How to Get a DeepSeek API Key: 3 Minutes, Zero Review
Somewhere out there, someone is on day two of waiting for their DeepSeek API key application to "pass review." They filled in an application form, uploaded documents, and now they're refreshing a status page — because a tutorial told them approval takes one to two business days. I know this person exists because a friend sent me that exact tutorial in July, screenshot attached, asking how his review was going. Here's the thing: there is no application. No review. No form. The real process takes about three minutes, and the only thing anyone should be waiting for is their own coffee to brew.
This guide covers the whole life of a DeepSeek API key — the real creation flow (with the one step everybody skips), what "free" actually means, how to configure it everywhere, how to keep it safe, and the error tree for when it refuses to work. Plus a correction table for steps circulating in older tutorials that simply don't exist.
What a DeepSeek API Key Actually Is
A DeepSeek API key is one long string that does two jobs at once. It's your credential — the Authorization: Bearer header that proves the request is yours — and it's your meter: every token the API bills flows back to the account that key belongs to. An access card and the wallet it charges, fused into a single card.
That fusion explains most of the confusion people have with keys:
Billing is account-level, not key-level. Concurrency limits count per account regardless of which key made the call — 500 concurrent requests for deepseek-v4-pro, 2,500 for deepseek-v4-flash. A second key doesn't double your limits; it's another door into the same room.
The key has no permissions, no types, no scopes. There's no "test key" versus "production key." One key sees everything the account can see, which is also why leaking one matters so much — whoever holds it spends your balance.
It's shown exactly once. When you create a key, the platform displays the full string a single time. It isn't stored in plaintext anywhere you can retrieve later — like a scratch-off ticket: once you've revealed it, the platform can't un-reveal it for you. Lose it, and the move isn't "recover password"; it's delete the old key and issue a fresh one.
None of this is rationed, either. Creating keys costs nothing, there's no quota on how many you hold, and deleting one takes effect the instant you confirm. The platform treats keys as disposable on purpose — which hints at the right mental model: keys are meant to be rotated freely, because the thing worth guarding is the account, not the strings it hands out.
How to Get Your DeepSeek API Key
The real flow, end to end, per the official docs and the platform's actual console:
| Step | Action | Detail |
|---|---|---|
| 1 | Sign up at platform.deepseek.com | Email or phone number; no enterprise verification |
| 2 | Check for granted balance | New accounts often get trial credit (more below) |
| 3 | Top up | The step everyone skips — see why below |
| 4 | Open API Keys, click Create | Left sidebar of the console |
| 5 | Name the key | Something like my-app-dev — you'll thank yourself later |
| 6 | Copy it immediately | Shown once. Paste into a password manager or .env |
Three minutes, no application form, no review queue, no document upload. If any guide tells you to "create an application and wait for review," close the tab — that step doesn't exist.
Two details worth slowing down for.
Why top-up comes first. Creating the key costs nothing. Using it requires balance. The API is strictly pay-per-token, and a key attached to an empty account fails on its first real call with error 402 — Insufficient Balance. Among people reporting "my new key doesn't work," 402 is the leading cause by a wide margin — I've now debugged this exact conversation three times, and each time the key was innocent: the key is fine; the wallet behind it is empty. Top up before you write a line of integration code, and you delete the most common failure before it exists.
Why name the key. Nothing stops you from creating several keys under one account, and naming them — cli-experiments, prod-api, agency-batch — turns the console list into an audit trail. When one project leaks its key, you delete exactly that key, and every other project keeps running. The name is free; the isolation is priceless.
Is the DeepSeek API Key Free? The Honest Answer
Three separate questions hide inside "is it free," and each has a different answer.
Creating the key: free, unlimited ceremony. Sign up, click, done.
Calling the API: pay-per-token, always. Input and output bill separately, rates vary by model, and — since August 16, 2026 — by peak versus off-peak hour. The current rate table with effective dates lives in our DeepSeek V4 guide; don't trust pricing quoted in older tutorials, because it moved twice this year.
The new-account grant: real, but soft. Fresh accounts typically receive a granted balance — trial credit that gets spent before any topped-up balance. The honest caveat: the amount and its validity window are set by the platform and have changed over time. Check your balance page right after signing up and treat whatever you see as a pleasant head start, not a contractual commitment. Budget on real rates from day one.
One more freebie worth knowing: GET /user/balance returns your live balance programmatically, so a spend alarm is one scheduled call away. (The API guide covers that endpoint and the full first-call chain.)
Configure It Once, Use It Everywhere
The key travels well because the API is OpenAI-compatible — every tool that accepts an OpenAI key pattern accepts this one with a swapped base URL.
The discipline that survives every framework: environment variables, never literals.
# .env — committed to nothing, shared with no one
DEEPSEEK_API_KEY=sk-your-key-hereimport os
from openai import OpenAI
client = OpenAI(
api_key=os.environ["DEEPSEEK_API_KEY"],
base_url="https://api.deepseek.com",
)Two lines of configuration and a standard SDK — that's the entire setup. Anthropic-format codebases point at https://api.deepseek.com/anthropic instead. For the curl smoke test later in this article, export the same variable in your shell (export DEEPSEEK_API_KEY=...) and the command runs verbatim — one source of truth, zero copies drifting out of date. The full quick-start — streaming, thinking mode, multi-turn, JSON output — is one article over at the DeepSeek API guide.
Coding agents take the same key through environment variables, no code at all: our Claude Code walkthrough shows the exact recipe for putting DeepSeek behind your terminal agent.
