Get an API key and keep it private

Choose a route before creating credentials

There is no universal Jev key. Credentials are specific to each route:

• TypeSafe: for existing accounts; create TYPESAFE_API_KEY in the console.
• OpenRouter: sign up, add Credits, then create OPENROUTER_API_KEY.
• DigitalOcean: prepay an Inference balance, then create a model access key.
• Cloudflare: Workers use an AI binding and need no TypeSafe key; create a Cloudflare API token only for external REST calls.
• OpenCode Zen: sign in, choose the free or paid Jev model, then create OPENCODE_API_KEY.
• Vercel: create AI_GATEWAY_API_KEY, or use OIDC when deployed on Vercel.

See the current status and steps for all six routes.

Store it safely

Keep keys in a password manager or server-side secret and read them through environment variables. Never put them in HTML, browser JavaScript or Git.

Keep it out of public artifacts

Do not put real keys in Git repositories, browser JavaScript, screenshots, videos, shared links or coding-agent chat messages. A .env file is not encrypted storage; exclude it from version control.

After accidental exposure

Revoke the key, create a replacement, inspect activity and billing, and remove public copies. Deleting a string from a commit does not invalidate the credential.

Checkpoint

The server can read the credential, while the browser and repository cannot. Add a balance alert or usage limit as well.