> ## Documentation Index
> Fetch the complete documentation index at: https://upstash.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ACL SETUSER

> Create or modify a user with the specified attributes.

Use `ACL SETUSER` to create a new ACL user or change the rules of an existing one.

Rules are applied left to right in a single call: they enable or disable the user (`on`, `off`), grant or revoke access to key patterns (`~pattern`), channel patterns (`&pattern`), commands and categories (`+get`, `-@admin`), and manage passwords. Because rules are cumulative, calling `SETUSER` again only adds to or removes from what a user already has; use `reset` to start over from a clean slate.

## Syntax

```redis theme={"system"}
ACL SETUSER <username> [rule ...]
```

## Arguments

| Argument   | Required | Repeatable | Description                                            |
| ---------- | -------- | ---------- | ------------------------------------------------------ |
| `username` | Yes      | No         | ACL user to create or modify.                          |
| `rule`     | No       | Yes        | One rule token, applied in order. See the table below. |

| Rule                        | Effect                                                                                                                              |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `on` / `off`                | Enable or disable authentication for the user.                                                                                      |
| `>token`                    | Add a password. `token` must be a value returned by [`ACL GENTOKEN`](/docs/redis/commands/server/acl-gentoken), not an arbitrary string. |
| `<token`                    | Remove a password previously added this way.                                                                                        |
| `!hash`                     | Remove a password by its 64-character lowercase SHA-256 hash.                                                                       |
| `resetpass`                 | Remove every password set on the user.                                                                                              |
| `~pattern`                  | Grant access to keys matching `pattern`.                                                                                            |
| `allkeys`                   | Alias for `~*`.                                                                                                                     |
| `resetkeys`                 | Remove every key pattern granted so far.                                                                                            |
| `&pattern`                  | Grant access to pub/sub channels matching `pattern`.                                                                                |
| `allchannels`               | Alias for `&*`.                                                                                                                     |
| `resetchannels`             | Remove every channel pattern granted so far.                                                                                        |
| `+command` / `-command`     | Grant or revoke a single command.                                                                                                   |
| `+@category` / `-@category` | Grant or revoke every command in a category; see [`ACL CAT`](/docs/redis/commands/server/acl-cat).                                       |
| `allcommands`               | Alias for `+@all`.                                                                                                                  |
| `nocommands`                | Alias for `-@all`.                                                                                                                  |
| `reset`                     | Reset the user to its just-created state: `resetpass`, `resetkeys`, `resetchannels`, `off`, `nocommands`.                           |

## Important points

* This command can expose administrative information or make a broad destructive change. Restrict it to trusted code paths.
* `nopass` is rejected. Every user must have at least one password; there is no way to allow authentication with any password.
* Plain-text passwords (`>password`) and pre-hashed passwords (`#hash`) are rejected. Passwords must be generated with [`ACL GENTOKEN`](/docs/redis/commands/server/acl-gentoken) and added with `>token`; this is what lets the same credential authenticate on both the TCP and REST endpoints.
* Subcommand-scoped rules such as `+client|list` are not supported and return an error.
* The `default` user cannot be modified; the command returns an error if it is the target.
* Changes take effect immediately on new and existing connections, so a rule that narrows access can lock out a running application. Check with [`ACL GETUSER`](/docs/redis/commands/server/acl-getuser) before applying it broadly.

## Response

The reply reports the result of the operation. Error replies have the same shape in RESP2 and RESP3 and are surfaced as exceptions by the SDKs below.

| Protocol | Reply              |
| -------- | ------------------ |
| RESP2    | Simple string `OK` |
| RESP3    | Simple string `OK` |

<Note>
  Client libraries often decode bulk strings, maps, sets, and numeric strings into language-native values. The table describes the Redis wire reply.
</Note>

## Examples

TCP examples use the TLS `REDIS_URL` from the Upstash console. REST examples use `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN`.

<AccordionGroup>
  <Accordion title="Redis CLI" icon="terminal">
    ```bash theme={"system"}
    ACL SETUSER app on ~cache:* +get +set
    ```
  </Accordion>

  <Accordion title="@upstash/redis" icon="node-js" iconType="brands">
    <Note>
      This command is not supported yet in `@upstash/redis`.
    </Note>
  </Accordion>

  <Accordion title="upstash_redis" icon="python" iconType="brands">
    <Note>
      This command is not supported yet in `upstash_redis`.
    </Note>
  </Accordion>

  <Accordion title="ioredis" icon="node-js" iconType="brands">
    ```ts theme={"system"}
    import Redis from "ioredis";

    const redis = new Redis(process.env.REDIS_URL!);
    const result = await redis.acl("SETUSER", "app", "on", "~cache:*", "+get", "+set");
    console.log(result);
    ```
  </Accordion>

  <Accordion title="node-redis" icon="node-js" iconType="brands">
    ```ts theme={"system"}
    import { createClient } from "redis";

    const client = await createClient({ url: process.env.REDIS_URL })
      .on("error", console.error)
      .connect();
    const result = await client.aclSetUser("app", ["on", "~cache:*", "+get", "+set"]);
    console.log(result);
    ```
  </Accordion>

  <Accordion title="redis-py" icon="python" iconType="brands">
    ```python theme={"system"}
    import os
    import redis

    client = redis.from_url(os.environ["REDIS_URL"])
    result = client.acl_setuser(
        "app",
        enabled=True,
        keys=["cache:*"],
        commands=["+get", "+set"],
    )
    print(result)
    ```
  </Accordion>

  <Accordion title="go-redis" icon="golang" iconType="brands">
    ```go theme={"system"}
    package main

    import (
        "context"
        "fmt"
        "os"

        "github.com/redis/go-redis/v9"
    )

    func main() {
        opts, err := redis.ParseURL(os.Getenv("REDIS_URL"))
        if err != nil {
            panic(err)
        }
        client := redis.NewClient(opts)
        result, err := client.ACLSetUser(context.Background(), "app", "on", "~cache:*", "+get", "+set").Result()
        if err != nil {
            panic(err)
        }
        fmt.Println(result)
    }
    ```
  </Accordion>

  <Accordion title="jedis" icon="java" iconType="brands">
    ```java theme={"system"}
    import java.net.URI;

    import redis.clients.jedis.Jedis;

    try (Jedis jedis = new Jedis(new URI(System.getenv("REDIS_URL")))) {
      Object result = jedis.aclSetUser("app", "on", "~cache:*", "+get", "+set");
      System.out.println(result);
    }
    ```
  </Accordion>

  <Accordion title="redis-rs" icon="rust" iconType="brands">
    ```rust theme={"system"}
    use redis::TypedCommands;
    use redis::acl::Rule;

    fn main() -> redis::RedisResult<()> {
        let url = std::env::var("REDIS_URL").expect("REDIS_URL is not set");
        let client = redis::Client::open(url)?;
        let mut connection = client.get_connection()?;

        let rules = [
            Rule::On,
            Rule::Pattern("cache:*".to_string()),
            Rule::AddCommand("get".to_string()),
            Rule::AddCommand("set".to_string()),
        ];
        connection.acl_setuser_rules("app", &rules)?;
        Ok(())
    }
    ```
  </Accordion>
</AccordionGroup>


## Related topics

- [ACL GENPASS](/docs/redis/commands/server/acl-genpass.md)
- [ACL GENTOKEN](/docs/redis/commands/server/acl-gentoken.md)
- [ACL RESTTOKEN](/docs/redis/commands/server/acl-resttoken.md)
- [ACL SAVE](/docs/redis/commands/server/acl-save.md)
- [ACL LOAD](/docs/redis/commands/server/acl-load.md)