brex-app gives finance and engineering teams a secure, unified portal to create, rotate, scope, and audit Brex API credentials in real time — no tickets, no waiting, no exposure risk.
brex-app gives finance and engineering teams precise, auditable control over every credential, permission, and event in your API infrastructure.
Define granular read, write, and admin permissions per key using role-based access controls built for multi-team environments. Limit blast radius by ensuring each service credential can only touch exactly what it needs.
Schedule routine rotation on any cadence or trigger instant rotation in response to a security event — all with zero-downtime webhook delivery to your services. New credentials propagate atomically before old ones expire.
Every key creation, rotation, revocation, and API call is recorded in a tamper-proof, append-only timeline capturing the exact timestamp, actor, IP address, and outcome. Satisfy SOC 2, ISO 27001, and internal compliance requirements with a single export.
A developer-first API designed for production scale. Provision keys, subscribe to events, and query audit logs with a consistent REST interface your team will actually enjoy using.
Provision fine-grained API keys in seconds via the brex-app REST API. Each key carries an explicit scope array, an expiry timestamp, and a description — no dashboard required. Rotate, revoke, or extend keys from your CI/CD pipeline without manual intervention.
$ curl -X POST "https://api.brex-app.io/v1/keys" -H "Authorization: Bearer $BREX_MASTER_TOKEN" -H "Content-Type: application/json" -d '{ "description": "ci-deploy-pipeline", "scopes": ["ledger:read", "payments:write", "audit:read"], "expires_at": "2026-01-01T00:00:00Z" }'} # Response { "id": "key_9Xf2pLmQzR7kT", "secret": "bx_live_••••••••••••••••", "scopes": ["ledger:read", "payments:write", "audit:read"], "expires_at": "2026-01-01T00:00:00Z", "status": "active" }
brex-app dispatches HMAC-SHA256 signed webhooks on every key lifecycle event — creation, rotation, expiry, and revocation. Verify the signature in your handler and trigger automated credential updates across your infrastructure without polling.
// POST https://your-app.io/webhooks/brex // Headers: // X-Brex-Signature: sha256=3f2e1c... // X-Brex-Delivery: evt_01HZK9G... { "event": "key.rotated", "timestamp": "2025-11-14T08:42:17.391Z", "api_version": "2025-11", "data": { "key_id": "key_9Xf2pLmQzR7kT", "previous_secret_hint": "bx_live_••••1a2b", "new_secret_hint": "bx_live_••••9z8y", "rotated_by": "usr_deploy-bot", "reason": "scheduled_rotation", "scopes": ["ledger:read", "payments:write"] } }
Every API call, payment, and user action is captured in an immutable audit log. Filter by actor, resource type, date range, or event category and export results as JSON or CSV for compliance reviews, SIEM pipelines, or internal investigations.
$ curl -G "https://api.brex-app.io/v1/audit-logs" -H "Authorization: Bearer $BREX_API_KEY" --data-urlencode "from=2025-10-01T00:00:00Z" --data-urlencode "to=2025-10-31T23:59:59Z" --data-urlencode "event_types=payment.sent,key.rotated" --data-urlencode "limit=50" # Response (first entry) { "total": 1284, "has_more": true, "data": [{ "id": "log_01HZP3RTKW", "event": "payment.sent", "actor": "usr_finance-controller", "amount_usd": 250000.00, "ip": "203.0.113.42", "occurred_at": "2025-10-15T14:22:09.003Z" }] }
Full API Reference & SDKs
TypeScript, Python, Go, and Java SDKs with OpenAPI 3.1 spec included.
brex-app connects natively with the tools your engineering and finance teams already rely on — no rework required.
More integrations available via the brex-app REST & GraphQL APIs.
brex-app is built on a foundation of rigorous security controls and regulatory compliance, so your finance and engineering teams operate with confidence from day one.
Independently audited and certified against SOC 2 Type II standards, validating our controls for security, availability, and confidentiality across all systems.
All data is encrypted at rest and in transit using AES-256, the same standard trusted by top financial institutions and government agencies worldwide.
Granular role-based access control paired with single sign-on via Okta, Azure Active Directory, and Google Workspace — centralized identity, zero friction.
Restrict platform access to approved IP ranges using precise CIDR-based rules — an essential control layer for corporate networks and distributed engineering teams.
Questions about our security posture? Contact our security team
Download Security OverviewFrom Series B scale-ups to pre-IPO engineering orgs — finance and platform teams rely on brex-app to ship faster and close cleaner.
"brex-app cut our credential rotation time from 2 hours to 3 minutes. What used to require a war room of engineers now runs as a scheduled job. The API surface is clean, well-documented, and actually does what it promises."
"We evaluated six corporate finance platforms before choosing brex-app. Nothing else came close on programmatic spend controls. Our finance team closed Q3 two days early because reconciliation was already done."
"brex-app's developer-first approach is real, not marketing copy. We shipped a full internal expense approval workflow in a single sprint. The webhook reliability alone made the migration worth it."
Corporate Finance, Engineered for Scale. The developer-first financial platform built for modern enterprises.