A pattern that scales: one key per environment, per project. Dev machines get a dev key; production servers get a prod key; the client project that keeps rotating developers gets its own. When something leaks — and over a long enough career, something leaks — you revoke one key and the blast radius is one project, not everything.
Key Security: The Short Version
The rules are short because they're absolute:
- Never hardcode a key in source files — it rides version history forever
- Never ship it client-side — a key in a browser or mobile app is public
- Never commit
.envfiles (add.envto.gitignoretoday, not after the incident) - Never paste it into a chat, a screenshot, or a forum post asking for help — redact the middle, keep the first and last few characters
Where should it live? A password manager for the master copy, an environment variable for everything that consumes it. Deletion and re-creation are instant and unlimited, so treat keys as replaceable by design — the setup you're protecting is the account behind them, not any single string.
If a key leaks, four moves, in order: delete it in the console (instant, kills all requests using it), create a replacement, swap the configuration everywhere it lived, and read the usage page for calls you didn't make. That last step closes the loop — it's how you confirm the exposure cost you nothing.
Rotation schedules, secret managers, and hardware-level policies are good general engineering practice — but they're your call and your tooling, not something the platform mandates. The platform's part of the bargain is simpler: instant deletion, unlimited re-creation, and per-key naming so you can see exactly what died.
Why Isn't My Key Working? The Decision Tree
Almost every "broken key" is one of four errors. Read the status code, follow the branch.
401 — Authentication Fails. The server rejected the credential itself. Three usual suspects: the key is wrong (typo, or you pasted an old deleted one), it was deleted (check the console — deleted keys fail instantly), or the copy operation smuggled in a leading space or trailing newline. That last one is criminally common: copying from a terminal or chat window grabs invisible characters, and one stray newline voids the whole string like a mis-transcribed door code. The fix is always the same — regenerate cleanly, paste into a plain-text editor first, verify no phantom lines, then move it into .env.
402 — Insufficient Balance. Not a key problem. The account's balance is exhausted; the error reference points you to the top-up page. If your key worked yesterday and fails today, this is the prime suspect — check the balance endpoint before touching the key.
429 — Rate Limit Reached. You're sending requests faster than the account's concurrency allows. Two things that don't help: a new key (limits are account-level) and faster retries (they deepen the hole — the official error guide recommends pacing your requests instead). What helps: exponential backoff between attempts, or batch jobs moved to off-peak hours when the same tokens cost half as much. If a burst is genuinely unavoidable, spacing it across a few minutes is usually all it takes.
400 / 422 — Invalid Format / Parameters. Not the key at all. The request body is malformed or a parameter value is out of range; the response message names the field. Fix the payload, leave the credential alone.
The one-minute smoke test when you're unsure which branch you're on:
curl https://api.deepseek.com/models \
-H "Authorization: Bearer ${DEEPSEEK_API_KEY}"A clean model list means key and balance are both alive — whatever's broken lives in your actual request. A 401 means the credential; a 402 means the wallet. Sixty seconds, three-way diagnosis.
Fake Steps in Circulating Tutorials
For the record, because search results are full of confident instructions that describe a platform that doesn't exist:
| The tutorial says | The reality |
|---|---|
| Create an application, wait 1–2 business days for review | No application, no review — the key exists the moment you click |
| Choose a "test key" or "production key" type | No types. One kind of key |
| Test keys are limited to 5 requests/second | Limits are account-level concurrency: 500 (pro) / 2,500 (flash) |
| Download the official Python/Java/Go SDK | No dedicated SDK — reuse the OpenAI SDK with a different base_url |
| Configure the OAuth callback URL | No OAuth. A Bearer header |
| Set the IP whitelist in the console | No such console feature (a proxy you control can do this yourself) |
Every item in the left column appears in tutorials written with the confident tone of documentation. The lesson generalizes: for anything workflow-shaped, check the publish date first and the official console second. Platforms this young change their onboarding faster than content farms update their back catalogs.
FAQ
Where do I get a DeepSeek API key?At platform.deepseek.com — sign in, open API Keys in the left sidebar, click Create new API key. No application or review step exists; the key is generated immediately.
Is a DeepSeek API key free?Creating one is free. Using one is pay-per-token. New accounts usually receive a granted trial balance — the amount varies and is visible on your balance page after signup — and topping up is required once it runs out.
I lost my key. Can I recover it?No. The full string is displayed exactly once at creation because it isn't stored retrievably. Delete the lost key in the console and create a new one — then update your .env.
Why does my new key return 401?Three common causes: the key string is wrong or belongs to a deleted key, or copying it introduced a stray space or newline. Regenerate, paste through a plain-text editor, and retry. If the error is 402 instead, the key is fine — the account needs a top-up.
Can I have more than one key?Yes. Create as many as you need and name each one by project or environment (prod-api, cli-dev). All keys share the account's balance and concurrency limits; naming just makes managing — and, when necessary, revoking — them surgical.
Do keys expire?A key left alone keeps working indefinitely. Deleting it in the console, however, takes effect immediately — any request still carrying a deleted key fails on the spot with 401. Expiry is your decision, not the platform's clock.
How do I check the key works without writing code?One curl line — curl https://api.deepseek.com/models -H "Authorization: Bearer $DEEPSEEK_API_KEY". A JSON model list means everything's healthy; 401 means the credential; 402 means the balance.
From here: top up, create the key, run the curl smoke test — three minutes, done properly once. After that, the key stops being the interesting part. What's worth managing is what it meters: the token bill at the end of the month, which the API guide teaches you to read.