> ## Documentation Index
> Fetch the complete documentation index at: https://docs.brew.new/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization Keys: One Key for Every Brand

> One API key or MCP connection can now reach every brand in your organization. Name the brand on each call, or keep a key locked to one brand.

<Note>
  **September 2026** · Available on all plans.
</Note>

<Note>
  **Historical note · September 2026** · Describes Brew as of September 2026. For
  current behavior, see [Brand vs Organization Keys](/api-reference/api/authentication#brand-vs-organization-keys).
</Note>

## What Shipped

Running several brands from code used to mean one API key per brand, and one
agent connection per brand. Switching brands meant switching credentials.

Now one key, or one agent connection, can reach every brand in your
organization. You name the brand on each call. Keys locked to a single brand
work exactly as before.

## Two Kinds of Key

When you create a key in **Settings → API**, scope it to one brand or to the
whole organization.

* **Brand key.** Reaches one brand, with nothing to name on a request. Use it
  when an integration only ever touches that brand, so a leak stays inside it.
* **Organization key.** Reaches every brand. Each request names its brand in
  the `X-Brand-Id` header. There is no default brand, so a call that forgets
  fails instead of landing in the wrong place. With the `brands` permission,
  it can also create brands.

```bash theme={null}
curl -H "Authorization: Bearer brew_your_org_key" \
  -H "X-Brand-Id: <brandId>" \
  https://brew.new/api/v1/domains
```

`GET /v1/brands` lists the brand ids an organization key can use.

## Your Agent, Across Every Brand

MCP connections scope the same way. Connect Claude, Cursor, or any MCP client
to one brand, or to all of them.

<Steps>
  <Step title="Connect once">
    Add `https://brew.new/api/mcp` to your client, sign in with Brew, and pick
    all brands instead of one. An organization key works too.
  </Step>

  <Step title="Ask across brands">
    "Compare last month's open rates for Acme and North Studio." The agent
    calls `list_brands`, then passes a `brand_id` on each call.
  </Step>

  <Step title="Approve before anything sends">
    A real send or audience launch pauses for your approval first, so nothing
    goes out from the wrong brand.
  </Step>
</Steps>

## In the SDK and CLI

The TypeScript SDK pins a brand with `brew.withBrand(brandId)`, and
`brew.brands` lists and creates brands. The CLI takes `--brand <brandId>` or
`BREW_BRAND_ID`.

## Get Started

Read [Brand vs Organization Keys](/api-reference/api/authentication#brand-vs-organization-keys)
for the full rules, or [MCP Authentication & Scoping](/api-reference/mcp/authentication-and-scoping#brand-scoping)
to connect an agent across brands.