How to set up the Brex MCP server

Brex manages corporate cards, expenses, and spend data. Use OAuth for a user-delegated connection, or a dedicated API credential created by an account administrator for approved automation.

This guide prepares Brex for an MCP client. The Brex agent template is separate from Brex-side authorization.

Choose a connection method

Choose OAuth when the connection should represent a Brex user. Choose the approved Brex API credential path only for a named non-interactive integration. Brex's authentication guide is the source of truth for the credential types available to your account.

Recommended: OAuth with a dedicated finance identity

Use Brex OAuth when the server supports a user-delegated connection. Have a Brex administrator create a dedicated test identity or approved integration identity with only the card, expense, or transaction visibility the workflow needs.

1. Have a Brex account or card admin accept the Developer API agreement in Settings → Developer.
2. In Settings → Beta features, enable Brex in AI assistants. Without both prerequisites, dynamic client registration can fail with a 403 response.
3. Connect the MCP client to https://api.brex.com/mcp. Brex registers OAuth clients dynamically, so a compatible client does not need a separately created OAuth app or client secret.
4. Authorize as the dedicated identity and inspect one known test transaction or expense.
5. Confirm that card controls, payments, reimbursements, and other write actions are not granted unless separately reviewed.

Alternative: API credential

If the Brex implementation uses a vendor-issued service credential, issue it to a named integration owner, restrict it to the required entity and scopes, and store it in a secret manager. Treat finance-data credentials as production secrets even in test accounts.

• Open the vendor's credential documentation as the dedicated least-privileged identity.
• Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
• Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
• Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.

Verify Brex MCP

Use this checklist to confirm the MCP server is connected with the intended access.

• Connect the MCP client using the newly created authorization.
• Confirm that Brex MCP tools are discovered.
• Read one known test resource that the authorized identity is allowed to access.
• Attempt to read a resource outside the approved Brex boundary; it should be unavailable or denied.
• Confirm that no write capability beyond the reviewed setup is available.

Troubleshooting

If dynamic registration returns 403, re-check the Developer API agreement and Brex in AI assistants beta enrollment with an account or card admin. If authorization succeeds but tools are missing, check the selected Brex entity and the user's capability. Do not make a finance administrator credential the default workaround for a missing permission.

Next steps

Deploy the Brex agent template to create a governed agent in Dome that can work with the approved finance data boundary, with the template's included model, tools, and rules.