Set up and check your API key

Keep your key safe

Treat your API key like a house key. Anyone holding it can walk in. So you never leave copies lying around.

1. Create a key in the TypeSafe dashboard: console keys.
2. Store it in one place only: the environment variable TYPESAFE_API_KEY.
3. For raw HTTP, send Authorization: Bearer $TYPESAFE_API_KEY.
4. The SDKs read TYPESAFE_API_KEY by default.
5. Never commit keys, never put them in client-side pages, and never invent placeholder keys that look real. The JS SDK's dangerouslyAllowBrowser defaults to false. Do not turn it on for public lessons.

Sources: Quick start, CORE credentials.

Verify without showing the secret

Fail closed. Print the key's length or the HTTP status. Never print the key value.

# Length only — never echo the key
if [ -z "$TYPESAFE_API_KEY" ]; then
  echo "TYPESAFE_API_KEY is not set"
  exit 1
fi
echo "TYPESAFE_API_KEY length: ${#TYPESAFE_API_KEY}"

# Auth test — print status only (401 = bad/missing key)
code=$(curl -s -o /dev/null -w "%{http_code}"   -H "Authorization: Bearer $TYPESAFE_API_KEY"   https://api.typesafe.ai/v1/models)
echo "GET /v1/models => HTTP $code"
# Expect 200 when the key is valid (docs: models endpoint uses Bearer auth)

const key = process.env.TYPESAFE_API_KEY;
if (!key) throw new Error("TYPESAFE_API_KEY is not set");
console.log("key length:", key.length); // never console.log(key)

const res = await fetch("https://api.typesafe.ai/v1/models", {
  headers: { Authorization: `Bearer ${key}` },
});
console.log("status", res.status); // do not log Authorization header

Next

Make your first POST /v1/systemone call.