{
  "schema_version": 2,
  "id": "develop/clients/go/amr",
  "title": "Connect to Azure Managed Redis",
  "url": "https://redis.io/docs/latest/develop/clients/go/amr/",
  "summary": "Learn how to authenticate to an Azure Managed Redis (AMR) database",
  "tags": [
    "docs",
    "develop",
    "stack",
    "oss",
    "rs",
    "rc",
    "oss",
    "kubernetes",
    "clients"
  ],
  "last_updated": "2026-09-09T09:42:14+01:00",
  "page_type": "content",
  "content_hash": "8ff3272fd7182939297514de42c7f43378489f826336396d557f052f53d88035",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "The [`go-redis-entraid`](https://github.com/redis/go-redis-entraid) package\nlets you authenticate your app to\n[Azure Managed Redis (AMR)](https://azure.microsoft.com/en-us/products/managed-redis)\nusing [Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/).\nYou can authenticate using a system-assigned or user-assigned\n[managed identity](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview)\nor a [service principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals),\nletting `go-redis-entraid` fetch and renew the authentication tokens for you automatically."
    },
    {
      "id": "install",
      "title": "Install",
      "role": "setup",
      "text": "Install [`go-redis`](https://redis.io/docs/latest/develop/clients/go) if you\nhave not already done so. Note that `go-redis-entraid`\nrequires `go-redis` v9.9.0 or above, so you should upgrade if you\nare using an earlier version.\n\nInstall `go-redis-entraid` with the following command:\n\n[code example]"
    },
    {
      "id": "create-a-streamingcredentialsprovider-instance",
      "title": "Create a `StreamingCredentialsProvider` instance",
      "role": "content",
      "text": "The `StreamingCredentialsProvider` interface defines methods\nto provide credentials for authentication. Use an object that\nimplements this interface to obtain the authentication credentials you\nneed when you connect to Redis. See the sections below to learn how\nto create the `StreamingCredentialsProvider` instances for AMR\nusing the factory functions that `go-redis-entraid` provides."
    },
    {
      "id": "streamingcredentialsprovider-for-a-service-principal",
      "title": "`StreamingCredentialsProvider` for a service principal",
      "role": "content",
      "text": "Use the `NewConfidentialCredentialsProvider()` factory function to create a\n`StreamingCredentialsProvider` that authenticates to AMR using a\nservice principal (see the\n[Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals) to learn more about service principals).\n\nYou will need the following details of your service principal to make the connection:\n\n- Client ID\n- Client secret\n- Tenant ID\n\nUse an `AuthorityConfiguration` instance to pass the tenant ID.\nThis type has the following fields:\n\n-   `AuthorityType`: This should have one of the values\n    - `identity.AuthorityTypeDefault` (\"default\")\n    - `identity.AuthorityTypeMultiTenant` (\"multi-tenant\")\n    - `identity.AuthorityTypeCustom` (\"custom\")\n-   `TenantID`: Pass your tenant ID string here, or use \"common\" for\n    a multi-tentant application.\n-   `Authority`: Custom authority URL. This is only required if you\n    specified `AuthorityTypeCustom` in the `AuthorityType` field.\n\nThe example below shows how to import the required modules and call\n`NewConfidentialCredentialsProvider()`:\n\n[code example]"
    },
    {
      "id": "streamingcredentialsprovider-for-a-managed-identity",
      "title": "`StreamingCredentialsProvider` for a managed identity",
      "role": "content",
