jev-setup

• SKILL.mdcore · 7,863 bytes
• SKILL.mdcore · 7,863 bytes
• SKILL.mdcore · 7,863 bytes

# Connect Jev (the key never passes through you)

Jev is TypeSafe's decision model. It needs one API key. **You must never see, ask for, or handle that key.**

The key can come from any of four providers, and the same Jev answers either way:

- **TypeSafe** (`jev setup-key`, the default): a key from [console.typesafe.ai](https://console.typesafe.ai/settings/keys).
- **OpenRouter** (`jev setup-key --provider openrouter`): reaches Jev through OpenRouter's Decisions API. Worth offering when the person already has an OpenRouter key, because it is then one key instead of two and one bill instead of two.
- **Venice** (`jev setup-key --provider venice`): reaches the same Jev through Venice, which serves it as its own decision modality. Worth considering when the person already has a Venice key; check Venice's current pricing before relying on any cost claim.
- **OpenCode Zen** (`jev setup-key --provider zen`): reaches Jev through OpenCode Zen, whose free tier answers the same request with the same model id shape. Worth offering when the person has no TypeSafe key — TypeSafe is not accepting new signups — and wants to start without a bill.

`TYPESAFE_BASE_URL` is an explicit compatible-endpoint override for a local mock or HTTPS proxy (for example `http://127.0.0.1:8787`, or a gateway that mounts the API under a path such as `https://gw.example/jev`). It is not a built-in provider endpoint editor: the official URLs above stay fixed by default. The client never forwards a saved or supplied provider credential to an override endpoint — not the keychain entry, not the credentials file, and not `TYPESAFE_API_KEY` from the environment, because that variable is where most installs keep their real TypeSafe key. A gateway that requires a bearer gets `JEV_PROXY_API_KEY` instead: the operator sets it in the same environment as `TYPESAFE_BASE_URL`, for that gateway only, and it is sent to nothing else. The client permits plaintext only on numeric loopback and does not follow redirects. `jev doctor` names the override, says whether a bearer goes with it, and asks it: a gateway answering 401 shows up there as `auth_failed` instead of as silence. Do not send sensitive states to an untrusted proxy. Clear the variable to return to the official endpoint and normal key flow.

If more than one key exists, TypeSafe is used: an existing install never starts routing its decisions somewhere else because an OpenRouter or Zen key happened to be in the environment for a text model. To pick a different one on purpose, set `JEV_PROVIDER=openrouter` or `JEV_PROVIDER=zen` in the environment the commands run in; it is honoured only when that provider actually has a key here, and an unset or unknown value changes nothing. `jev doctor` reports which one is in use under `key.provider`.