Brex

Overview

Connect your users to Brex for corporate card management, expense tracking, and financial data access.

Property	Value
Provider ID	brex
Category	Finance
PKCE	Supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Get Brex OAuth credentials

Brex OAuth (3LO) is partner-gated — there is no self-serve developer console for creating OAuth apps. Credentials must be issued by Brex’s developer support team after the partner application is approved.

Apply to be a Brex developer partner

Submit an application at brex.com/partners.

Request OAuth credentials

Once approved, contact the Brex developer support team to request OAuth client credentials. Provide the Alter callback URL from the Developer Portal — Brex configures the redirect URI on its side, there is no self-serve UI for it.

Receive credentials

Brex issues a Client ID, Client Secret, and the list of approved scopes.

Note

For internal automations against a single Brex account (not user-facing OAuth), use a User Token generated under Developer → Settings at dashboard.brex.com instead — that flow uses a static bearer token, not OAuth, and does not work with this provider.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Brex provider

Go to OAuth Providers > Add Provider > Brex.

Enter credentials

• Client ID: Paste your Brex Client ID
• Client Secret: Paste your Brex Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
openid	OpenID Connect authentication
offline_access	Request a refresh token for long-lived access
transactions.card.readonly	Read-only access to card transactions
accounts.card.readonly	Read-only access to card accounts
users.readonly	Read-only access to user information
expenses.card	Access to card expense data
budgets.readonly	Read-only access to budgets
vendors.readonly	Read-only access to vendor information

Tip

Include both openid and offline_access scopes to enable automatic token refresh.

Notes

• The openid and offline_access scopes are included by default.
• Brex scopes configured in your OAuth application must match the scopes you request during authorization.
• See the Brex authentication documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
createUser	admin, send	POST	/v2/users
emailCardNumber	send	POST	/v2/cards/{id}/secure_email
setUserLimit	admin, write	POST	/v2/users/{id}/limit
updateUser	admin, write	PUT	/v2/users/{id}
createCard	write	POST	/v2/cards
createDepartment	write	POST	/v2/departments
createLocation	write	POST	/v2/locations
createTitle	write	POST	/v2/titles
lockCard	write	POST	/v2/cards/{id}/lock
terminateCard	write	POST	/v2/cards/{id}/terminate
unlockCard	write	POST	/v2/cards/{id}/unlock
updateCard	write	PUT	/v2/cards/{id}
getCardById	read	GET	/v2/cards/{id}
getCardNumber	read	GET	/v2/cards/{id}/pan
getCompany	read	GET	/v2/company
getDepartmentById	read	GET	/v2/departments/{id}
getLegalEntity	read	GET	/v2/legal_entities/{id}
getLocationById	read	GET	/v2/locations/{id}
getMe	read	GET	/v2/users/me
getTitleById	read	GET	/v2/titles/{id}
getUserById	read	GET	/v2/users/{id}
getUserLimit	read	GET	/v2/users/{id}/limit
listCardsByUserId	read	GET	/v2/cards
listDepartments	read	GET	/v2/departments
listLegalEntities	read	GET	/v2/legal_entities
listLocations	read	GET	/v2/locations
listTitles	read	GET	/v2/titles
listUsers	read	GET	/v2/users