Use Brew with Vercel Connect

Connect Brew to apps and agents deployed on Vercel through Vercel Connect, using the MCP server over OAuth or the REST API with an API key.

Overview

Vercel Connect holds the credentials for third-party services at the Vercel team level. Your deployed code asks it for a short-lived token whenever it needs one. With Brew connected, no Brew API key or OAuth token ever lives in your project’s environment variables.

There are two ways to connect Brew:

Connection	Reaches	Who the token acts as	Use it when
OAuth	The Brew MCP server, https://brew.new/api/mcp	The person who signed in to Brew, scoped to one brand or the whole organization	An AI agent should use Brew’s tools on behalf of a user
API key	The REST API, https://brew.new/api/v1, and the MCP server	The key’s brand or organization	Your backend calls the API directly, for example to fire an automation trigger

OAuth tokens work only with the MCP server. To call the REST API, use an API-key connection.

Prerequisites

Brew Account

Sign up at brew.new and set up your brand.

Vercel Project

Link your directory with vercel link, then run vercel env pull to get a development OIDC token for Vercel Connect.

MCP Server with OAuth

Vercel Connect registers its own OAuth client with Brew, so you don’t create an app or copy a client secret.

1. Create the connector

   Brew isn’t in Vercel’s connector catalog yet, so create the connector from Brew’s MCP server URL:

   vercel connect create https://brew.new/api/mcp --name brew
   

   Vercel reads Brew’s OAuth discovery documents and registers the client automatically. Copy the connector UID it returns, and use that exact value in place of YOUR_OAUTH_CONNECTOR_UID below. The connector name or type won’t work.

2. Attach it to your project

   vercel connect attach 'YOUR_OAUTH_CONNECTOR_UID'
   

   This allows Production, Preview, and Development to request tokens. Pass -e to limit it to particular environments.

3. Install the packages

   pnpm add @vercel/connect ai @ai-sdk/mcp
   
4. Connect an AI SDK route to Brew

   connectAuthProvider asks Vercel Connect for a current Brew token on every MCP request:

   app/api/chat/route.ts

   import { createMCPClient } from '@ai-sdk/mcp';
   import {
     connectAuthProvider,
     ConsentRequiredError,
   } from '@vercel/connect/ai-sdk';
   import { stepCountIs, streamText } from 'ai';
   
   export const maxDuration = 60;
   
   export async function POST(request: Request) {
     const { prompt } = await request.json();
     // Take this from your authenticated session, never from the request body.
     const userId = 'user_123';
     let brew: Awaited<ReturnType<typeof createMCPClient>> | undefined;
   
     try {
       brew = await createMCPClient({
         transport: {
           type: 'http',
           url: 'https://brew.new/api/mcp',
           authProvider: connectAuthProvider(
             'YOUR_OAUTH_CONNECTOR_UID',
             { subject: { type: 'user', id: userId } },
             { redirectUrl: new URL('/', request.url).toString() },
           ),
         },
       });
   
       const result = streamText({
         model: 'anthropic/claude-sonnet-5.5',
         tools: await brew.tools(),
         prompt,
         stopWhen: stepCountIs(8),
         onFinish: async () => {
           await brew?.close();
         },
       });
   
       return result.toTextStreamResponse();
     } catch (error) {
       await brew?.close();
       if (error instanceof ConsentRequiredError) {
         return Response.redirect(error.url, 303);
       }
       throw error;
     }
   }
   
5. Approve access in Brew

   The first request for a user throws ConsentRequiredError, and the route redirects them to Brew. They sign in and choose what to connect: one brand, or All brands if they’re an organization admin. The page shows Returns to connect.vercel.com; after Allow access, a new chat turn loads the tools.

The connection acts with that person’s current Brew access, rechecked on every request. A brand connection works on that brand; an organization connection needs a brand_id from list_brands. See MCP Authentication & Scoping.

On OAuth connections, production sends and the writes listed in Confirmation require approval. Test sends to the connected person are exempt.

