How to Get a DeepSeek API Key
How do I get a DeepSeek API key?
DeepSeek (Hangzhou DeepSeek AI Co., Ltd.) API key: open the official console, create a key for the correct project, workspace, or account, and copy it immediately. The key format is DeepSeek API keys use the sk- prefix followed by provider-issued secret characters. Use the least-privilege permissions for this service. Store it as DEEPSEEK_API_KEY in a server-side secret manager. Fund the account before live calls.
Steps
- Open DeepSeek Platform API Keys and choose Create API key. (verified 2026-08-14)
- Name the key for one environment or service, then confirm creation. (verified 2026-08-14)
- Copy the key immediately and store it securely; DeepSeek does not make a lost secret safe to recover. (verified 2026-08-14)
- Add account balance under Billing before making paid calls; DeepSeek does not provide an ongoing free tier in this guide. (verified 2026-08-14)
- Store the value as DEEPSEEK_API_KEY in a server-side environment or secret manager, never in source control or browser code. (verified 2026-08-14)
Key facts
| Env var | DEEPSEEK_API_KEY |
| Console | https://platform.deepseek.com/api_keys |
| Key format | DeepSeek API keys use the sk- prefix followed by provider-issued secret characters; never publish a sample value. |
| Scope and permissions | The key is account-level in the documented console; use separate keys per service/environment because no granular permission matrix is published here. |
| Billing | API usage draws down the DeepSeek account balance; billing belongs to the account, not to a separate key-level wallet. |
| Payment required before first call | Yes |
| Scoped to project/org | No |
| Shown once | Yes |
Rotate or revoke a key
Rotation
- Create a replacement key.
- Deploy it and verify a request.
- Revoke the previous key and remove it from deployments.
Revocation
- Open Platform → API Keys.
- Select the compromised or retired key.
- Revoke/delete it, then rotate any affected secrets.
First API call
curl example using deepseek-v4-flash; the key stays in DEEPSEEK_API_KEY and is never included in the snippet.
curl https://api.deepseek.com/v1/chat/completions \
-H "Authorization: Bearer $DEEPSEEK_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"model\": \"$MODEL\", \"messages\": [{\"role\": \"user\", \"content\": \"Say hello in one sentence.\"}]}"FAQ
Do I need a credit card to get a DeepSeek API key?
Yes — DeepSeek requires a payment method on file before the key can make live calls.
Can I see my DeepSeek API key again after closing the page?
No — DeepSeek shows the full key value exactly once. If you lose it, revoke it and create a new one.
Is this the same as an All AI Ask API key?
No. This page is about creating an API key with DeepSeek directly, for calling their API yourself. For an All AI Ask key — one key that routes to DeepSeek and every other provider we support — see /api-keys.
Batch 49 · deepseek decision and evidence contributions. Surface verification: 2026-08-14. These are route-local, server-rendered fixtures; unavailable values are not inferred.
DeepSeek direct-host credential verifier
Frozen Batch 49 fixture board. Formula / decision rule: success = host owner + base URL + auth header class + requested model + response identity Boundary: A third-party host accepting a credential is not proof of official DeepSeek authentication.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-deepseek-m1-r1official OpenAI-compatible endpoint | host=api.deepseek.com; base=/v1; header=Bearer; env=DEEPSEEK_API_KEY; key=fp-ds-prod-01; model=deepseek-chat; status=200; request=req-ds-1 Official host, auth class, model ID, and request ID join. | host-owner match=Yes; direct verification=PASS | PASS — official surface. |
batch49-deepseek-m1-r2official Anthropic-compatible endpoint · stale alias | host=api.deepseek.com; base=/anthropic; header=x-api-key; key=fp-ds-prod-02; model=deepseek-reasoner-old; status=404; request=req-ds-2 Host is official, but the requested alias is stale; auth success is not asserted. | model join=No; retry with current catalog evidence | UNAVAILABLE — alias identity stale. |
batch49-deepseek-m1-r3wrong third-party base URL · consumer-chat session · missing bearer | host=proxy.example; base=/v1; header=missing; session=consumer-chat; model=deepseek-chat; status=401; request=req-ds-3 Neither the host owner nor direct API credential class joins the request. | direct credential verification=blocked | FAIL CLOSED — host/auth mismatch. |
Provenance: Batch 49 deepseek module 1 first-party evidence and surface verification date 2026-08-14. DeepSeek API documentation. Missing joins fail closed.
DeepSeek account-key blast-radius planner
Frozen Batch 49 fixture board. Formula / decision rule: maximum affected workloads = all consumers joined to account + key + environment Boundary: When granular scopes are absent, isolate risk with separate keys and deployment boundaries.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-deepseek-m2-r1development · staging · production API | account=acct-ds-1; keys=fp-ds-dev/fp-ds-stg/fp-ds-prod; permission=account-level; stores=three; consumers=three Each environment has a distinct fingerprint and secret store, limiting blast radius despite account-wide permissions. | max affected per key=joined environment consumers only | PASS WITH ISOLATION. |
batch49-deepseek-m2-r2batch worker · two-region service | account=acct-ds-1; key=fp-ds-shared-04; scopes=Unavailable; regions=us/eu; consumers=worker+2 regions; funded dependency=account One key joins three production consumers and has no provider-level permission split. | maximum affected=3 workloads; isolation recommendation=separate keys | RISK — account-level blast radius. |
batch49-deepseek-m2-r3shared-key anti-pattern | account=acct-ds-1; key=fp-ds-shared-05; consumers=dev+staging+prod+personal; store=source-control; rotation owner=missing The key crosses environments and is exposed in source control; no accountable rotation owner joins. | go-live=No; revoke and reissue per environment | FAIL CLOSED — shared secret. |
Provenance: Batch 49 deepseek module 2 first-party evidence and surface verification date 2026-08-14. DeepSeek API documentation. Missing joins fail closed.
DeepSeek go-live and revocation evidence ledger
Frozen Batch 49 fixture board. Formula / decision rule: go-live = creation + funding + auth + deployment coverage; billing and auth failures stay separate Boundary: Do not diagnose balance failure as credential failure, or vice versa, without provider evidence.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-deepseek-m3-r1new unfunded key · funded valid key | key=fp-ds-new-01; creation=joined; funding=No; auth=not-tested; request=none; key2=fp-ds-funded-02; request=req-ds-4=200 Creation and funding are separate states; only the funded key has an accepted model response. | unfunded=blocked; funded=go-live candidate | PARTIAL — funding gate explicit. |
batch49-deepseek-m3-r2exhausted balance · invalid key | key=fp-ds-bal-03; funding=exhausted; status=402; request=req-ds-5; key2=fp-ds-invalid-04; status=401; request=req-ds-6 Provider statuses distinguish billing exhaustion from invalid authentication. | 402 → replenish; 401 → rotate/revoke; do not conflate | CLASSIFIED — separate actions. |
batch49-deepseek-m3-r3rotated worker fleet · suspected leak | old=fp-ds-leak-05; new=fp-ds-new-06; workers=9/9; old-last-use=10:12Z; revoke=10:20Z; negative=401 All workers use the replacement and the old fingerprint fails after revocation. | coverage=100%; revoke proof=joined | COMPLETE — incident receipt. |
Provenance: Batch 49 deepseek module 3 first-party evidence and surface verification date 2026-08-14. DeepSeek API documentation. Missing joins fail closed.