Render Keyvalue

RenderOfficialCreated by Render

Skill
Tool integration
Data and AI
MIT
No issues found

From the author

Provisions and configures Render Key Value (Redis-compatible Valkey 8) instances for caching, session storage, and job queues. Use when the user needs Key Value, uses Redis or Valkey, or needs a cache, session store, or job queue backend, or needs to configure maxmemory policy, ipAllowList, connection strings, or internal vs external access. Trigger terms: Key Value, Redis, Valkey, cache, session store, REDIS_URL, maxmemory, ipAllowList, allkeys-lru, noeviction.

— the description by Render

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Render Key Value provides low-latency, in-memory storage powered by Valkey 8, a drop-in replacement for Redis. This skill guides users through provisioning instances, configuring access controls, selecting appropriate memory eviction policies, and wiring connections to other services within the Render platform. It covers both internal and external connectivity, authentication requirements, and best practices for using Key Value as a cache, session store, or job queue backend.

What it does

Provisions Valkey 8 instances for caching, session storage, and job queues.
Configures maxmemory policies such as allkeys-lru or noeviction based on use case.
Manages ipAllowList settings for internal and external network access.
Provides patterns for wiring connection strings to services using Blueprints.
Explains the distinction between internal and external connection URLs.
Offers guidance on troubleshooting common connection and authentication issues.

When to use it

When you need to add a cache or session store to your web application.
When setting up a job queue backend for frameworks like Celery, Sidekiq, or BullMQ.
When configuring network access and security for your Key Value instance.
When you need to define or update your service configuration in a render.yaml Blueprint.
When troubleshooting connection refused or authentication errors.

Advantages

Seamless integration with existing Redis-compatible client libraries.
Optimized for low-latency communication via internal private networking.
Flexible configuration for both ephemeral caching and persistent job queue needs.
Clear guidance on Blueprint-based infrastructure as code.

Usage examples

“How do I add a Redis-compatible cache to my Render Blueprint?”: The agent provides a YAML snippet for a keyvalue service, including the required ipAllowList and the fromService configuration to inject the REDIS_URL into your application.
“Should I use allkeys-lru or noeviction for my job queue?”: The agent explains that noeviction is required for job queues to prevent data loss, whereas allkeys-lru is appropriate for caches where eviction is acceptable.
“How do I connect to my Render Key Value instance from my local machine?”: The agent explains how to enable external access by adding your IP to the allow list and using the external rediss:// URL with TLS and authentication.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/render-oss/render-keyvalue/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip render-keyvalue.zip -d .agents/skills

Documentation by Render

Render Key Value

Render Key Value provides low-latency, Redis-compatible in-memory storage running Valkey 8. Use it as a shared cache, session store, or job queue backend. Compatible with virtually all Redis client libraries.

When to Use

Adding a cache or session store to a web app
Wiring a job queue backend for Celery, Sidekiq, BullMQ, Asynq, or Oban
Choosing the right maxmemory policy (cache vs queue)
Configuring ipAllowList in Blueprints (required field)
Connecting via internal vs external URLs
Troubleshooting auth failures or connection refused errors

For background worker setup and queue framework patterns, see render-background-workers. For Blueprint authoring, see render-blueprints.

Before configuring or troubleshooting an internal Key Value connection, read references/private-networking.md.

Key Concepts

Valkey 8 (not Redis)

New instances run Valkey 8, an open-source Redis fork. It is a drop-in replacement for Redis—existing Redis client libraries work without changes. Legacy instances (created before Feb 2025) run Redis 6.

Connection URLs

Every instance has two URLs:

URL type	When to use	Auth required
Internal (`redis://red-xxx:6379`)	From Render services in the same workspace and region	No (by default)
External (`rediss://red-xxx:6379`)	From outside Render (local dev, CI)	Always

Always prefer the internal URL for production services—lower latency, no TLS overhead, communicates over the private network.

External connections are disabled by default. Enable them by adding IP ranges to the access control list in the Dashboard.

