> ## Documentation Index
> Fetch the complete documentation index at: https://docs.brew.new/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Brew with Vercel Connect

> Connect Brew to apps and agents deployed on Vercel through Vercel Connect, using the MCP server over OAuth or the REST API with an API key.

## Overview

[Vercel Connect](https://vercel.com/docs/connect) holds the credentials for third-party services at the Vercel team level. Your deployed code asks it for a short-lived token whenever it needs one. With Brew connected, no Brew API key or OAuth token ever lives in your project's environment variables.

There are two ways to connect Brew:

| Connection | Reaches | Who the token acts as | Use it when |
| :- | :- | :- | :- |
| **OAuth** | The Brew MCP server, `https://brew.new/api/mcp` | The person who signed in to Brew, scoped to one brand or the whole organization | An AI agent should use Brew's tools on behalf of a user |
| **API key** | The REST API, `https://brew.new/api/v1`, and the MCP server | The key's brand or organization | Your backend calls the API directly, for example to fire an automation trigger |

> [!NOTE]
>
> OAuth tokens work only with the MCP server. To call the REST API, use an API-key connection.

## Prerequisites

> [card] Brew Account
>
> Sign up at [brew.new](https://brew.new) and set up your brand.

> [card] Vercel Project
>
> Link your directory with `vercel link`, then run `vercel env pull` to get a development OIDC token for Vercel Connect.

## MCP Server with OAuth

Vercel Connect registers its own OAuth client with Brew, so you don't create an app or copy a client secret.

**1. Create the connector**

Brew isn't in Vercel's connector catalog yet, so create the connector from Brew's MCP server URL:

```bash theme={null}
vercel connect create https://brew.new/api/mcp --name brew
```

Vercel reads Brew's OAuth discovery documents and registers the client automatically. Copy the connector UID it returns, and use that exact value in place of `YOUR_OAUTH_CONNECTOR_UID` below. The connector name or type won't work.

**2. Attach it to your project**

```bash theme={null}
vercel connect attach 'YOUR_OAUTH_CONNECTOR_UID'
```

This allows Production, Preview, and Development to request tokens. Pass `-e` to limit it to particular environments.

**3. Install the packages**

```bash theme={null}
pnpm add @vercel/connect ai @ai-sdk/mcp
```

**4. Connect an AI SDK route to Brew**

`connectAuthProvider` asks Vercel Connect for a current Brew token on every MCP request:

```ts app/api/chat/route.ts theme={null}
import { createMCPClient } from '@ai-sdk/mcp';
import {
  connectAuthProvider,
  ConsentRequiredError,
} from '@vercel/connect/ai-sdk';
import { stepCountIs, streamText } from 'ai';

export const maxDuration = 60;

export async function POST(request: Request) {
  const { prompt } = await request.json();
  // Take this from your authenticated session, never from the request body.
  const userId = 'user_123';
  let brew: Awaited<ReturnType<typeof createMCPClient>> | undefined;

  try {
    brew = await createMCPClient({
      transport: {
        type: 'http',
        url: 'https://brew.new/api/mcp',
        authProvider: connectAuthProvider(
          'YOUR_OAUTH_CONNECTOR_UID',
          { subject: { type: 'user', id: userId } },
          { redirectUrl: new URL('/', request.url).toString() },
        ),
      },
    });

    const result = streamText({
      model: 'anthropic/claude-sonnet-5.5',
      tools: await brew.tools(),
      prompt,
      stopWhen: stepCountIs(8),
      onFinish: async () => {
        await brew?.close();
      },
    });

    return result.toTextStreamResponse();
  } catch (error) {
    await brew?.close();
    if (error instanceof ConsentRequiredError) {
      return Response.redirect(error.url, 303);
    }
    throw error;
  }
}
```

**5. Approve access in Brew**

The first request for a user throws `ConsentRequiredError`, and the route redirects them to Brew. They sign in and choose what to connect: **one brand**, or **All brands** if they're an organization admin. The page shows **Returns to connect.vercel.com**; after **Allow access**, a new chat turn loads the tools.

The connection acts with that person's current Brew access, rechecked on every request. A brand connection works on that brand; an organization connection needs a `brand_id` from `list_brands`. See [MCP Authentication & Scoping](https://docs.brew.new/api-reference/mcp/authentication-and-scoping.md).

> [!WARNING]
>
> On OAuth connections, production sends and the writes listed in [Confirmation](https://docs.brew.new/api-reference/mcp/authentication-and-scoping.md#confirmation) require approval. Test sends to the connected person are exempt.
>
> When a tool returns `confirmation_required`, collect the person's approval in your chat UI. Then repeat the same call with `confirmed: true` and the returned `confirmation_id`.

