DeepSeek BYOK

Bring your DeepSeek key. Keep the fallback.

Put one or more DeepSeek API keys on your TEKIZ.AI host, point Codex or any OpenAI-compatible client at port 8790, and keep failures isolated to the key that failed.

Create a DeepSeek key Configure Codex

Customer-controlled keys

Your DeepSeek key stays in the router process on your machine or server. Agents receive only the TEKIZ.AI endpoint and optional client key.

Credential-level failover

A 401, 402, 403, or 429 cools the affected credential fingerprint. Other DeepSeek keys and eligible provider routes remain available.

One agent configuration

Use deepseek/deepseek-v4-flash directly or let Balanced and Frontier profiles choose among authorized routes.

From key to first request

  1. Create an API key in the DeepSeek platform. DeepSeek currently documents API-key access for this integration.
  2. Set DEEPSEEK_API_KEY on the machine running TEKIZ.AI Router, then start the router on port 8790.
  3. Point your client at http://127.0.0.1:8790/v1. The provider key does not need to be copied into Codex or another agent.

Set up local setup

export DEEPSEEK_API_KEY=your_deepseek_key
git clone https://github.com/tekizai/tekizai-router.git
cd tekizai-router
python3 router.py --port 8790

curl http://127.0.0.1:8790/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "deepseek/deepseek-v4-flash",
    "messages": [{"role": "user", "content": "Reply with DEEPSEEK_OK"}]
  }'

Use a key pool

Teams can configure an ordered pool for separate accounts, quota domains, or key rotation. A failed key does not disable DeepSeek provider-wide. 

export TEKIZAI_ROUTER_DEEPSEEK_API_KEYS='["team-a-key","team-b-key"]'
export TEKIZAI_ROUTER_CREDENTIAL_STRATEGY=failover

Supported strategies are failover, round-robin, lru, and random.

Use it from Codex

export TEKIZAI_API_KEY=local
mkdir -p ~/.codex
cat >> ~/.codex/config.toml <<'TOML'
[model_providers.tekizai-local]
name = "TEKIZ.AI"
base_url = "http://127.0.0.1:8790/v1"
env_key = "TEKIZAI_API_KEY"
wire_api = "responses"
TOML

# ~/.codex/tekizai-deepseek.config.toml
cat > ~/.codex/tekizai-deepseek.config.toml <<'TOML'
model_provider = "tekizai-local"
model = "deepseek/deepseek-v4-flash"
TOML

codex --profile tekizai-deepseek

DeepSeek currently documents V4 Flash as its Codex-compatible model. Plain codex keeps using ChatGPT. The TEKIZ.AI route is selected only with codex --profile tekizai-deepseek.

Hosted and self-hosted are separate custody paths

A generated sk_tekiz_* key uses hosted capacity enabled for your TEKIZ.AI account. A DEEPSEEK_API_KEY environment variable belongs on your self-hosted router; setting it on a client does not upload it to the hosted service. See the integration matrix for BYOK, BYOS, local, and managed-access boundaries.

Stay within your approved services

If your company approves only DeepSeek, keep that boundary. TEKIZ.AI can reduce token burn while making better use of existing subscriptions and account billing.