How an agent gets a DeepSeek key through KeyKeeper, what to choose on platform.deepseek.com, and how KeyKeeper verifies it.

Template id	`deepseek` (also `deep-seek`)
Field	`deepseek-api-key` → `DEEPSEEK_API_KEY` · secret
Key looks like	whether it can be viewed again is unconfirmed
Created at	platform.deepseek.com
Verified by KeyKeeper	`GET https://api.deepseek.com/models` — lists available models
Template checked	2026-09-15

What the agent does

keykeeper providers show deepseek
keykeeper save --provider deepseek --from-clipboard --create --purpose "what this task does"
keykeeper run -c deepseek -- <your command>

--provider deepseek fills in the credential id and the field. The environment variable is the one DeepSeek's own tools read, so nothing has to be mapped.

What only you can do

Create a separate API key

Make sure the account has balance

Copy the key, then approve the save in KeyKeeper's window.

What to choose

Keys have no per-key scopes. Use one key per project and revoke it independently.

The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.

What KeyKeeper checks

Before writing: the value must look like a DeepSeek key (whether it can be viewed again is unconfirmed). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
After saving: KeyKeeper itself sends GET https://api.deepseek.com/models with the key in the Authorization header (lists available models). The agent receives accepted, rejected or could not reach — never the value.

Endpoints

The key is a bearer token for these endpoints. keykeeper run sets only the variables above; point your client at the base URL yourself.

OpenAI — https://api.deepseek.com
Anthropic — https://api.deepseek.com/anthropic

Rotation and expiry

No universal expiry policy was confirmed for this credential type. Record the date shown by the provider, or leave it unknown. Rotate or revoke at platform.deepseek.com.

DeepSeek