Authentication

Every call to the public API is authenticated with a bearer token:

-H "Authorization: Bearer sk-your-key-here"

The token is the API key itself. There is no OAuth flow, no refresh token, and no session cookie — a key either works or it does not.

Keys are prefixed

Keys are issued with the sk- prefix. If a key ever reaches your logs, you can recognise it by that prefix.

Creating a key

1. Sign in at jevmodel.io.
2. Open Settings → API Keys.
3. Press Create API key, give it a name that says where it will be used, and create it.

The full key is displayed exactly once, immediately after creation. The list only ever shows the masked form — four leading characters, eight dots, four trailing characters — so a screenshot of the settings page is safe to share.

Revoking a key

Open the key and delete it. Revocation is immediate: the next call with that key returns 401 Invalid API key.

Using keys safely

• Keep the key in an environment variable, never in source control.
• Use a different key per service or per environment, so you can revoke one without breaking the others.
• Rotate on a schedule, and whenever a key may have been exposed.
• Never send a key to the model provider, a log aggregator, or an error tracker.

What a rejected key looks like

The API answers both cases the same way on purpose: a caller cannot use the error to discover which key ids exist.