Internal authentication

By default, internal connections are unauthenticated. You can require auth for internal connections in the Dashboard for compliance or extra security. This changes the internal URL to include credentials:

redis://default:PASSWORD@red-xxx:6379

Warning: Enabling internal auth breaks existing unauthenticated connections. Migrate clients to the authenticated URL first.

Maxmemory Policy

Critical decision. Choose based on your use case:

Use case	Policy	Why
Cache (can lose data)	`allkeys-lru`	Evicts least-recently-used keys to free space
Job queue (cannot lose data)	`noeviction`	Returns error on writes when full; never drops keys
Session store	`allkeys-lru` or `volatile-lru`	Sessions can be regenerated; LRU is safe

All available policies:

Policy	Behavior	Memory fills up?
`allkeys-lru`	Evict any key by LRU	No
`noeviction`	Error on writes when full	Yes
`volatile-lru`	Evict keys with TTL by LRU	Yes
`volatile-lfu`	Evict keys with TTL by LFU	Yes
`allkeys-lfu`	Evict any key by LFU	No
`volatile-random`	Evict random keys with TTL	Yes
`allkeys-random`	Evict any random key	No
`volatile-ttl`	Evict keys nearest to expiry	Yes

Blueprint Configuration

services:
  - type: keyvalue
    name: cache
    plan: starter
    region: oregon
    maxmemoryPolicy: allkeys-lru
    ipAllowList: []

`ipAllowList` is required

Blueprints must include ipAllowList on Key Value services. Common patterns:

Value	Meaning
`[]`	No external access (internal only—recommended for most apps)
`[{source: "0.0.0.0/0", description: "everywhere"}]`	Open external access (use sparingly)
`[{source: "203.0.113.0/24", description: "office"}]`	Specific IP ranges

Wiring to services

Use fromService with type: keyvalue and property: connectionString:

envVars:
  - key: REDIS_URL
    fromService:
      name: cache
      type: keyvalue
      property: connectionString

Available fromService properties for Key Value:

Property	Value
`connectionString`	Full internal URL (`redis://red-xxx:6379`)
`host`	Hostname only
`port`	Port only (typically `6379`)

Data Persistence

Paid instances: Disk-backed, appendfsync everysec. You may lose up to 1 second of writes on interruption.
Free instances: No disk persistence. Data is lost on restart or upgrade.
Upgrading from Free: All data is lost during the upgrade because Free instances have no disk.

Compute Plans and Changes

The compute plan determines available memory and connection limits. Use references/compute-plans.md for current Plan IDs and Key Value-specific change guidance.

Connection Examples

See references/connection-examples.md for client code in Node.js (ioredis, node-redis), Python (redis-py), Ruby (redis-rb, Sidekiq), and Go.

Common Mistakes

Mistake	Fix
Missing `ipAllowList` in Blueprint	Add `ipAllowList: []` for internal-only access
Using `allkeys-lru` for job queues	Switch to `noeviction`—LRU eviction drops queued jobs
Connecting with external URL from a Render service	Use the internal URL for lower latency and no auth requirement
Forgetting `type: keyvalue` in `fromService`	`type` is required; without it the wiring fails
Using deprecated `redis` type alias	Prefer `keyvalue` in new Blueprints (`redis` still works but is deprecated)

References

Document	Contents
`references/compute-plans.md`	Current Plan IDs, specifications, availability, and Key Value plan changes
`references/private-networking.md`	Current private-network scope, internal addressing, isolation, and troubleshooting
`references/connection-examples.md`	Client code for Node.js, Python, Ruby, Go
`references/troubleshooting.md`	Auth errors, connection refused, memory full, migration from Redis 6

render-background-workers — Queue consumer setup with Celery, Sidekiq, BullMQ
render-blueprints — Full render.yaml schema, fromService patterns
render-networking — Private network, internal URLs
render-env-vars — Wiring REDIS_URL and other connection vars

Current documentation retrieval

Whenever this skill directs you to consult current Render documentation:

Retrieve the linked Markdown document directly with an available URL-fetching tool or HTTP client, such as curl. Do not substitute web-search summaries for the document.
Confirm that retrieval succeeded and returned the expected document, then read its contents. Saving a file or printing its path is not sufficient.
If the request fails or your tool cannot read the Markdown response, open and read the linked HTML version instead.
If neither version can be retrieved, disclose that the current reference is unavailable and follow any topic-specific fallback in the skill. Use bundled guidance only for stable constraints, and do not guess at changeable platform details.

