🚨 Redis Error Guide: 'ERR Client sent AUTH, but no password is set' — Fix AUTH Against an Unsecured Server

Overview

Redis returns Client sent AUTH, but no password is set when a client issues AUTH to a server that has no password configured. There is nothing to authenticate against, so Redis rejects the attempt. On modern versions the message often adds a pointer to ACLs.

The literal error clients receive:

(error) ERR Client sent AUTH, but no password is set. Can't AUTH in this context.

The mismatch is the whole story: the client is configured with a password, but the server it connected to has neither requirepass nor a matching ACL user password. Usually that means the client hit the wrong instance, or a requirepass you expected to be set is not actually applied.

Symptoms

• A client fails at connect/handshake with this error, before any real command runs.
• The same client credentials work against a different Redis instance.
• Appears after a failover, a config reset, or connecting to the wrong host/port.

redis-cli -a 's3cr3t' PING

(error) ERR Client sent AUTH, but no password is set. Can't AUTH in this context.

Common Root Causes

1. Server has no requirepass, client sends one

The instance is unsecured (empty requirepass) but the client is configured to authenticate.

redis-cli CONFIG GET requirepass

1) "requirepass"
2) ""

An empty value means no password is set — hence the error.

2. Connected to the wrong instance

The client’s password belongs to a different Redis (e.g. prod credentials pointed at a dev instance with no auth).

redis-cli INFO server | grep -E 'redis_version|run_id|tcp_port'

3. ACLs in use instead of requirepass

On Redis 6+, auth may be governed by ACL users. A single-argument AUTH <password> maps to the default user; if that user has no password and nopass isn’t the intent, the context can be wrong.

redis-cli ACL WHOAMI
redis-cli ACL LIST

4. requirepass was cleared at runtime

A CONFIG SET requirepass "" (or a config reload without the directive) removed the password after the client was configured.

How to diagnose

Step 1: Ask the server whether a password is set

redis-cli CONFIG GET requirepass

Empty output confirms the server side has no password — the client should not send AUTH.

Step 2: Verify you are on the intended instance

redis-cli -h <host> -p <port> INFO server | grep -E 'tcp_port|run_id'

Compare tcp_port/run_id to the instance you meant to reach.

Step 3: Inspect ACL configuration (Redis 6+)

redis-cli ACL LIST
redis-cli ACL GETUSER default

Check whether the default user is nopass or has a password.

Step 4: Confirm without a password

redis-cli PING          # if this returns PONG with no -a, the server is unsecured

PONG

Fixes

Stop sending AUTH to an unsecured server

Remove the password from the client’s connection string/config for this instance:

redis-cli PING          # no -a flag needed

Or set a password on the server (recommended for anything reachable)

redis-cli CONFIG SET requirepass 's3cr3t'
redis-cli CONFIG REWRITE
redis-cli -a 's3cr3t' PING     # now AUTH is valid

Better still, define an ACL user rather than a global requirepass:

redis-cli ACL SETUSER appuser on '>s3cr3t' '~app:*' '+@read' '+@write'

Point the client at the correct instance

Fix the host/port so the client reaches the secured server its credentials belong to.

What to watch out for

• This error means the server is unsecured — if that instance is network-reachable, treat it as an exposure risk and add auth (or bind/firewall it) immediately.
• redis-cli -a prints a warning about passwords on the command line; prefer the REDISCLI_AUTH environment variable or interactive AUTH.
• On Redis 6+, AUTH <user> <password> (two args) targets a specific ACL user; single-arg AUTH targets default. A mismatch can surface as auth-context errors.
• The inverse error, NOAUTH Authentication required, means the opposite: the server does require a password and the client did not send one.

Related

• Redis Error: ‘NOAUTH Authentication required’
• Redis Error: ‘WRONGPASS invalid username-password pair or user is disabled’
• Redis Error: ‘NOPERM this user has no permissions’

Paste the client error into the free incident assistant, and browse more Redis guides.