Access · Last updated 2026-09-21

Authentication concepts for Jev integrations

Authentication for TypeSafe Jev is a secret you already hold: a console bearer token, or a documented gateway credential (for example a Vercel AI Gateway key or OIDC token). The first-party evaluation call is POST https://api.typesafe.ai/v1/systemone with Authorization: Bearer …. Jev authenticates your service. Your app authenticates humans.

This page is for builders who already heard of Jev / System One and need the mental model before they wire headers. jev.pro is an independent unofficial field guide — not affiliated with TypeSafe AI. We do not sell, issue, or proxy API keys. Confirm header names on docs.typesafe.ai. Keys come from the TypeSafe dashboard after access, at console.typesafe.ai.

Steps

1. Pick one production door and record how auth is injected. Doors differ: see channels compared.
2. First-party: export TYPESAFE_API_KEY. Official SDKs read it. Raw HTTP must send Authorization: Bearer. Details: API keys.
3. Gateway: use the Gateway secret and the Gateway base URL / model id Vercel documents (typesafe-ai/jev). That string is not a TypeSafe first-party alias. Do not mix ids across doors.
4. Treat 401 as “stop and fix the secret.” Do not retry in a loop. 422 is a body problem; 429/529 are capacity. See access troubleshooting.
5. Rotate leaked keys in the console or gateway. jev.pro cannot revoke anything.
6. Keep authorization of people in your IAM. Jev will not enforce SSO — permissions.

Pitfalls

• Putting the key in state or instructions. That does not authenticate the call and will log a secret.
• Marketplace or wrapper 402 / customer-verification codes. Those are that vendor’s surface, not a TypeSafe status we will invent.
• Inventing an “auth endpoint.” There is no documented first-party auth route beyond getting a key and calling /v1/systemone or /v1/models.
• Sending raw JWTs you would not log. You may put text fields you already trust into state. Do not paste session tokens.
• Treating vendor RPM or price as part of the auth handshake. TypeSafe’s models page claims 1200 RPM, 250k tok/s, and $0.042/M input (output free). Those can change and they do not appear in the Bearer header.

What authenticates versus what authorizes

Authentication answers “is this caller allowed to evaluate?” Authorization answers “may this human take the verdict?” A 200 with admin_override is still only a typed string until your handler checks roles. Reviewers need traces, not the vault.

OIDC appears on documented gateway paths. First-party TypeSafe HTTP is a bearer key. Local Vercel OIDC, when you use it, expires on Vercel’s schedule (their KB has cited ~12 hours) — that is Vercel’s clock, not TypeSafe’s.

If GET /v1/models is empty, check auth first. The catalog lists aliases; versioned ids may still work on POST.

See also

• Access hub
• API keys
• Permissions and roles
• Access troubleshooting

FAQ

Does Jev do end-user login for my customers?

No. Your app authenticates humans. Jev authenticates your service.

Can I put JWT user identity in state?

You may put text fields you already trust. Do not send raw tokens you would not log.

Is OIDC a TypeSafe product?

OIDC appears on documented gateway paths. First-party TypeSafe HTTP is a bearer key.

What this page does not claim

This page does not claim TypeSafe ships end-user SSO, a dedicated auth endpoint, or that Gateway OIDC is a first-party TypeSafe alias. It does not issue or revoke keys. It does not freeze vendor limits.

Disclaimer

This is an independent unofficial site and is not affiliated with TypeSafe AI; official documentation is available at https://docs.typesafe.ai.