Manage users and ACLs for Public Cloud Databases for Valkey

Objective

This guide explains how to create the users of your Public Cloud Databases for Valkey service and how to define or update their access control lists (ACLs), from the OVHcloud Control Panel or with the OVHcloud API.

Requirements

• A Public Cloud project in your OVHcloud account
• A Valkey service running on your OVHcloud Public Cloud Databases (the Getting started with Public Cloud Databases guide can help you to meet this requirement)
• Access to the OVHcloud API. If you have never used the OVHcloud API before, follow this tutorial: First Steps with the OVHcloud APIs.

OVHcloud Control Panel Access

• Direct link: All my Public Cloud projects
• Navigation path: Public Cloud > Select your project > Databases

Instructions

Understand the ACL fields

Each Valkey user has four ACL fields. Each field is a list of values. They follow the Valkey ACL rules, described in the official documentation: https://valkey.io/topics/acl/.

For example, a user with the following ACLs can read and write the keys starting with cache: and publish or subscribe to the channels starting with news:, but cannot run FLUSHALL:

• Keys: cache:*
• Categories: +@read, +@write, +@connection, +@pubsub
• Commands: -flushall
• Channels: news:*

Keep the following points in mind:

• A channel pattern alone is not enough to use Pub/Sub: the user also needs the Pub/Sub commands, for example with the +@pubsub category. Without it, PUBLISH is refused even on an allowed channel.
• FUNCTION and FCALL are not in the list of commands that can be allowed individually: to allow Lua functions, use the +@scripting category, which also covers EVAL and EVALSHA.
• The +@connection category allows connection commands such as PING and HELLO, which are useful to test a connection.
• When no channel is supplied for a new user, the default channel ACL is set by the valkey_acl_channels_default advanced parameter (allchannels or resetchannels). See Advanced parameters for Public Cloud Databases for Valkey.
• ACL changes apply immediately: connected clients do not need to reconnect.
• A user named default exists on every new service.

The allowed categories and commands can be listed with the API (see List the allowed categories and commands). The categories available are: all, admin, bitmap, blocking, connection, dangerous, fast, geo, hash, hyperloglog, keyspace, list, pubsub, read, scripting, set, slow, sortedset, stream, string, transaction and write.

Using the OVHcloud Control Panel

Select your Valkey service, then open the Users tab. The table lists the users of the service with their keys, categories, commands and channels.

Create a user

1. Click Add user.

2. Enter the Username: 3 to 32 characters, chosen from letters, digits, dots (.), underscores (_) and dashes (-), not starting with a dot or a dash.

3. In the Keys, Categories, Commands and Channels fields, type each value and press Enter (or click the + button) to add it to the list. Categories and commands must start with + or -.

   The Control Panel only accepts lowercase letters and @ after the + or - sign. Commands whose name contains a digit or an underscore, such as +georadius_ro or +bitfield_ro, cannot be entered in the Control Panel: add them with the API (see below).

4. Click Create User.

The password of the new user is displayed once, when the user is created. Note it down: it cannot be retrieved later. If you lose it, reset it (see below).

Edit the ACLs of a user

In the users table, click the ... button at the end of the user's row, then click Edit. Add or remove values in the four fields, then click Edit to confirm. The new ACLs apply immediately.

Reset the password of a user

In the users table, click the ... button at the end of the user's row, then click Reset password and confirm. The new password is displayed once: note it down and update every application that uses this user.

Using the OVHcloud API

Get your service, cluster and user IDs

Get the ID of your Public Cloud project, also known as serviceName:

Get the ID of your Valkey service, also known as clusterId:

List the users of the service:

Get the details of a user, whose ID is also known as userId:

Example response:

{
  "createdAt": "2026-10-06T15:36:54.91456+02:00",
  "id": "aaaaaaaa-1234-56ab-78cd-123456abcdef",
  "status": "READY",
  "username": "app-cache",
  "keys": ["cache:*"],
  "categories": ["+@read", "+@write", "+@connection", "+@pubsub"],
  "commands": ["-flushall"],
  "channels": ["news:*"]
}

List the allowed categories and commands

Get the categories allowed in the categories field:

Get the commands allowed in the commands field:

Both calls return a list of names without the +, - or @ prefixes, for example "read" for the category or "get" for the command.

Create a user

Use the following API call:

Example of request body:

{
  "name": "app-cache",
  "keys": ["cache:*"],
  "categories": ["+@read", "+@write", "+@connection", "+@pubsub"],
  "commands": ["-flushall"],
  "channels": ["news:*"]
}

Only name is required. The response contains the password of the new user. It is displayed only once: note it down.

Update the ACLs of a user

Use the following API call:

Set the new values of the four lists in the request body. Each list replaces the current one, so include all the values you want to keep:

{
  "keys": ["cache:*", "session:*"],
  "categories": ["+@read", "+@write", "+@connection"],
  "commands": ["-flushall"],
  "channels": ["news:*"]
}

The new ACLs apply immediately.

Reset the password of a user

The response contains the new password. It is displayed only once.

Check the ACLs of a user

Connect with the user, for example with valkey-cli (see Connect using the CLI for Public Cloud Databases for Valkey), and run commands inside and outside its permissions. With the example user above:

valkey-cli --tls -u valkeys://<username>:<password>@<host>:<port>

> SET cache:greeting "hello"
OK
> SET other:greeting "hello"
(error) NOPERM No permissions to access a key
> FLUSHALL
(error) NOPERM User app-cache has no permissions to run the 'flushall' command
> PUBLISH sports:live "goal"
(error) NOPERM No permissions to access a channel

If the password is wrong, the connection is refused with WRONGPASS invalid username-password pair or user is disabled.

We want your feedback!

We would love to help answer questions and appreciate any feedback you may have.

For training or technical assistance implementing our solutions, contact your sales representative or visit our Professional Services page to request a quote and have your project analysed by our experts.

Are you on Discord? Connect to our channel at https://discord.gg/ovhcloud and interact directly with the team that builds our databases service!