# AUTH

> Authenticate the current connection with a password, or as a named ACL user.

URL: https://docs.hotkv.com/commands/auth/

```
AUTH password
AUTH username password
```

- Group: Connection
- Complexity: O(N) where N is the number of passwords defined for the user
- HotKV Cloud: all plans
- On-Premise: no license needed

`AUTH` logs the current connection in. With one argument it checks the
password of the `default` user (set with `requirepass` or with
[ACL SETUSER](https://docs.hotkv.com/commands/acl-setuser/index.md)). With two arguments it logs in as the
named ACL user. After a successful `AUTH`, the connection runs commands with
that user's permissions.

With two arguments for a name the ACL does not have, and LDAP login set up
(`iam.ldap.enabled`, with the `enterprise-iam` license feature), the LDAP
directory decides: `AUTH alice password` logs in an LDAP user, who then runs
with the roles they have (see [Roles and single sign-on](https://docs.hotkv.com/operate/iam/index.md)). A
name the ACL has is always the ACL's, whatever the password. `HELLO` with
`AUTH` takes ACL users only.

`AUTH` can be sent before the connection is authenticated, which is the
point of it. To authenticate and switch protocol in one round trip, use
[HELLO](https://docs.hotkv.com/commands/hello/index.md) with its `AUTH` option.

## Options

| Argument | Meaning |
| --- | --- |
| `username` | An ACL user. Omit it to log in as `default`. |
| `password` | The user's password. |

## Return value

| Case | RESP2 | RESP3 |
| --- | --- | --- |
| Logged in | Simple string `OK` | Simple string `OK` |
| Wrong password, unknown user, or disabled user | Error `WRONGPASS invalid username-password pair or user is disabled.` | Same error |
| One-argument form while the `default` user has no password | Error, see below | Same error |

The one-argument form replies with this error when the `default` user does
not need a password:

```
ERR AUTH <password> called without any password configured for the default user. Are you sure your configuration is correct?
```

Every failed attempt is recorded in the ACL log (see [ACL LOG](https://docs.hotkv.com/commands/acl-log/index.md))
and counted in the `acl_access_denied_auth` field of
[INFO](https://docs.hotkv.com/commands/info/index.md) `stats`.

## Examples

```
127.0.0.1:6379> GET greeting
(error) NOAUTH Authentication required.
127.0.0.1:6379> AUTH wrong-password
(error) WRONGPASS invalid username-password pair or user is disabled.
127.0.0.1:6379> AUTH s3cret
OK
127.0.0.1:6379> AUTH alice alice-password
OK
127.0.0.1:6379> ACL WHOAMI
"alice"
```

## Compatibility

Same forms, replies and error strings as Redis 7 and Valkey 8.

## See also

[HELLO](https://docs.hotkv.com/commands/hello/index.md), [ACL SETUSER](https://docs.hotkv.com/commands/acl-setuser/index.md),
[ACL WHOAMI](https://docs.hotkv.com/commands/acl-whoami/index.md), [ACL LOG](https://docs.hotkv.com/commands/acl-log/index.md),
[RESET](https://docs.hotkv.com/commands/reset/index.md)