      "text": "Use the `NewManagedIdentityCredentialsProvider()` function to create a\n`StreamingCredentialsProvider` that authenticates to AMR using a\nmanaged identity (see the\n[Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview) to learn more about managed identities).\n\nThe example below shows how to import the required modules and call\n`NewManagedIdentityCredentialsProvider()`.\nPass `identity.SystemAssignedIdentity` or `identity.UserAssignedIdentity`\nas the `ManagedIdentityType` parameter.\n\n[code example]"
    },
    {
      "id": "custom-configuration",
      "title": "Custom configuration",
      "role": "content",
      "text": "The examples above use a default configuration but you can also provide a custom\nconfiguration using the `TokenManagerOptions` field of `CredentialsProviderOptions`:\n\n[code example]\n\nYou can then pass this configuration when you create the\n`StreamingCredentialsProvider`. The example below shows how to do this\nwith the `NewManagedIdentityCredentialsProvider()` method:\n\n[code example]\n\nThe fields of `TokenManagerOptions` are explained below:\n\n-   `ExpirationRefreshRatio`: A `float` value representing the fraction\n    of a token's lifetime that should elapse before attempting to\n    refresh it. For example, a value of 0.75 means that you want to\n    refresh the token after 75% of its lifetime has passed.\n-   `LowerRefreshBounds`: The minimum amount of the token's lifetime\n    (in milliseconds) remaining before attempting to refresh, regardless\n    of the `expirationRefreshRatio` value. Set this to zero if you want\n    the refresh time to depend only on `expirationRefreshRatio`.\n-   `RetryOptions`: This object specifies how to retry a token request\n    after failure. The available options are:\n    -   `MaxAttempts`: The maximum number of times to retry a token request\n        The default value is 3.\n    -   `InitialDelay`: The initial delay between retries in milliseconds. This\n        will be modified during successive attempts by the `BackoffMultiplier`\n        value (see below). The default is 1000ms.\n    -   `BackoffMultiplier`: The factor by which the `InitialDelay` is multiplied\n        between attempts, following an\n        [exponential backoff](https://en.wikipedia.org/wiki/Exponential_backoff)\n        strategy. The default multiplier is 2.0.\n    -   `IsRetryable`: A function that receives an `error` parameter and returns\n        a boolean `true` result if an attempt that failed with that error is\n        retryable and `false` otherwise. Use this to implement your own custom\n        logic to decide which errors should be retried."
    },
    {
      "id": "connect",
      "title": "Connect",
      "role": "content",
      "text": "When you have created your `StreamingCredentialsProvider` instance, you are ready to\nconnect to AMR.\nThe example below shows how to pass the instance as a parameter to the standard\n`NewClusterClient()` connection method. It also illustrates how to use\n[`os.Getenv()`](https://pkg.go.dev/os#Getenv) to get the connection details\nfrom environment variables rather than include their values in the code.\n\n[code example]"
    },
    {
      "id": "more-information",
      "title": "More information",
      "role": "content",
      "text": "See the [`go-redis-entraid`](https://github.com/redis/go-redis-entraid)\nGitHub repository for full source code and more examples and details."
    }
  ],
  "examples": [
    {
      "id": "install-ex0",
      "language": "bash",
      "code": "go get github.com/redis/go-redis-entraid",
      "section_id": "install"
    },
    {
      "id": "streamingcredentialsprovider-for-a-service-principal-ex0",
      "language": "go",
      "code": "import (\n    \"github.com/redis-developer/go-redis-entraid/entraid\"\n    \"github.com/redis-developer/go-redis-entraid/identity\"\n        ...\n)\n    .\n    .\nprovider, err := entraid.NewConfidentialCredentialsProvider(\n    entraid.ConfidentialCredentialsProviderOptions{\n\t    ConfidentialIdentityProviderOptions: identity.ConfidentialIdentityProviderOptions{\n\t\t    ClientID:        \"<your-azure-client-id>\",\n\t\t    ClientSecret:    \"<your-azure-client-secret>\",\n\t\t    CredentialsType: identity.ClientSecretCredentialType,\n\t\t    Authority: identity.AuthorityConfiguration{\n\t\t\t    AuthorityType: identity.AuthorityTypeDefault,\n\t\t\t    TenantID:      \"<your-azure-tenant-id>\",\n\t\t    },\n\t    },\n    },\n)",
