Brev Connect Commands | NVIDIA Brev Documentation

Use these commands to set up Brev Connect on external hardware, manage SSH access, and deregister machines.

For console registration and a complete SSH setup walkthrough, see Connect DGX Spark or Connect DGX Station.

For connectivity commands (brev shell and brev port-forward) that also work with Brev Connect, see Connectivity.

Authentication and where to run commands

Run register, enable-ssh, disable-ssh, and deregister on the Linux machine being connected. Run grant-ssh and revoke-ssh from any computer with the Brev CLI and permission to manage the target machine.

Brev Connect management commands can prompt you to authenticate again even after brev login. To register and configure SSH without a browser login, pass a valid Read & Write Personal API key with --api-key on each command, or supply it through BREV_API_KEY. Passing a key to brev register does not save it for the next command.

Use your Brev user login on the computer you connect from for brev shell and brev port-forward.

brev register

Register a Linux machine with your Brev organization. This installs the NetBird mesh VPN, profiles the machine’s hardware, and registers it with the Brev API.

brev register

Without flags, registration prompts for a device name, organization, and confirmation. For non-interactive registration with user authentication, provide both --name and --org. With API key authentication, the organization is derived from the key.

Flags

Flag	Short	Description
`--name`	`-n`	Device name (e.g., `my-dgx-spark`); required in non-interactive mode
`--org`	`-o`	Organization name; required in non-interactive mode unless using API key authentication
`--approve`		Skip confirmation prompts
`--registration-token`		Optional registration token supplied by your registration workflow
`--ssh-port`	`-p`	Deprecated; run `brev enable-ssh --ssh-port` after registration instead

Names must start with a letter or digit, contain only letters, digits, hyphens, underscores, or dots, and be at most 63 characters long.

What it does

Installs the NetBird VPN agent via https://pkgs.netbird.io/install.sh
Collects a hardware profile — GPUs (NVML), CPU, RAM, storage, OS, interconnects
Registers the machine with the Brev API
Saves registration data in /etc/brev/device_registration.json and connects the Brev tunnel

Registration does not enable SSH or grant anyone access. If registration is interrupted, rerun it with the same organization to resume the saved registration.

Example

# Register interactively
brev register
# Register to a specific organization
brev register --name my-dgx-spark --org my-team
# Register with an API key (organization resolved automatically)
brev register --name my-dgx-spark --api-key "$BREV_API_KEY"

Requires sudo access. Linux only. The NetBird agent is installed as a systemd service. Non-interactive registration and --approve do not bypass a required sudo password.

brev enable-ssh

Enable SSH on a registered machine by installing the Brev certificate authority for a Linux user and opening the SSH port. Prompts for the Linux user and SSH port to use.

brev enable-ssh

Flags

Flag	Description
`--linux-user`	Linux user to enable SSH for; defaults to the current user in non-interactive mode
`--ssh-port`	SSH destination port; the interactive prompt defaults to `22`. Required in non-interactive mode.

Details

Enables the machine to accept Brev SSH certificates
Run brev grant-ssh afterward to grant yourself or another org member access
Must be run on a registered machine
Requires an SSH server already running on the selected port; this command does not install or start it
The Linux account must exist, and the command must be able to write its ~/.ssh/authorized_keys

Example

brev enable-ssh --linux-user ubuntu --ssh-port 22
# Use the API key from registration to avoid a browser login
brev enable-ssh --linux-user ubuntu --ssh-port 22 --api-key "$BREV_API_KEY"

brev disable-ssh

Run this on the registered machine as the Linux user whose Brev SSH access you want to disable:

brev disable-ssh

Removes the Brev certificate authority entry for this node and Brev-managed keys from the current Linux user’s ~/.ssh/authorized_keys. The machine stays registered, and access configured for other Linux accounts is unchanged. Repeat as each affected Linux user if needed. This command has no command-specific flags.

brev grant-ssh

Grant SSH access to yourself or another member of your organization. Prompts for the organization, machine, port, Brev user, and Linux user. With API key authentication, the organization is derived from the key.

brev grant-ssh

Flags

Flag	Description
`--org`, `-o`	Organization name; required in non-interactive mode unless using API key authentication
`--node`, `-n`	Machine name; required in non-interactive mode
`--user`, `-u`	Brev user ID or email; required in non-interactive mode
`--linux-user`	Linux user on the target machine; defaults to the current local user
`--port-id`	Brev port ID; required in non-interactive mode
`--approve`	Skip confirmation

To find a --port-id, select the machine’s organization with brev org set my-team, then run the beta command brev ports ls my-dgx-spark --json, replacing the names with your organization and machine. Use the port_id of the entry whose destination_port matches the SSH port you enabled. You can also run brev grant-ssh without flags to select the port interactively.

Example

brev grant-ssh
# Select the machine, port, Brev user, and Linux user using API-key authentication
brev grant-ssh --api-key "$BREV_API_KEY"

Requires SSH to already be enabled on the device (run brev enable-ssh first). Select the same Linux user you enabled SSH for. Each person connecting uses their own Brev user login.

brev revoke-ssh

Revoke SSH access from a user. Presents an interactive selector for the organization, machine, and access entry, including the Brev user, Linux user, and port.

brev revoke-ssh

Flags

For non-interactive selection, provide --org, --node, --user (Brev user ID or email), --linux-user, and --port-id. Find the port ID as described under brev grant-ssh, or run brev revoke-ssh without flags to select an existing access entry. Add --approve to skip confirmation.

How it works

Sends a request to the Brev server to revoke the selected SSH access entry.

Example

brev revoke-ssh

brev deregister

Remove the current Linux machine from Brev. Requires sudo access.

brev deregister

Flags

Prompts for confirmation. Use --approve to skip confirmation.

What it does

Unregisters the machine from the Brev server
Removes this node’s certificate authority entry, or legacy Brev keys, from the current Linux user’s ~/.ssh/authorized_keys
Uninstalls the NetBird agent
Deletes /etc/brev/device_registration.json

If SSH was enabled for other Linux accounts, run brev disable-ssh as those users before deregistering to remove their local Brev SSH entries. Check the output for any local cleanup failures; deregistration reports these as warnings.

Example

brev deregister

Using shell and port-forward with Brev Connect

The brev shell and brev port-forward commands work with Brev Connect machines after SSH is enabled and your Brev user has been granted access. Run them on your connecting computer with a user login and the machine’s organization selected. If a workspace with the given name isn’t found, Brev looks up external machines in that organization.

brev login
brev org set my-team
# SSH into a Brev Connect machine
brev shell my-dgx-spark
# Forward a port from a Brev Connect machine
brev port-forward my-dgx-spark --port 8888:8888

brev port-forward forwards TCP over SSH. Run one command per local:remote mapping; repeating --port only uses the last value. The service must already be running on the remote port.

For Brev Connect machines, this command also creates a remote TCP port binding that persists after the local forwarding process exits. To remove that binding, use the beta command brev ports close my-dgx-spark and select the matching destination port.