Redis

Redis is part of the authentication security boundary. It backs refresh rotation, human sessions, revocation, OAuth state, identity indexes, agent sessions, locks, rate limiting, and IP controls.

Generated Express projects read REDIS_HOST and REDIS_PORT. The fullstack API creates one Redis client from REDIS_URL and passes it to core.

const auth = await createAuthenik8({
  jwt,
  refreshSecret,
  redis: redisClient,
});

Internal namespaces

Core owns its Redis key layout. Applications should use the public session, refresh, OAuth, agent, and security APIs instead of reading or deleting Redis keys directly. Every active key is scoped below the resolved redisKeyPrefix; the default prefix is derived from the configured issuer and audience.

The current internal groups include:

Namespace	Purpose
`<prefix>:sessions:*`	Active human access sessions
`<prefix>:refresh:*`	Current refresh-token records, keyed by a digest of the user and session identifiers
`<prefix>:refresh-families:*`	Indexes used for complete user-wide revocation
`<prefix>:lock:*`	Distributed refresh locks, also keyed by a digest
`<prefix>:oauth:*`	Single-use OAuth state and provider flow state
`<prefix>:oauth:v1:*`	OAuth identity records and indexes
`<prefix>:agent-sessions:*`	Active machine and delegated sessions
`<prefix>:security:*`	Rate-limit and IP allowlist state

These groups are operational context, not a public storage API, and may change between engine releases.

Do not expose Redis publicly. Production deployments should use authentication, transport security where supported, network isolation, and operational monitoring.

Internal namespaces​

Internal namespaces