      "section_id": "streamingcredentialsprovider-for-a-service-principal"
    },
    {
      "id": "streamingcredentialsprovider-for-a-managed-identity-ex0",
      "language": "go",
      "code": "import (\n    \"github.com/redis-developer/go-redis-entraid/entraid\"\n    \"github.com/redis-developer/go-redis-entraid/identity\"\n        ...\n)\n    .\n    .\nprovider, err := entraid.NewManagedIdentityCredentialsProvider(\n\tentraid.ManagedIdentityCredentialsProviderOptions{\n\t\tManagedIdentityProviderOptions: identity.ManagedIdentityProviderOptions{\n\t\t\tManagedIdentityType:  identity.UserAssignedObjectID,\n\t\t\tUserAssignedObjectID: \"<your-user-assigned-client-id>\",\n\t\t},\n\t},\n)",
      "section_id": "streamingcredentialsprovider-for-a-managed-identity"
    },
    {
      "id": "custom-configuration-ex0",
      "language": "go",
      "code": "options := entraid.CredentialsProviderOptions{\n    TokenManagerOptions: manager.TokenManagerOptions{\n        ExpirationRefreshRatio: 0.7,\n        LowerRefreshBounds: 10000,\n        RetryOptions: manager.RetryOptions{\n            MaxAttempts: 3,\n            InitialDelay: 1000 * time.Millisecond,\n            MaxDelay: 30000 * time.Millisecond,\n            BackoffMultiplier: 2.0,\n            IsRetryable: func(err error) bool {\n                return strings.Contains(err.Error(), \"network error\") ||\n                    strings.Contains(err.Error(), \"timeout\")\n            },\n        },\n    },\n}",
      "section_id": "custom-configuration"
    },
    {
      "id": "custom-configuration-ex1",
      "language": "go",
      "code": "provider, err := entraid.NewManagedIdentityCredentialsProvider(\n\tentraid.ManagedIdentityCredentialsProviderOptions{\n\t    CredentialsProviderOptions: options,\n\t\tManagedIdentityProviderOptions: identity.ManagedIdentityProviderOptions{\n\t\t\tManagedIdentityType:  identity.UserAssignedObjectID,\n\t\t\tUserAssignedObjectID: \"<your-user-assigned-client-id>\",\n\t\t},\n\t},\n)",
      "section_id": "custom-configuration"
    },
    {
      "id": "connect-ex0",
      "language": "go",
      "code": "package main\n\nimport (\n    \"context\"\n    \"fmt\"\n    \"log\"\n    \"os\"\n    \"strings\"\n\n    \"github.com/redis-developer/go-redis-entraid/entraid\"\n    \"github.com/redis/go-redis/v9\"\n)\n\nfunc main() {\n    // Get required environment variables\n    redisEndpoint := os.Getenv(\"REDIS_ENDPOINT\")\n    if redisEndpoint == \"\" {\n        log.Fatal(\n            \"REDIS_ENDPOINT environment variable is required\"\n        )\n    }\n\n    // Create credentials provider for system assigned identity\n    provider, err := entraid.NewManagedIdentityCredentialsProvider(\n        entraid.ManagedIdentityCredentialsProviderOptions{\n\t\t    ManagedIdentityProviderOptions: identity.ManagedIdentityProviderOptions{\n\t\t\t    ManagedIdentityType: identity.SystemAssignedIdentity,\n\t\t    },\n        }\n    )\n    if err != nil {\n        log.Fatalf(\"Failed to create credentials provider: %v\", err)\n    }\n\n    // Create Redis client\n    // Note: AMR databases have clustering enabled by default.\n    client := redis.NewClusterClient(&redis.Options{\n        Addr: redisEndpoint,\n        StreamingCredentialsProvider: provider,\n    })\n    defer client.Close()\n\n    // Test connection\n    ctx := context.Background()\n    if err := client.Ping(ctx).Err(); err != nil {\n        log.Fatalf(\"Failed to connect to Redis: %v\", err)\n    }\n    log.Println(\"Connected to Redis!\")\n}",
      "section_id": "connect"
    }
  ]
}