API · Last updated 2026-09-21

Jev API webhook signatures

If Stripe, GitHub, or your bus signs deliveries, verify their HMAC. Outbound calls to TypeSafe use a bearer API key, not a webhook signature TypeSafe documents on System One.

This page is for builders who searched an extra “endpoint” name while wiring Jev / System One. jev.pro is an independent unofficial field guide — not affiliated with TypeSafe AI. We do not sell or issue keys. Confirm first-party routes on docs.typesafe.ai/api.

The public API reference documents one evaluation route — POST https://api.typesafe.ai/v1/systemone — plus GET /v1/models. This title is not a separate first-party URL in that reference. Treat the capability as something you implement around the official call.

Steps

1. Verify the inbound webhook with the vendor’s signing secret.
2. Map the event to filtered state.
3. Call POST /v1/systemone from your worker.
4. Do not wait for a TypeSafe callback they have not documented.

Map onto the official POST

No documented TypeSafe X-Typesafe-Signature on the evaluation API we read. Auth remains Authorization: Bearer. Body remains model, state, questions. Do not put signing secrets in state. Question ids are not sent to the model. Text only.

Official SDKs (typesafe-sdk, @typesafe-ai/sdk) retry 429/529. Other documented statuses: 401, 422. Skipping inbound signature checks because “Jev will judge the payload” is backwards: an attacker who can POST to you can fill state with whatever they want. Schema-safe answers are not proof the event was authentic.

Pin jev-1.13.0 in the worker. jev-latest / jev-preview currently resolve to it — confirm. Vendor-claimed token price still applies to every webhook-driven call. Vendor-claimed 1200 RPM is easy to hit if you evaluate on every noisy event — filter first (64k / 32k context claims also argue for a thin state).

TypeSafe does not POST results to your URL in the public System One reference we used. If you need a queue instead of a webhook, that is your bus.

When not to look for a TypeSafe signature

Outbound System One is a client call, not a webhook TypeSafe sends. Marketplace doors may add their own auth; that is not a first-party HMAC we will invent.

Pitfalls

• Skipping inbound signature checks because “Jev will judge the payload.”
• Putting signing secrets in state.
• Inventing X-Typesafe-Signature as official.
• Waiting for a TypeSafe callback job.

See also

• API hub — bearer POST
• Webhook channel — your inbound adapter
• Authentication concepts — keys vs signatures
• Async jobs — workers that can restart

FAQ

Does TypeSafe POST results to my URL?

Not in the public System One reference we used.

Is this a documented TypeSafe URL?

No.

Queue instead of webhook?

Queue channel.

Can Jev verify Stripe’s HMAC for me?

No. Verify first, then evaluate text.

What this page does not claim

• Official TypeSafe status, logos, or support.
• That jev.pro sells, issues, or proxies API keys.
• Extra first-party HTTP routes beyond POST /v1/systemone and GET /v1/models unless the API reference lists them.
• Invented latency SLOs, search volume, or unofficial prices. List price and rate limits are vendor claims — confirm on models.
• That a schema-constrained answer is automatically factually correct.

Disclaimer

This is an independent unofficial site and is not affiliated with TypeSafe AI; official documentation is available at https://docs.typesafe.ai. Never treat jev.pro as TypeSafe official documentation. We do not sell, issue, or proxy API keys.