DeepSeek API Guide: Setup, Keys and First Request

The DeepSeek API provides OpenAI-compatible and Anthropic-compatible request formats. For new OpenAI-format integrations, use https://api.deepseek.com and a current model ID: deepseek-v4-flash or deepseek-v4-pro. Keep the key in an environment variable, never in browser code or a public repository.

Before you start

You need a DeepSeek account, available API balance and a key created at platform.deepseek.com↗ — official external destination. Read the current pricing and open-platform terms. Use a separate development key and a small balance while testing.

The legacy model names deepseek-chat and deepseek-reasoner were retired after July 2026. Tutorials using them should be updated rather than copied.

Store the API key

On macOS or Linux:

export DEEPSEEK_API_KEY="replace-with-your-key"

In PowerShell:

$env:DEEPSEEK_API_KEY="replace-with-your-key"

Do not place a real key in .env.example, screenshots, client-side JavaScript or support messages. For production, use the deployment platform’s secret manager and rotate leaked keys immediately.

Python request

Install the current OpenAI SDK in an isolated environment:

python -m pip install openai

Then:

import os
from openai import OpenAI

api_key = os.environ.get("DEEPSEEK_API_KEY")
if not api_key:
    raise RuntimeError("DEEPSEEK_API_KEY is not set")

client = OpenAI(
    api_key=api_key,
    base_url="https://api.deepseek.com",
    timeout=30.0,
    max_retries=2,
)

response = client.chat.completions.create(
    model="deepseek-v4-flash",
    messages=[
        {"role": "system", "content": "Answer concisely. State uncertainty."},
        {"role": "user", "content": "Explain context caching in three bullets."},
    ],
    max_tokens=300,
    extra_body={"thinking": {"type": "disabled"}},
)

print(response.choices[0].message.content)
print(response.usage)

The example fails safely when the environment variable is missing and limits output.

JavaScript request

Install the SDK:

npm install openai

Use a server-side module:

import OpenAI from "openai";

if (!process.env.DEEPSEEK_API_KEY) {
  throw new Error("DEEPSEEK_API_KEY is not set");
}

const client = new OpenAI({
  apiKey: process.env.DEEPSEEK_API_KEY,
  baseURL: "https://api.deepseek.com",
  timeout: 30_000,
  maxRetries: 2,
});

const response = await client.chat.completions.create({
  model: "deepseek-v4-flash",
  messages: [
    { role: "system", content: "Answer concisely. State uncertainty." },
    { role: "user", content: "Explain context caching in three bullets." },
  ],
  max_tokens: 300,
  thinking: { type: "disabled" },
});

console.log(response.choices[0].message.content);
console.log(response.usage);

Never bundle this code and secret into a public web client. Put an authenticated server endpoint between users and the provider.

Thinking mode

The current models default to thinking enabled. In the OpenAI SDK, DeepSeek’s documentation uses extra_body for the thinking object and supports reasoning_effort values high and max. Thinking can help harder tasks but adds generated tokens and protocol details.

Use non-thinking mode for simple classification or extraction when it passes evaluation. Read the official thinking guide before multi-turn tool calls; reasoning content must be preserved in certain tool sequences.

Inspect the response

Check finish_reason before trusting content. stop means a natural stop; length indicates truncation or context pressure; tool_calls requires application handling; content_filter or insufficient_system_resource needs an explicit failure path.

Record model, token categories, request duration and privacy-safe identifiers. Do not log full prompts by default. The usage object separates cache hit and miss tokens for cost analysis.

Handle errors deliberately

DeepSeek documents 400 invalid format, 401 authentication, 402 insufficient balance, 422 invalid parameters, 429 rate limit, 500 server error and 503 overload. Retry only transient 429, 500 and 503 responses with bounded exponential backoff and jitter.

Do not retry 401 with the same key or 422 with the same body. Surface a useful internal error without exposing the provider key or raw private prompt. The API error guide contains a production checklist.

Cost and abuse controls

Validate user input, cap length, restrict models and set max_tokens. Add per-user quotas and authentication to your server. Reject recursive calls and limit agent turns. Monitor for sudden token growth.

At current rates, Flash is cheaper than Pro, but compare accepted results. Context caching can reduce repeated prefix cost automatically; it should not be used as an excuse to send unnecessary data.

Privacy and downstream responsibility

DeepSeek’s open-platform terms say developers operating downstream systems are responsible for their end users and privacy disclosures. Do not put personal data into user_id; the documented field allows only a constrained identifier and is used for safety, cache and scheduling isolation.

Classify data, minimise prompts and provide deletion and contact paths appropriate to your application. A provider’s controls do not replace your own obligations.

Verify model availability

Call the documented GET /models endpoint or check the official pricing page during deployment. Pin accepted model IDs in configuration and fail closed when an unexpected alias appears. Run regression tests after model updates.

The model overview distinguishes API IDs from open checkpoints and runtime tags.

Conclusion

A safe DeepSeek integration begins with current model IDs, server-side secret storage, output limits and explicit error handling. Add usage monitoring, validation and human review before expanding from a first request to a production workflow.