UpstashError: WRONGPASS invalid or missing auth token

By Ohad Krispin, founder of VibeRaven · LinkedIn

"UpstashError: WRONGPASS invalid or missing auth token" means the Upstash database rejected an @upstash/redis request because the token was missing or wrong. Upstash names two causes: the token variable was never set where the code runs, or the token is the Redis connection password, which only works in traditional Redis clients while HTTP clients need the REST token. Copy UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN from the database's Connect section, set both in Vercel for the environment that fails, and redeploy, because Vercel applies changes to new deployments only. Reproduced the SDK's message with @upstash/redis 1.40.0 on 2026-10-31 against a local stub server that returned the documented body.

What the full error looks like in the logs

The text WRONGPASS invalid or missing auth token comes from the Upstash server. @upstash/redis wraps it in an UpstashError and adds the command it sent (pkg/http.ts). We checked that wrapping against a local stub server that answered with the documented body, and sent nothing to Upstash. Upstash documents the message on its troubleshooting page, and it appears in redis-js issue 1389.

UpstashError: WRONGPASS invalid or missing auth token, command was: [["get","user:1"]]

Which token the SDK uses when two are set

Redis.fromEnv() uses UPSTASH_REDIS_REST_TOKEN when it is set and falls back to KV_REST_API_TOKEN only when it is not (platforms/nodejs.ts). The URL works the same way. After you switch databases, or move from Vercel KV to an Upstash store from the Marketplace, an old UPSTASH_REDIS_REST_TOKEN left in the project is used before the new KV_REST_API_TOKEN. Make sure the URL and the token come from the same database. If the logs show a missing variable instead, read the missing variable warning.

const url = process.env.UPSTASH_REDIS_REST_URL || process.env.KV_REST_API_URL;
const token = process.env.UPSTASH_REDIS_REST_TOKEN || process.env.KV_REST_API_TOKEN;

WRONGPASS with a different ending, and slow failures

"WRONGPASS invalid username-password pair or user is disabled" is a different message. Upstash documents it for TCP connection strings: checking Read-Only Token in the console changes the username from default to default_ro, so the read-only token only works with that username.

A wrong token can also look like a hang. In redis-js issue 1389, an Upstash maintainer wrote that when several requests fail, the server slows the requests down, which makes them look slow.

Checklist

How to fix it, then check the fix

01Open the database in the Upstash console, go to Connect, and copy UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN from the REST tab or the JavaScript snippet. Do not use the Redis connection password.

Find where the app reads them, and look for a second pair that could win:

grep -rnE "UPSTASH_REDIS_REST|KV_REST_API" --exclude-dir=node_modules --exclude-dir=.next .

03In the Vercel project's Environment Variables, replace the token, and the URL from the same database, for each environment that fails. Paste with no trailing space or newline: the SDK warns when a token contains whitespace.
04Delete variables that belong to a database you no longer use, so only one URL and token pair is left.
05Redeploy, because Vercel applies changed variables only to new deployments. Then call a route that runs a Redis command: it returns a value, not WRONGPASS.

Sources

Official docs behind this checklist

More provider errors

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

Is the connection password the same as the REST token?

No. Upstash says the connection password works only with traditional Redis clients, and HTTP connections need the HTTP auth token. @upstash/redis is an HTTP client, so it needs the REST token.

Why does it work locally but not on Vercel?

Locally the app reads .env.local. Vercel reads the variables set in the project for the environment being deployed, and applies a change to new deployments only. A fixed token for Production does not reach a Preview deployment unless Preview is selected too.

Does this error mean the database is down?

No. The server answered and rejected the credentials. A missing URL gives a different failure, "Failed to parse URL from /pipeline", before any request leaves the app.