Memorystore for Redis (and the Valkey offering) is private-IP only inside your VPC.
`drivers.store.kv` stays `redis`.

<Callout title="The one rule">
  Open the instance → **Connections** for **Primary Endpoint** + port; **Security** for the AUTH
  string. There is no public hostname to paste.
</Callout>

## Find credentials (current console)

1. Google Cloud Console → **Memorystore** → **Redis** (or Valkey) → click **Instance ID**.
2. **Connections** section → copy **Primary Endpoint** (private IP) and **Port**
   (usually `6379`).
3. If AUTH is enabled: **Security** section → **AUTH string** (or
   `gcloud redis instances get-auth-string INSTANCE --region=REGION`).
4. If **in-transit encryption** is on: download the **TLS server certificate** from the
   instance page; clients use port **6378** with that CA (not plain 6379).

```bash title="process env"
# AUTH on, transit encryption off (common default)
REDIS_URL=redis://:AUTH_STRING@10.0.0.3:6379

# Transit encryption on → port 6378 + rediss:// + CA configured in the client
# REDIS_URL=rediss://:AUTH_STRING@10.0.0.3:6378
```

Cloud Run / Cloud Functions need a **Serverless VPC Access** connector on the same
network.

## Production guidance

| Topic      | Guidance                                                                         |
| ---------- | -------------------------------------------------------------------------------- |
| Networking | Private IP only — never a public endpoint option                                 |
| AUTH       | Optional but recommended; string is on the instance Security panel               |
| TLS        | **Not** default — enable in-transit encryption explicitly; port becomes **6378** |
| Tiers      | Basic vs Standard (replica) — pick before you need HA                            |

## Real gotcha — TLS port flip

Enabling in-transit encryption changes the client port to **6378** and requires the
server CA. Leaving `REDIS_URL` on `:6379` after enabling TLS looks like a mysterious
timeout — update port and scheme together.

## Troubleshooting

<Accordions>
<Accordion title="Connection refused / timeout from Cloud Run">

Missing Serverless VPC Access connector, or connector on the wrong VPC. Memorystore is
unreachable from the public internet by design.

</Accordion>
<Accordion title="NOAUTH Authentication required">

AUTH enabled but password omitted from `REDIS_URL`. Copy the AUTH string from
**Security** and use `redis://:AUTH@ip:port`.

</Accordion>
</Accordions>

## Learn more

- [Redis (image)](/docs/recipes/redis) · [Valkey (image)](/docs/recipes/valkey)
- [ElastiCache](/docs/providers/elasticache) — AWS equivalent
- [Store · KV](/docs/elements/store#kv)

## Next

<Cards>
  <Card title="ElastiCache" description="AWS's equivalent." href="/docs/providers/elasticache" />
  <Card
    title="Azure Cache for Redis"
    description="Azure's equivalent."
    href="/docs/providers/azure-redis"
  />
  <Card
    title="Dragonfly Cloud"
    description="Public TLS endpoint option."
    href="/docs/providers/dragonfly-cloud"
  />
</Cards>