Skip to main content
The CLI authenticates with the same API keys as the Public API. Create one in the dashboard under Settings → API.

​
Sign In

Paste your key when prompted. The CLI validates it against the API before storing anything, then saves it to ~/.config/brew-cli/config.json with owner-only file permissions. brew-cli logout removes it, and brew-cli whoami shows the resolved credential (always masked) at any time. Non-interactive environments skip login entirely and set an environment variable instead:

​
Precedence

When several sources are present, the CLI resolves the key in this order:
  1. --api-key flag
  2. BREW_API_KEY environment variable
  3. The stored login
The same pattern applies to the brand: --brand, then BREW_BRAND_ID, then brew-cli config set brandId ....

​
Brand vs Organization Keys

A key is scoped either to one brand or to your whole organization:
  • Brand-scoped key: the brand is implicit for brand-scoped commands. Permission scopes and access rules still apply.
  • Organization-scoped key: brand-level commands need to know which brand you mean. Pass --brand <brandId>, export BREW_BRAND_ID, or store a default with brew-cli config set brandId <brandId>. Find ids with brew-cli brands list. Omitting the brand returns a BRAND_ID_REQUIRED error rather than guessing.
Organization-level commands (brands, templates, flows, usage) ignore the brand entirely; Organization operations owns the full list. api-keys commands remain for compatibility, but the API rejects CLI credentials with 403. Manage keys in Settings → API; see Key Lifecycle.

​
API URL

The default is https://brew.new/api. Override it with --api-url, then BREW_API_URL, then the stored apiUrl, in that order. For a local API:
The stored login normally lives in ~/.config/brew-cli/config.json. XDG_CONFIG_HOME changes the base directory; BREW_CLI_CONFIG_DIR selects it directly.

​
Key Hygiene

Keys start with brew_ and are shown masked in every CLI output, including errors. Prefer login or environment variables in shared shells; --api-key can land in shell history. Use a brand key when appropriate, and rotate any exposed key in API settings.

​
Need Help?

Our team is ready to support you at every step of your journey with Brew. Choose the option that works best for you:

Search Documentation

Type in the “Ask any question” search bar at the top left to instantly find relevant documentation pages.

Ask ChatGPT or Claude

Click here to open the Copy page menu at the top of this page, then send the page to ChatGPT, Claude, or your editor.