Jev API 403: Must Supply an API Key

The exact error

We got this on September 19, 2026 by sending a request to https://api.typesafe.ai/v1/systemone without an Authorization header:

HTTP 403

{
  "detail": {
    "error_type": "authentication_error",
    "message": "Must supply an API key! Check your request and try again."
  }
}

Note the status code. TypeSafe’s API reference lists only 401 for key problems, but a request with no key at all gets 403, not 401. Code that only checks for 401 will treat this as an unexpected error.

What causes it

• The header is missing. A typo in the header name, or an HTTP client that drops it.
• The environment variable is empty. Authorization: Bearer $TYPESAFE_API_KEY in a shell where the variable is not set sends Bearer followed by nothing. Some clients then omit the header altogether.
• A proxy or gateway strips it. Corporate proxies, some serverless rewrites and misconfigured API gateways remove Authorization headers.
• Browser requests. Fetching the API directly from a web page with credentials omitted, or through a CORS proxy that drops headers. You should not be calling Jev from the browser anyway; see below.

How to fix it

1. Check that the variable is set in the process that makes the call:

[ -n "$TYPESAFE_API_KEY" ] && echo "key is set" || echo "TYPESAFE_API_KEY is empty"

2. Send the header explicitly:

curl -s https://api.typesafe.ai/v1/models -H "Authorization: Bearer $TYPESAFE_API_KEY"

3. If that works from your machine but not from your server, log the outgoing headers (with the key redacted) to see whether something in between removes them.

If you use an official SDK

The SDKs check for a key before sending anything, so you will not see the 403. Instead:

• Python raises TypeSafeError: “No API key was provided. Pass api_key or set the TYPESAFE_API_KEY environment variable.”
• JavaScript throws TypeSafeError: “No API key was provided. Pass apiKey to the TypeSafeClient constructor or set the TYPESAFE_API_KEY environment variable.”

The fix is the same: set TYPESAFE_API_KEY, or pass the key to the client constructor.

Keep keys out of front-end code

A 403 sometimes appears when someone tries to call Jev from browser JavaScript and leaves the key out on purpose. That instinct is right, but the answer is a small server-side endpoint that holds the key, not an unauthenticated call. The JavaScript SDK blocks browser use unless you set dangerouslyAllowBrowser, because anyone viewing the page could copy the key and spend your credits.

Related errors

• A key was sent but is wrong: 401: Cannot authenticate with the server
• Everything else: Jev API errors