## REST API with an API Key

**1. Create a Brew API key**

Create a key at [brew.new/settings/api](https://brew.new/settings/api). Anyone with access to a brand can create a key for it while that brand is active. An organization key, which reaches every brand, needs an organization admin.

**2. Create the connector**

Brew isn't in Vercel's connector catalog yet. In the Vercel dashboard, open **Connect**, create a generic **API key** connector named `brew-api`, and paste the key.

Copy the connector UID Vercel shows, and use it in place of `YOUR_API_KEY_CONNECTOR_UID` in the command and code below. Then attach the connector to your project:

```bash theme={null}
vercel connect attach 'YOUR_API_KEY_CONNECTOR_UID'
```

**3. Call the API**

`getToken` returns the stored key. Send it as a bearer token:

```ts app/lib/brew.ts theme={null}
import { getToken } from '@vercel/connect';

export async function fireBrewTrigger(
  triggerEventId: string,
  payload: Record<string, unknown>,
  idempotencyKey: string,
) {
  const key = await getToken('YOUR_API_KEY_CONNECTOR_UID', { subject: { type: 'app' } });

  const response = await fetch(
    `https://brew.new/api/v1/automations/triggers/${triggerEventId}/fire`,
    {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${key}`,
        'Content-Type': 'application/json',
        'Idempotency-Key': idempotencyKey,
      },
      body: JSON.stringify({ payload }),
    },
  );
  if (!response.ok) {
    throw new Error(`Brew returned ${response.status}`);
  }
  return response.json();
}
```

With an organization key, also send `X-Brand-Id` on brand-scoped calls. See [Authentication](https://docs.brew.new/api-reference/api/authentication.md).

## Disconnect

* **OAuth:** each user's connection appears in Brew under **Settings → MCP**, in the "Connected via OAuth" list, where they can disconnect it. Revoking from Vercel (`revokeToken`, the dashboard, or the CLI) also ends the grant in Brew. Deleting the connector revokes every grant it holds.
* **API key:** delete the key at [brew.new/settings/api](https://brew.new/settings/api). Removing the connector in Vercel only deletes Vercel's copy.

## Troubleshooting

> [accordion] Brew shows "Couldn’t start the connection"
>
> An unsupported scope or resource can cause this. Brew advertises only `brew:all` and accepts `https://brew.new/api/mcp` as its resource audience, so keep those values.
>
> If they already match, read the reported error details before retrying. See [OAuth Discovery and Security](https://docs.brew.new/api-reference/mcp/authentication-and-scoping.md#oauth-discovery-and-security).

> [accordion] The REST API answers 401 INVALID\_API\_KEY
>
> A malformed or unknown key can cause this. Check that the API-key connector holds a valid Brew API key and that you send it as a bearer token.
>
> A Brew OAuth token sent to REST also fails, because OAuth tokens work only with the MCP server. Use an API-key connection for REST. See [Authentication](https://docs.brew.new/api-reference/api/authentication.md).

> [accordion] Tools fail with BRAND\_ID\_REQUIRED
>
> The connection covers the whole organization. Have the agent call `list_brands` and pass `brand_id`, or reconnect and pick one brand.

> [accordion] ClientNotLinkedToProjectError
>
> The calling project or environment isn't attached to the connector. Run `vercel connect attach <uid>` for that environment. If your local OIDC token is older than about 12 hours, run `vercel env pull` again.

## Need Help?

Our team is ready to support you at every step of your journey with Brew. Choose the option that works best for you:

> [tab] Self-Service Tools
>
> > [card] Search Documentation
> >
> > Type in the "Ask any question" search bar at the top left to instantly find relevant documentation pages.
>
> > [card] [Ask ChatGPT or Claude](#top)
> >
> > Click here to open the **Copy page** menu at the top of this page, then send the page to ChatGPT, Claude, or your editor.

> [tab] Talk to Our Team
>
> > [card] [Schedule a Call](https://cal.com/team/brewdotnew/brew-demo)
> >
> > Book time with our founders for personalized guidance on strategy, best practices, or complex implementation questions.
>
> > [card] Call Us Directly
> >
> > Need immediate assistance? Reach us at **+1-(332)-203-2145** for urgent issues or time-sensitive questions.
>
> > [card] Slack Channel
> >
> > Our preferred support channel. You'll receive an invite after signup for direct founder support and fast responses.
>
> > [card] [Email Support](mailto:support@brew.new)
> >
> > Contact us at **[support@brew.new](mailto:support@brew.new)** for detailed inquiries or if you prefer not to use Slack.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.