Authentication

How to create a Brew API key, bind it to a brand, store it securely, and validate it works. Covers environment variable setup and SDK client creation.

Overview

The Brew SDK uses the same API keys as the raw REST API.

Every request is authenticated with your Brew API key. The SDK sends it as Authorization: Bearer brew_your_api_key for you. The server also accepts the alternate X-API-Key: brew_your_api_key header for raw HTTP callers, but the SDK standardizes on Bearer to keep one canonical wire format.

An API key is scoped to one brand or to your whole organization. A brand key resolves its brand automatically, so the client needs nothing else. An organization key must name a brand for brand-scoped calls, as Organization Keys shows. Never put brandId in a request body or query: the API rejects it with 400 INVALID_REQUEST. See API authentication for the full brand-scoping and permission contract. This page covers the SDK-specific key setup and client construction.

Get Your API Key

1. Open the API settings page

   Go to brew.new/settings/api.

2. Pick the brand or the organization

   For a brand key, make the brand you want active in the dashboard first. For an organization key, choose the whole organization instead. The scope is fixed at creation, so you can’t retarget a key later.

3. Create a key

   Create a new API key and copy it somewhere safe.

4. Store it in your environment

   Keep it server-side. Do not commit it or expose it in frontend code.

Recommended Setup

Use an environment variable in your own app code:

export BREW_API_KEY="brew_your_api_key"

Then create the SDK client with that value:

import { createBrewClient } from '@brew.new/sdk'

const brew = createBrewClient({
  apiKey: process.env.BREW_API_KEY!,
})

Validate the Key

Use a simple read call to make sure the key works:

const { data: domains } = await brew.domains.list()
console.log(domains)

A bad key returns 401 INVALID_API_KEY. See TypeScript Error Handling for the full error catch pattern.

Organization Keys

An organization key needs a brand for every brand-scoped call. Set brandId in the client config, or pin one with brew.withBrand(brandId). The SDK sends it as the X-Brand-Id header.

const brew = createBrewClient({ apiKey: process.env.BREW_API_KEY! })

const { data: brands } = await brew.brands.list()
const acme = brew.withBrand(brands[0].brandId)
await acme.emails.list()

withBrand() returns a new pinned client and leaves the original untouched, so one key can work across several brands. The organization-level resources (brew.brands, brew.templates, brew.flows, and brew.usage) never send the pin. A brand-scoped call with no brand pinned fails with 400 BRAND_ID_REQUIRED: there is no default brand.

Security Notes

• Keep API keys on the server only.
• Use different keys for development and production.
• Rotate keys if you think one was exposed.
• Log the x-request-id from failed calls when debugging.

Next Steps

TypeScript Installation

Install and configure @brew.new/sdk.

API Introduction

See the raw public API contract.

Need Help?

Our team is ready to support you at every step of your journey with Brew. Choose the option that works best for you:

Self-Service Tools

Search Documentation

Type in the “Ask any question” search bar at the top left to instantly find relevant documentation pages.

ChatGPT/Claude Integration

Click “Open in ChatGPT” at the top right of any page to explore it further with ChatGPT or Claude.

Talk to Our Team

Schedule a Call

Book time with our founders for personalized guidance on strategy, best practices, or complex implementation questions.

Call Us Directly

Need immediate assistance? Reach us at [phone] for urgent issues or time-sensitive questions.

Slack Channel

Our preferred support channel. You’ll receive an invite after signup for direct founder support and fast responses.

Email Support

Contact us at [e-mail] for detailed inquiries or if you prefer not to use Slack.