Jev 401 Authentication Error: How to Fix It

Check environment loading, whitespace, Bearer headers, and provider-specific API keys in a fixed order.

Symptoms and meaning

A 401 means authentication did not succeed. It usually occurs before the question is evaluated, so changing state or criteria is unlikely to help. Determine whether the response comes from TypeSafe directly or a provider gateway.

1. Confirm TYPESAFE_API_KEY exists

Check presence without printing the key:

import os
key = os.environ.get("TYPESAFE_API_KEY", "")
print({"present": bool(key), "has_outer_whitespace": key != key.strip()})

A variable defined in one shell is not automatically available in another process, CI job, or deployed Worker. Restart a long-lived process if it captured its environment before you configured the value.

2. Check accidental spaces

Remove surrounding whitespace introduced by copying. Check whether quote characters were stored as part of the value. Do not print the token in logs to debug this; inspect configuration locally and use a masked presence check.

3. Verify the Bearer prefix

The header is Authorization: Bearer <key>. A bare token, duplicated Bearer prefix, or an unrelated header name can fail. SDK clients set this header for you; avoid overriding it with a second authentication layer accidentally.

4. Verify the correct provider key

A direct TypeSafe key belongs at api.typesafe.ai. An OpenRouter key belongs at OpenRouter. A Vercel gateway key and a Cloudflare account token have their own scope. Review both the base URL and key source together.

5. Replace compromised or revoked keys

If a key was revoked, generate a replacement in the provider console. If it was exposed, revoke it and rotate the deployment secret. Do not re-enable a leaked credential as a debugging shortcut.

6. Test a minimal request

Download request.json and run:

curl --fail-with-body https://api.typesafe.ai/v1/systemone   -H "Authorization: Bearer $TYPESAFE_API_KEY"   -H "Content-Type: application/json"   --data-binary @request.json

If this succeeds but the app fails, compare the app’s environment and base URL. If it still returns 401, verify the account and key status with the provider. Do not repeatedly retry the unchanged request.