Sign In
~/.config/brew-cli/config.json with owner-only file permissions. brew-cli logout removes it, and brew-cli whoami shows the resolved credential (always masked) at any time.
Non-interactive environments skip login entirely and set an environment variable instead:
Precedence
When several sources are present, the CLI resolves the key in this order:--api-keyflagBREW_API_KEYenvironment variable- The stored login
--brand, then BREW_BRAND_ID, then brew-cli config set brandId ....
Brand vs Organization Keys
A key is scoped either to one brand or to your whole organization:- Brand-scoped key: the brand is implicit. Every command just works.
- Organization-scoped key: brand-level commands need to know which brand you mean. Pass
--brand <brandId>, exportBREW_BRAND_ID, or store a default withbrew-cli config set brandId <brandId>. Find ids withbrew-cli brands list. Omitting the brand returns aBRAND_ID_REQUIREDerror rather than guessing.
brands, templates, usage) ignore the brand entirely.
Key Hygiene
Keys start withbrew_ and are shown masked in every CLI output, including errors. Treat them like passwords: prefer login or environment variables over --api-key in shared shells (flags can land in shell history), scope keys to a single brand when you can, and rotate any key that leaks from the dashboard page where you created it.
Need Help?
Our team is ready to support you at every step of your journey with Brew. Choose the option that works best for you:- Self-Service Tools
- Talk to Our Team
Search Documentation
Type in the “Ask any question” search bar at the top left to instantly find relevant documentation pages.
ChatGPT/Claude Integration
Click “Open in ChatGPT” at the top right of any page to explore it further with ChatGPT or Claude.