API Keys
Brev API keys authenticate CLI commands and automation without a browser login. Each personal API key belongs to one organization and acts on behalf of the user who created it.
Brev API keys authenticate to Brev. To store credentials for a workload, such as an NGC API key, use Secrets.
Create an API Key
Open API Keys
In the Brev Console, select the organization, open Account Settings, and select API Keys.
Configure the Key
Select Create API Key, then set:
- Name: A descriptive name, such as
training-automation. - Access: Read or Read & Write. Choose the minimum access the workflow needs.
- Expiration date: Choose a future date. The default is 30 days; the key expires at the end of the selected day.
- Organization: Confirm the displayed organization. To use a different organization, cancel and switch organizations first.
Select Create.
The full key is shown only once. If you lose it, create a replacement and delete the old key. Keep keys out of source code, shared logs, and notebooks.
Access and Permissions
The selected access level limits what the key can do. Your access to resources in the selected organization also applies; choosing Read & Write does not give you additional organization permissions.
A key cannot be used to switch to another organization. Create a separate key for each organization your workflow needs.
Organization Owners, Admins, Maintainers, and Members can create their own keys. You can view, edit, and delete your own keys. Organization Owners and Admins can also view and delete other users’ keys, but cannot edit them or recover their full values.
Authenticate the CLI
Save a Key for Later Commands
Run the following with your key in place of the placeholder:
The CLI saves the key locally and selects its organization automatically. The --api-key flag requires a value; it does not prompt for one. Current CLI versions do not require --org-id.
Use a Key in Automation
Have your CI system or secret manager supply the key through the BREV_API_KEY environment variable. You can also pass a key explicitly to a command with --api-key.
For example, register an external Linux machine using a Read & Write key:
Registration resolves the organization from the key. Passing a key directly to brev register or setting BREV_API_KEY does not save it for later sessions; use brev login --api-key to save it. See Brev Connect commands for registration prerequisites and SSH setup.
Return to User Login
brev logout removes locally saved credentials; it does not revoke the key in Brev or clear an environment variable in your shell. Use a user login for SSH workflows: API-key login does not set up your user SSH credentials.
Edit, Rotate, or Delete a Key
The API Keys list shows each key’s name, prefix, access level, expiration, and last use.
- Edit: Open your key’s actions menu, select Edit, change its Name or Access, and select Save. Editing does not replace the key value or extend its expiration. Expired keys cannot be edited in the Console.
- Rotate: Create a new key, update the credential used by your scripts or CI jobs, verify access, then delete the old key. Create a replacement before expiration to avoid interrupting automation.
- Delete: Open the key’s actions menu, select Delete, and confirm. Applications using that key lose access. Deletion cannot be undone.