Cache

Valkey (Redis-compatible), shared by all projects, with an ACL user per project limited to keys starting with <project>:.

mybase cache enable shop     # prints the password (TCP only) once
mybase cache info shop

• TCP (LAN/Tailscale), any Redis client: new Redis("redis://shop:<password>@<host>:6379", { keyPrefix: "shop:" }).
• HTTP (anywhere): createCache from @mybase-dev/sdk/cache or @upstash/redis, with an API key that has cache:write, at https://mybase.example.com/cache/<project>.

Memory is capped (64 MB by default, whole server) with LRU eviction, and snapshots are saved at most every 15 minutes: treat it as a cache, not a database. Guide: SDK cache.

SecurityCopy Anchor Link

• The TCP password crosses the network in plain text: use :6379 only on the LAN or Tailscale (VALKEY_BIND=127.0.0.1 otherwise), and the HTTP API from anywhere else.
• Keys can be evicted at any time and memory is shared: never store secrets or anything you can't rebuild.

More: Security best practices.

Agent notesCopy Anchor Link

• Every key must start with <project>:; others get NOPERM.
• Commands that list or count other projects' keys (KEYS, SCAN, DBSIZE, PUBSUB CHANNELS) are refused. Over HTTP, blocking, subscribe, and MULTI are refused too (use /multi-exec).
• The password can't be shown again: mybase cache password <project> --rotate replaces it.