDEX_TYPEupstash search delete --index-id $INDEX_ID --dry-runupstash search delete --index-id $INDEX_IDupstash search rename --index-id $INDEX_ID --name $NEW_NAMEupstash search reset-password --index-id $INDEX_IDupstash search transfer --index-id $INDEX_ID --target-account $TARGET_ACCOUNT_IDupstash search statsupstash search index-stats --index-id $INDEX_IDupstash search index-stats --index-id $INDEX_ID --period $PERIOD   # 1h, 3h, 12h, 1d, 3d, 7d, 30d

QStash#

upstash qstash listupstash qstash get --qstash-id $QSTASH_IDupstash qstash rotate-token --qstash-id $QSTASH_IDupstash qstash set-plan --qstash-id $QSTASH_ID --plan $PLAN             # paid, qstash_fixed_1m, qstash_fixed_10m, qstash_fixed_100mupstash qstash stats --qstash-id $QSTASH_IDupstash qstash stats --qstash-id $QSTASH_ID --period $PERIOD            # 1h, 3h, 12h, 1d, 3d, 7d, 30dupstash qstash ipv4upstash qstash move-to-team --qstash-id $QSTASH_ID --target-team-id $TARGET_TEAM_IDupstash qstash update-budget --qstash-id $QSTASH_ID --budget $BUDGET_DOLLARS   # 0 = no limitupstash qstash enable-prodpack --qstash-id $QSTASH_IDupstash qstash disable-prodpack --qstash-id $QSTASH_ID

Blob#

upstash blob listupstash blob get --bucket-id $BUCKET_IDupstash blob get --bucket-id $BUCKET_ID --hide-credentials          # omit token and token_nextupstash blob create --name $NAME --visibility $VISIBILITY           # private (default), publicupstash blob create --name $NAME --cors $ORIGIN $ORIGIN             # space-separated originsupstash blob delete --bucket-id $BUCKET_ID --dry-runupstash blob delete --bucket-id $BUCKET_IDupstash blob credentials --bucket-id $BUCKET_ID                     # temporary S3 credentialsupstash blob credentials                                            # from UPSTASH_BLOB_TOKEN

blob credentials exchanges a bucket token for temporary, bucket-scoped S3 credentials for use with the AWS CLI, rclone, or any S3 SDK. expiresAt is the credential's expiry.

Installation#

Free Redis without an account#

Authentication#

1. Browser login#

2. Saved API key#

3. Environment variables#

4. Per-command flags#

Usage#

Output#

Redis#

Core#

Configuration#

Backups#

Execute Redis commands directly#

Team#

Vector#

Search#

QStash#

Blob#