DeepSeek BYOK

Use DeepSeek from a router you control

Put one or more DeepSeek API keys on your TEKIZ.AI host, point Codex or another OpenAI-compatible client at port 8790, and keep your provider key off the client. Add another authorized key or model if you want fallback.

Create a DeepSeek key Configure Codex

Customer-controlled keys

Your DeepSeek key stays in the router process on your machine or server. Agents receive only the TEKIZ.AI endpoint and optional client key.

Handle a failed key

A 401, 402, 403, or 429 cools the affected credential fingerprint. The router can try another eligible route if you configured one.

One agent configuration

Use deepseek/deepseek-v4-flash directly or let Balanced and Frontier profiles choose among authorized routes.

From key to first request

  1. Create an API key in the DeepSeek platform. DeepSeek currently documents API-key access for this integration.
  2. Set DEEPSEEK_API_KEY on the machine running TEKIZ.AI Router, then start the router on port 8790.
  3. Point your client at http://127.0.0.1:8790/v1. The provider key does not need to be copied into Codex or another agent.

Run DeepSeek through a local router

Run these commands from your configured router installation. Leave the router running, then send the test request from a second terminal.

export DEEPSEEK_API_KEY=your_deepseek_key
python3 router.py --port 8790
curl http://127.0.0.1:8790/v1/chat/completions \
  -H 'Authorization: Bearer local-router' \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "deepseek/deepseek-v4-flash",
    "messages": [{"role": "user", "content": "Reply with DEEPSEEK_OK"}]
  }'

Use a key pool

Teams can configure an ordered pool for separate accounts, quota domains, or key rotation. When one key fails, the router can try another eligible key in the pool. 

export TEKIZAI_ROUTER_DEEPSEEK_API_KEYS='["team-a-key","team-b-key"]'
export TEKIZAI_ROUTER_CREDENTIAL_STRATEGY=failover

Supported strategies are failover, round-robin, lru, and random.

Use it from Codex

export TEKIZAI_API_KEY=local
mkdir -p ~/.codex
cat >> ~/.codex/config.toml <<'TOML'
[model_providers.tekizai-local]
name = "TEKIZ.AI"
base_url = "http://127.0.0.1:8790/v1"
env_key = "TEKIZAI_API_KEY"
wire_api = "responses"
TOML

# ~/.codex/tekizai-deepseek.config.toml
cat > ~/.codex/tekizai-deepseek.config.toml <<'TOML'
model_provider = "tekizai-local"
model = "deepseek/deepseek-v4-flash"
TOML

codex --profile tekizai-deepseek

DeepSeek currently documents V4 Flash as its Codex-compatible model. Plain codex keeps using ChatGPT. The TEKIZ.AI route is selected only with codex --profile tekizai-deepseek.

Hosted and self-hosted are separate custody paths

A generated sk_tekiz_* key uses hosted capacity enabled for your TEKIZ.AI account. A DEEPSEEK_API_KEY environment variable belongs on your self-hosted router; setting it on a client does not upload it to the hosted service. See the integration matrix for BYOK, BYOS, local, and managed-access boundaries.

Stay within your approved services

If your company approves only DeepSeek, keep that boundary. TEKIZ.AI can reduce token burn by choosing eligible models. Your DeepSeek account handles provider billing.