When a tool returns confirmation_required, collect the person’s approval in your chat UI. Then repeat the same call with confirmed: true and the returned confirmation_id.

REST API with an API Key

1. Create a Brew API key

   Create a key at brew.new/settings/api. Anyone with access to a brand can create a key for it while that brand is active. An organization key, which reaches every brand, needs an organization admin.

2. Create the connector

   Brew isn’t in Vercel’s connector catalog yet. In the Vercel dashboard, open Connect, create a generic API key connector named brew-api, and paste the key.

   Copy the connector UID Vercel shows, and use it in place of YOUR_API_KEY_CONNECTOR_UID in the command and code below. Then attach the connector to your project:

   vercel connect attach 'YOUR_API_KEY_CONNECTOR_UID'
   
3. Call the API

   getToken returns the stored key. Send it as a bearer token:

   app/lib/brew.ts

   import { getToken } from '@vercel/connect';
   
   export async function fireBrewTrigger(
     triggerEventId: string,
     payload: Record<string, unknown>,
     idempotencyKey: string,
   ) {
     const key = await getToken('YOUR_API_KEY_CONNECTOR_UID', { subject: { type: 'app' } });
   
     const response = await fetch(
       `https://brew.new/api/v1/automations/triggers/${triggerEventId}/fire`,
       {
         method: 'POST',
         headers: {
           Authorization: `Bearer ${key}`,
           'Content-Type': 'application/json',
           'Idempotency-Key': idempotencyKey,
         },
         body: JSON.stringify({ payload }),
       },
     );
     if (!response.ok) {
       throw new Error(`Brew returned ${response.status}`);
     }
     return response.json();
   }
   

   With an organization key, also send X-Brand-Id on brand-scoped calls. See Authentication.

Disconnect

• OAuth: each user’s connection appears in Brew under Settings → MCP, in the “Connected via OAuth” list, where they can disconnect it. Revoking from Vercel (revokeToken, the dashboard, or the CLI) also ends the grant in Brew. Deleting the connector revokes every grant it holds.
• API key: delete the key at brew.new/settings/api. Removing the connector in Vercel only deletes Vercel’s copy.

Troubleshooting

Brew shows "Couldn’t start the connection"

An unsupported scope or resource can cause this. Brew advertises only brew:all and accepts https://brew.new/api/mcp as its resource audience, so keep those values.

If they already match, read the reported error details before retrying. See OAuth Discovery and Security.

The REST API answers 401 INVALID_API_KEY

A malformed or unknown key can cause this. Check that the API-key connector holds a valid Brew API key and that you send it as a bearer token.

A Brew OAuth token sent to REST also fails, because OAuth tokens work only with the MCP server. Use an API-key connection for REST. See Authentication.

Tools fail with BRAND_ID_REQUIRED

The connection covers the whole organization. Have the agent call list_brands and pass brand_id, or reconnect and pick one brand.

ClientNotLinkedToProjectError

The calling project or environment isn’t attached to the connector. Run vercel connect attach <uid> for that environment. If your local OIDC token is older than about 12 hours, run vercel env pull again.

Need Help?

Our team is ready to support you at every step of your journey with Brew. Choose the option that works best for you:

Self-Service Tools

Search Documentation

Type in the “Ask any question” search bar at the top left to instantly find relevant documentation pages.

Ask ChatGPT or Claude

Click here to open the Copy page menu at the top of this page, then send the page to ChatGPT, Claude, or your editor.

Talk to Our Team

Schedule a Call

Book time with our founders for personalized guidance on strategy, best practices, or complex implementation questions.

Call Us Directly

Need immediate assistance? Reach us at [phone] for urgent issues or time-sensitive questions.

Slack Channel

Our preferred support channel. You’ll receive an invite after signup for direct founder support and fast responses.

Email Support

Contact us at [e-mail] for detailed inquiries or if you prefer not to use Slack.