API Keys
Brev API keys authenticate CLI commands and automation without a browser login. Each personal API key belongs to one organization and acts on behalf of the user who created it.
Brev API keys authenticate to Brev. To store credentials for a workload, such as an NGC API key, use Secrets.
Create an API Key
Open API Keys
In the Brev Console, select the organization, open Account Settings, and select API Keys.
Configure the Key
Select Create API Key, then set:
- Name: A descriptive name, such as
training-automation. - Access: Read or Read & Write. Choose the minimum access the workflow needs.
- Expiration date: Choose a future date. The default is 30 days; the key expires at the end of the selected day.
- Organization: Confirm the displayed organization. To use a different organization, cancel and switch organizations first.
Select Create.
The full key is shown only once. If you lose it, create a replacement and delete the old key. Keep keys out of source code, shared logs, and notebooks.
Access and Permissions
The selected access level limits what the key can do. Your access to resources in the selected organization also applies; choosing Read & Write does not give you additional organization permissions.
A key cannot be used to switch to another organization. Create a separate key for each organization your workflow needs.
Organization Owners, Admins, Maintainers, and Members can create their own keys. You can view, edit, and delete your own keys. Organization Owners and Admins can also view and delete other users’ keys, but cannot edit them or recover their full values.
Authenticate the CLI
Save a Key for Later Commands
Run the following with your key in place of the placeholder:
The CLI saves the key locally and selects its organization automatically. The --api-key flag requires a value; it does not prompt for one.
If you want to configure SSH, run brev refresh after signing in. It fetches the SSH key and host entries that brev shell, brev exec, and brev copy need.
Use a Key in Automation
Have your CI system or secret manager supply the key through the BREV_API_KEY environment variable. You can also pass a key explicitly to a command with --api-key.
For example, register an external Linux machine using a Read & Write key:
Registration resolves the organization from the key. Passing a key directly to brev register or setting BREV_API_KEY does not save it for later sessions. For subsequent Brev Connect setup commands, pass --api-key again or keep BREV_API_KEY set.
Registration does not enable SSH or grant users access. Run brev enable-ssh on the registered machine, then brev grant-ssh for yourself or a teammate. See Brev Connect commands for prerequisites and authentication options. Use a user login on the computer you connect from, as described below.
For a console-generated install-and-register command, follow Connect DGX Spark or Connect DGX Station.
For a complete pipeline that provisions an instance, runs a workload, and deletes it, see Use Brev in CI/CD.
Return to User Login
brev logout removes locally saved credentials; it does not revoke the key in Brev or clear an environment variable in your shell.
Edit, Rotate, or Delete a Key
The API Keys list shows each key’s name, prefix, access level, expiration, and last use.
- Edit: Open your key’s actions menu, select Edit, change its Name or Access, and select Save. Editing does not replace the key value or extend its expiration. Expired keys cannot be edited in the Console.
- Rotate: Create a new key, update the credential used by your scripts or CI jobs, verify access, then delete the old key. Create a replacement before expiration to avoid interrupting automation.
- Delete: Open the key’s actions menu, select Delete, and confirm. Applications using that key lose access. Deletion cannot be undone.