Jev API keys
Jev API keys are TypeSafe bearer tokens. Official HTTP auth is Authorization: Bearer <API_KEY>. Official Python and JavaScript SDKs read TYPESAFE_API_KEY from the environment. A missing or invalid key returns 401 Unauthorized. The key authenticates your service to POST /v1/systemone; it is not an end-user login.
This page is for builders who already have (or are about to have) TypeSafe console access and need to store the secret correctly. jev.pro is an independent unofficial field guide — not affiliated with TypeSafe AI. We do not sell, issue, or proxy API keys. Never paste a key into this website. Confirm header names on docs.typesafe.ai. If you are still choosing which docs surface to trust, start with accessing the unofficial Jev documentation guide.
Steps
- Get console access first — how to get access. TypeSafe’s quick start says the key comes from the dashboard after you have access. Start at console.typesafe.ai. We will not deep-link a settings path that might move.
- Create the key in the official console. Copy it once into your vault. Export
TYPESAFE_API_KEYin the runtime that will call Jev. Raw HTTP must still sendAuthorization: Bearer. - Smoke a tiny request. If you see 401, stop. Fix the secret. Do not retry 401 in a loop — see errors and retries.
- If you use Vercel AI Gateway instead of first-party HTTP, use an AI Gateway credential or OIDC, not a TypeSafe key, unless you deliberately point the official SDK at the Gateway base URL with that Gateway secret. The Gateway model id is
typesafe-ai/jev— not a TypeSafe first-party alias. See channels compared. - Scope secrets per environment. Staging and production should not share a key. Rotate immediately if the value appeared in a log, ticket, or chat.
- Keep examples in git as
$TYPESAFE_API_KEY. Treat the value as a password. This is ordinary secret hygiene, not a TypeSafe-specific protocol.
Pitfalls
- Asking jev.pro for a demo key or a proxy. We will not embed a live key and we will not forward yours.
- Putting the key inside
stateorinstructions. That does not authenticate the call and it will log a secret. - Mixing first-party keys with a Gateway base URL, then treating the 4xx as a “Jev is down” event.
- Sharing one key across a team chat. Reviewers do not need production credentials — they need traces. See authentication concepts.
- Assuming list price or RPM is attached to the key. TypeSafe’s models page currently claims $0.042/M input (output free), 250k tok/s, and 1200 RPM. Those are vendor claims and can change; they are not minted into your token.
First-party keys versus gateway credentials
A TypeSafe key opens https://api.typesafe.ai. A Gateway key opens Vercel’s door. OpenRouter and Cloudflare, when you use them, have their own secrets and their own model id strings. Record door + secret type + model id together so on-call does not rotate the wrong vault path.
GET /v1/models with a bad first-party key looks like an empty catalog. That is still 401-class auth, not a missing product. After a rotate, update every runtime that cached the old value — serverless replicas are a common miss.
See also
- Access hub
- How to get access
- Unofficial documentation access
- Authentication concepts
- 401 vs 422 vs 429
FAQ
Can I share one key across staging and production?
You can; you should not. Rotate and scope secrets per environment in your vault.
Does 401 retry help?
No. Fix the key. Do not loop.
Will this site proxy a key for a demo?
Never.
What this page does not claim
This page does not issue keys, publish a settings deep-link that TypeSafe might move, or treat Gateway OIDC as a TypeSafe first-party product. It does not freeze vendor prices or RPM.
Disclaimer
This is an independent unofficial site and is not affiliated with TypeSafe AI; official documentation is available at https://docs.typesafe.ai.