DeepSeek API Get Started

Updated: 2026-08-12.

Overview

DeepSeek API, DeepSeek API key, and DeepSeek developer workflows mean wiring models into sites, scripts, bots, or internal tools. “HTTP 200 once” is not production-ready. You also need: keys never in the browser, timeouts and retries, schema validation, usage budgets, and redacted logs. Endpoints, model names, prices, and rate limits follow official API docs. Below uses placeholders so this page does not invent short-lived model IDs or unit prices.

What this guide solves

• Prepare account, billing, and API Key
• Send a first request via environment variables
• Design timeouts, retries, error handling, and cost controls
• Pass a pre-launch security checklist and wire Codex when needed

Prep: account, key, billing

1. From deepseek.com, open the official developer / open platform (labels follow the live site).
2. Complete login and billing / top-up; set budget or usage alerts if the console offers them.
3. Create an API Key; copy immediately into a password manager or secret store—UIs often hide the full value later.
4. Tag keys by purpose (dev-chat / prod-summarizer) so rotation after leaks is precise.
5. Confirm current base URL, auth header, and model list in docs—do not copy expired blog snippets.

Do not assume web-chat quotas, models, and bills match the API. Casual trials can use DeepSeek V4 chat; product integration must call the API from a server.

Environment variables: secrets stay server-side

# Linux / macOS (local dev)
export DEEPSEEK_API_KEY="your-secret-here"

# Windows PowerShell (current session only; production → platform Secrets)
$env:DEEPSEEK_API_KEY = "your-secret-here"

Hard rules:

• Never put the key in frontend JS, mobile apps, public repos, screenshots, or issues
• Load via process.env, deploy Secrets, or a cloud KMS
• Separate keys for dev / staging / prod
• Suspected leak → revoke immediately in the console and rotate

First request (placeholders—replace from docs)

Replace OFFICIAL_API_ENDPOINT and MODEL_NAME_FROM_DOCS with values from api-docs.deepseek.com.

import os
import requests

api_key = os.environ["DEEPSEEK_API_KEY"]
endpoint = "OFFICIAL_API_ENDPOINT"  # copy from official docs
model = "MODEL_NAME_FROM_DOCS"      # copy from docs / console

resp = requests.post(
    endpoint,
    headers={
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
    },
    json={
        "model": model,
        "messages": [
            {"role": "user", "content": "Explain idempotency in three points"}
        ],
    },
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

After it works, check usage fields (if present), latency, and whether the key accidentally landed in logs.

Time-boxed betas (e.g. V4.1 Flash)

DeepSeek occasionally ships intermediate betas (for example DeepSeek V4.1 Flash): usually keep the same base_url and only change model to a temporary ID with an expiry date; billing and concurrency follow the notice that day. Never hard-code such IDs into production—always configure fallback to GA Flash/Pro. Dedicated steps: V4.1 Flash beta guide.

Copy-ready business prompt (inside messages)

You are an internal knowledge assistant. Answer only from the provided context.
If context is insufficient, say "not in the materials" and list what is missing.
Do not invent links, statutes, or numbers.
context:
"""
[redacted paragraph]
"""
question: [user question]

Streaming notes

Interactive UIs usually need streaming so users see tokens early. Event format, SSE fields, and client parsing follow the official “streaming” chapter. Also:

• Set overall and idle timeouts for streams
• Mid-stream disconnects must recover or fail clearly—no infinite spinners
• Never hold the key in the browser for “direct streaming”; proxy via your backend

Reliability design (required before launch)

1. Timeouts: connect + read; prevent hung workers
2. Retries: only for 429 / 5xx / brief network blips with capped exponential backoff; do not blind-retry 401/403/400
3. Idempotency: write paths need business idempotency keys so retries do not double-charge or double-create
4. Validation: schema-check JSON; on failure, safe degrade or a bounded “repair” call
5. Isolation: per-user QPS, global rate limits, circuit breakers
6. Observability: log request_id (if returned), model, latency, tokens, error codes—never raw IDs, cards, or full private chats
7. Versioning: treat system prompts, model names, and temperature-like knobs as versioned config

Error handling table

Situation	Typical signal	Action
Auth failure	401 / invalid key	Check env + key status; no retry
Permission / region	403	Read official account guidance
Bad params	400 / invalid model	Fix model and fields from docs
Rate limit	429	Backoff, queue, lower concurrency, request higher limits
Server error	5xx	Bounded retry + alert
Client timeout	timeout	Shrink context, lower max tokens, async jobs
Bad output	broken JSON	Validation failure path + limited repair

Cost control

• Cap input length and max output; summarize or truncate long histories
• Cache identical requests when privacy allows
• Route by difficulty: light tiers for classification, stronger tiers for hard reasoning (names from docs)
• Record daily tokens and spend; set budget alerts
• Prefer off-peak batching; avoid useless “think again” loops

Do not hard-code “price per million tokens” in tutorials or comments—use the live official pricing page.

Security checklist (pre-launch)

• Key only in server env / secret manager
• No keys in repo, CI logs, or frontend bundles
• User input length limits and basic filters (per compliance)
• Logs redacted; retention period defined
• Key rotation cadence; revoke on offboarding
• Separate keys for dev / staging / prod
• Browser and apps never hold the key

Codex / coding agents

When wiring DeepSeek into coding agents, keep secrets in local/CI Secrets—not chat screenshots. Step-by-step: Codex DeepSeek configuration.

Access

• Convenience trial: DeepSeek V4
• Studio mirror: AI Chat Studio
• Official chat: chat.deepseek.com
• API docs: api-docs.deepseek.com
• Codex config: /en/guides/codex/deepseek-config/

Web entries are for human trials; API is for server-side integration. Model lists and billing may differ.

FAQ

Can I put the API key in the browser?

No. Anything shipped to a browser can be extracted. Your backend must call DeepSeek.

Model name rejected?

Use the current list in the console and official docs: renamed, not enabled, or misspelled. Keep MODEL_NAME_FROM_DOCS as a reminder to re-check.

How do I control cost?

Limit context and output, cache reusable results, route by tier, set budget alerts, and watch for abusive traffic.

Must I store full conversations?

Keep only required fields; set retention; redact PII. Compliance beats convenience.

Key leaked—what now?

Revoke in the console → create a new key → hunt Git history, CI logs, container env, frontend artifacts → inspect billing for abnormal calls.

Official resources

• DeepSeek website
• Official chat
• API docs

Next reading

• DeepSeek coding playbook
• DeepSeek prompt engineering
• DeepSeek R1 reasoning
• Codex DeepSeek configuration

Action path

Today: run one placeholder request via env vars; print usage and latency.
Tomorrow: add timeouts, 429 backoff, and schema checks; delete any plaintext keys from code.
This week: set budget alerts, baseline 10 real inputs, then pick a default model tier; read Codex config if you need agents.