Azure Cache for Redis spans Basic → Enterprise. New caches expect TLS.
`drivers.store.kv` stays `redis`.

<Callout title="The one rule">
  Build `rediss://` from **Overview** hostname + **Access keys** primary key + SSL port **6380**. Do
  not use 6379 unless you explicitly allowed non-TLS.
</Callout>

## Find credentials (current portal)

1. Azure Portal → your **Azure Cache for Redis** resource.
2. **Overview** → copy **Host name** (`….redis.cache.windows.net`).
3. **Settings → Authentication** → **Access keys** tab (or **Overview → Show access
   keys**) → copy **Primary** key.
4. Ports: Overview link next to **Ports**, or docs defaults — **6380** TLS, **6379**
   non-TLS (disabled by default on new caches).
5. Enterprise tiers may use port **10000** — check Overview for that SKU.

```bash title="process env"
REDIS_URL=rediss://:PRIMARY_KEY@my-cache.redis.cache.windows.net:6380
```

Azure's “connection string” blade often shows StackExchange-style
`host:6380,password=…,ssl=True` — translate that to `rediss://:password@host:6380` for
oke.

## Production guidance

| Tier                 | Notes                                   |
| -------------------- | --------------------------------------- |
| Basic                | Shared, **no SLA** — not for production |
| Standard             | Replicated                              |
| Premium / Enterprise | Clustering, persistence, VNet           |

Non-TLS: **Settings → Advanced settings → Allow access only via SSL = No** — avoid in
production. Entra ID auth exists on newer tiers; oke's URL driver expects access-key
auth in `REDIS_URL`.

## Real gotcha — port 6380 vs 6379

Using `redis://…:6379` against a TLS-only cache fails. New caches disable non-TLS;
always start from **6380** + `rediss://` unless you intentionally opened 6379.

## Troubleshooting

<Accordions>
<Accordion title="Connection reset / SSL errors on 6379">

TLS-only cache. Switch to port **6380** and `rediss://`. Confirm Advanced settings still
require SSL.

</Accordion>
<Accordion title="WRONGPASS invalid username-password pair">

Primary key rotated or secondary key pasted by mistake. Re-copy **Primary** from
**Authentication → Access keys** and update `REDIS_URL` (empty username, key as
password).

</Accordion>
</Accordions>

## Learn more

- [Redis (image)](/docs/recipes/redis)
- [ElastiCache](/docs/providers/elasticache) · [Memorystore](/docs/providers/memorystore)
- [Store · KV](/docs/elements/store#kv)

## Next

<Cards>
  <Card title="ElastiCache" description="AWS's equivalent." href="/docs/providers/elasticache" />
  <Card title="Memorystore" description="GCP's equivalent." href="/docs/providers/memorystore" />
  <Card
    title="CockroachDB"
    description="Managed SQL-side pair."
    href="/docs/providers/cockroachdb"
  />
</Cards>