How to get a DeepSeek API key

Create a DeepSeek credential in the official account, configure it on your server and verify a small request. Keep account access, billing readiness and application configuration as separate checks.

Before you start

The official quickstart links to the DeepSeek platform for key creation and documents bearer authentication for the Chat Completions interface. Open the platform through that official link and sign in to the account intended to own the application. Official DeepSeek documentation.

Choose a clear purpose for this credential before generating it. A local experiment, a deployed support service and an unattended worker should be distinguishable in your own records. Record the account owner, the application that will use the key and the person responsible for stopping it. This makes later rotation practical without putting the secret itself in a ticket or shared document.

Check billing readiness before treating an authentication problem as a code problem. DeepSeek distinguishes an invalid credential from insufficient account balance in its error reference. Review DeepSeek charge categories and define the experiment’s stop condition. The AI API cost calculator can help plan its request volume, but it does not inspect the private account. Official DeepSeek documentation.

Step-by-step: create the key

1. Open the official DeepSeek platform from the quickstart’s API key link and sign in to the intended account.
2. Review the account’s usable balance and any explicit grant conditions before generating traffic.
3. Open the API keys area and use its create control. Give the credential a purpose-specific name when the interface offers one.
4. Transfer the new secret directly to the application’s secret store or local environment configuration. Keep it out of screenshots and project source.
5. Return to the key list and record a safe label for the credential, then verify the small request below before connecting a background worker.

Treat the console and the environment as separate stages. Completing the create dialog does not update an already running application. After configuring the secret, restart the intended process and verify that it reads the correct variable name. Check only whether the value is present; printing it to establish that fact creates an unnecessary copy.

If you are helping another developer, send the official setup link and the required variable name. Let the account owner enter the secret through the application’s secure configuration surface. A chat transcript or pasted diagnostic bundle is a poor place to transfer a bearer credential. A successful setup record should describe the outcome and safe key label rather than contain the value.

Set a spending limit / budget alerts

Inspect the controls available in your own DeepSeek billing interface. This guide does not infer an account-level hard cap or notification feature from another provider’s console. If the needed control is absent, enforce the experiment’s request ceiling and stop condition in the application and inspect actual usage after the initial run.

For a scheduled service, document what happens when the local allowance is reached: stop new work, preserve queued items and report a clear administrative condition. Do not turn a billing problem into an automatic top-up loop. If you use an account grant, track its eligibility and expiration from the actual offer. The DeepSeek free-access guide explains why key creation alone does not establish an allowance.

Verify the key: first call with cURL and Python

curl https://api.deepseek.com/chat/completions \
  -H "Authorization: Bearer ${DEEPSEEK_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"model":"deepseek-flash","messages":[{"role":"user","content":"Explain a database index briefly."}],"thinking":{"type":"disabled"}}'

import os
from openai import OpenAI

client = OpenAI(api_key=os.environ["DEEPSEEK_API_KEY"],
                base_url="https://api.deepseek.com")
response = client.chat.completions.create(
    model="deepseek-flash",
    messages=[{"role": "user", "content": "Explain a database index briefly."}],
    extra_body={"thinking": {"type": "disabled"}},
)
print(response.choices[0].message.content)

The examples use the documented Chat Completions request shape. A successful response includes a completion choice containing an assistant message; the wording depends on the model. This is a response-shape check, not a promised literal answer. Inspect returned usage after the call and keep only safe diagnostics. Official DeepSeek documentation.

{"choices":[{"message":{"role":"assistant","content":"<generated explanation>"}}],"usage":{"prompt_tokens":"<reported>","completion_tokens":"<reported>"}}

The response fragment is illustrative and omits variable identifiers. Follow the complete Python walkthrough for a script that validates local configuration and prints a controlled result. If the first call fails, retain its HTTP status and sanitized message, then follow DeepSeek troubleshooting rather than immediately replacing every setting.

Where to put the key

Use DEEPSEEK_API_KEY as the environment variable read by these examples. For raw HTTP, the corresponding credential is sent in the Authorization: Bearer header. The client’s base URL must point to DeepSeek as well as using the DeepSeek key. Official DeepSeek documentation.

Keep the secret on the server side of a web application. Browser-delivered JavaScript, page source and public build variables can expose it to visitors. Let the browser call your application, and let the server apply its access checks before calling the provider. For local development, exclude secret files from version control and use a separate safe example file containing variable names only.

Verify the configuration in the environment that actually runs the call. A shell variable in an interactive session may not be available to a service manager, container or scheduled worker. Check the deployment’s secret injection mechanism and restart behavior. Log a missing-variable condition explicitly so an empty value does not become a confusing authentication failure later.

Common rejections

DeepSeek documents authentication failure separately from insufficient balance and rate limiting. A rejection from a gateway can also differ from the provider’s documented error shape. Preserve the status and safe error type, and use the official error reference to select the next action. Official DeepSeek documentation.

For an authentication rejection, check the variable name, extra whitespace, intended account and base URL. For a balance rejection, inspect billing with the account owner. For a rate rejection, reduce outstanding work and review account concurrency. Do not assume that creating another key resolves shared account capacity. For a forbidden response, inspect the actual safe message; this page does not assign an undocumented universal meaning to it.

Rotate and revoke

Create the replacement credential, store it in the intended deployment, restart the affected process and verify a small call. Then revoke the old credential through the official account controls once its legitimate users have migrated. Keep a record of the safe labels and deployment change so a later failure can be traced without retaining either secret.

When exposure is suspected, prioritize revocation and review account activity. Remove the secret from the public location, but do not assume deletion makes the old value safe again. Check background workers and cached deployment configuration during recovery. A key that has been revoked should produce a controlled application failure rather than trigger a retry storm.

Frequently asked questions

Sources

• First API call and key link ↗
• Official console ↗
• Error reference ↗
• Billing reference ↗

Last verified 12 Sep 2026 · Source ↗