> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/brev/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/brev/_mcp/server. # API Keys > Create and manage personal API keys for programmatic access to an NVIDIA Brev organization. Brev API keys authenticate CLI commands and automation without a browser login. Each personal API key belongs to one organization and acts on behalf of the user who created it. Brev API keys authenticate to Brev. To store credentials for a workload, such as an NGC API key, use [Secrets](/guides/secrets). ## Create an API Key #### Open API Keys In the [Brev Console](https://brev.nvidia.com), select the organization, open **Account Settings**, and select **API Keys**. #### Configure the Key Select **Create API Key**, then set: * **Name**: A descriptive name, such as `training-automation`. * **Access**: **Read** or **Read & Write**. Choose the minimum access the workflow needs. * **Expiration date**: Choose a future date. The default is 30 days; the key expires at the end of the selected day. * **Organization**: Confirm the displayed organization. To use a different organization, cancel and switch organizations first. Select **Create**. #### Copy the Key In **API Key Created**, select **Copy** beside the API key and save it securely before selecting **Done**. The dialog also provides a CLI login command. The full key is shown only once. If you lose it, create a replacement and delete the old key. Keep keys out of source code, shared logs, and notebooks. ## Access and Permissions The selected access level limits what the key can do. Your access to resources in the selected organization also applies; choosing **Read & Write** does not give you additional organization permissions. | Access level | Use | | ---------------- | ---------------------------------------------------------------------------------------------------------------- | | **Read** | View resources you can access in the organization. | | **Read & Write** | View and modify resources where your access permits the operation, including registering a Brev Connect machine. | A key cannot be used to switch to another organization. Create a separate key for each organization your workflow needs. Organization Owners, Admins, Maintainers, and Members can create their own keys. You can view, edit, and delete your own keys. Organization Owners and Admins can also view and delete other users' keys, but cannot edit them or recover their full values. ## Authenticate the CLI ### Save a Key for Later Commands Run the following with your key in place of the placeholder: ```bash brev login --api-key "" brev ls --json ``` The CLI saves the key locally and selects its organization automatically. The `--api-key` flag requires a value; it does not prompt for one. Current CLI versions do not require `--org-id`. ### Use a Key in Automation Have your CI system or secret manager supply the key through the `BREV_API_KEY` environment variable. You can also pass a key explicitly to a command with `--api-key`. For example, register an external Linux machine using a **Read & Write** key: ```bash # BREV_API_KEY is supplied by your automation environment. brev register --name my-node --api-key "$BREV_API_KEY" --approve ``` Registration resolves the organization from the key. Passing a key directly to `brev register` or setting `BREV_API_KEY` does not save it for later sessions; use `brev login --api-key` to save it. See [Brev Connect commands](/cli/brev-connect) for registration prerequisites and SSH setup. ### Return to User Login ```bash unset BREV_API_KEY brev logout brev login ``` `brev logout` removes locally saved credentials; it does not revoke the key in Brev or clear an environment variable in your shell. Use a user login for SSH workflows: API-key login does not set up your user SSH credentials. ## Edit, Rotate, or Delete a Key The **API Keys** list shows each key's name, prefix, access level, expiration, and last use. * **Edit**: Open your key's actions menu, select **Edit**, change its **Name** or **Access**, and select **Save**. Editing does not replace the key value or extend its expiration. Expired keys cannot be edited in the Console. * **Rotate**: Create a new key, update the credential used by your scripts or CI jobs, verify access, then delete the old key. Create a replacement before expiration to avoid interrupting automation. * **Delete**: Open the key's actions menu, select **Delete**, and confirm. Applications using that key lose access. Deletion cannot be undone. ## Troubleshooting | Problem | Resolution | | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | Authentication fails | Check that the key is a Brev API key and has not expired or been deleted. An NGC API key or saved workload secret is not a Brev authentication credential. | | A write command is denied | Check that the key has **Read & Write** access and that its creator can perform the operation in the selected organization. | | A key or resource is missing | Check the active organization and your access. Keys are scoped to one organization, and key visibility depends on ownership and organization role. | | The CLI keeps using an old key | Check for an explicit `--api-key` or `BREV_API_KEY` overriding your saved credentials. Update or unset it. | | The full key cannot be copied again | Create a replacement; Brev only shows the full value when the key is created. | ## What's Next #### [Brev Connect](/cli/brev-connect) Register external hardware and configure SSH access. #### [Secrets](/guides/secrets) Store reusable workload credentials for Launchables.