Redis

Redis backs refresh tokens, rotation locks, OAuth state, rate limiting, identity records, and session control.

Key namespaces: refresh:<userId>, lock:<userId>, oauth:state:<state>

redis.ts

// By default core reads REDIS_HOST and REDIS_PORT.
// You can also pass an existing ioredis client.
const auth = await createAuthenik8({
  jwtSecret,
  refreshSecret,
  redis: redisClient,
});

What Redis stores

Key pattern	Purpose
refresh:<userId>	The current valid refresh token for a user
lock:<userId>	Mutex to prevent concurrent token refresh
oauth:state:<state>	CSRF state token for OAuth flows
Rate-limit counters	Per-IP request counts for auth.rateLimit