When a task requires multiple references, apply this workflow to each one and distinguish the documents you verified from those that remain unavailable.

Files

ATTRIBUTION.mdAdded by AutoGineer887 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md7.7 KiB
references/compute-plans.md2.6 KiB
references/connection-examples.md2.3 KiB
references/private-networking.md4.3 KiB
references/troubleshooting.md2.9 KiB

references/private-networking.md

Private networking

Render services can communicate over a private network without traversing the public internet. Private-network peers must belong to the same workspace and run in the same region. An isolated project environment can additionally block traffic both to and from resources outside that environment, so workspace and region matching alone do not guarantee connectivity.

Before designing, configuring, or troubleshooting private-network communication, fetch the current Render private-network reference:

Using the documentation-retrieval workflow in the root SKILL.md, retrieve and read the Markdown reference or its HTML version.

Read the relevant sections. Confirm current service-type capabilities, port restrictions, environment-isolation behavior, discovery-hostname guidance, and plan requirements instead of relying on a memorized catalog.

Web services and private services have internal hostnames and can receive private-network traffic. A private service must bind at least one port; use a background worker instead when a workload does not need to accept inbound connections. Render Postgres and Key Value instances provide internal connection URLs. Workflows, background workers, and cron jobs can initiate private-network connections but do not have an internal address for receiving them. Static sites are not on the private network. Free web services can initiate private-network connections but cannot receive them.

Prefer the internal address or URL shown under Connect > Internal in the Render Dashboard. Include the protocol when the client or server requires one; an address such as service:10000 does not by itself establish whether to use HTTP, HTTPS, or another protocol. A process that receives traffic must listen on the intended port and on an interface reachable outside its own container, such as 0.0.0.0, rather than only on loopback.

For Blueprint-managed connections, fetch the current Blueprint specification and use supported service or database references instead of copying a generated hostname, port, credential, or connection string. Web and private services currently expose host, port, and hostport properties. A Blueprint can obtain another service's discovery hostname by referencing that service's RENDER_DISCOVERY_SERVICE environment variable with fromService.envVarKey; the discovery hostname is not a service property. The fetched specification is authoritative for the syntax and supported references.

A service can expose at most 75 ports on the private network. Ports 18012, 18013, and 19099 are unavailable for private-network communication. Port 10000 is not generally blocked: for a web service, private traffic to port 10000 routes to its primary HTTP server even when that server binds to another port. In that case, both port 10000 and the actual primary HTTP port route to the same server.

Use a service's normal internal hostname for ordinary service-to-service traffic. For advanced per-instance communication, each web or private service has a discovery hostname, conventionally formed by appending -discovery to its internal hostname, that resolves to all active instance IP addresses. A service receives its own discovery hostname in RENDER_DISCOVERY_SERVICE. Use DNS APIs that honor the system resolver configuration, and do not persist resolved instance IPs because they can change between deploys. Prefer hostname-based communication unless per-instance addressing or custom load balancing is specifically required.

When a private-network connection fails, verify the workspace, region, project-environment isolation settings, whether the destination service type accepts inbound traffic, the internal hostname or URL, protocol, port, listening interface, current deploy health, and DNS resolution. Do not substitute a public URL or expose a private service merely to bypass a private-network configuration problem.

AWS PrivateLink is a separate Pro-or-higher feature for connecting a Render private network to compatible AWS-hosted systems. Fetch its current documentation before proposing or configuring it; do not treat ordinary Render service-to-service networking and PrivateLink as interchangeable.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Node.js

The author says: Render Key Value instances (free and paid plans)

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Render

Publisher

Render (Official)

Source

render-oss/skills · skills/render-keyvalue · commit b985a63

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Render or Render.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download render-keyvalue.zip