Claude Code with NexKit
Claude Code talks to NexKit over /v1/messages — the Anthropic Messages surface, translated to your provider. This is the configuration the P8 smoke test runs against a real provider.
Before you start
- Claude Code installed and on your
PATH. - A NexKit API key.
- A connected provider — DeepSeek or Qwen.
Create a NexKit API key
Sign in, open the dashboard, and create a key on the API Keys step. It looks like nk_live_….
It is shown exactly once. The gateway stores a SHA-256 hash and a short display prefix, so it cannot be shown again and cannot be recovered. Copy it before you leave the page; if you lose it, revoke it and create another.
Connect a provider
A NexKit key on its own reaches nothing. NexKit does not sell tokens — you bring your own provider credential, and that provider bills you directly.
- DeepSeek — Starts with sk- Get a key
- Alibaba Model Studio (Qwen) — Starts with sk-. Regions are separate accounts — use the key for your region. Get a key
Paste it on the Providers step of the dashboard. It is encrypted before it is stored and you will only ever see the last four characters.
Configure Claude Code
Choose the provider you connected — the model id changes, nothing else does.
Set these in your shell, then start Claude Code from the same shell:
export ANTHROPIC_BASE_URL="https://api.nexkit.uk"
export ANTHROPIC_API_KEY="nk_live_YOUR_KEY"
export ANTHROPIC_MODEL="deepseek-v4-flash"ANTHROPIC_BASE_URL has no /v1 on the end. Claude Code appends its own path. Adding one produces /v1/v1/messages, a 404 that reads like the gateway is down — this is the most common mistake on this path.
Any of deepseek-v4-flash, deepseek-v4-pro works as ANTHROPIC_MODEL.
Test it
claude -p --model deepseek-v4-flash "Reply with exactly this word and nothing else: NEXKIT"What success looks like
Claude Code prints NEXKIT and exits 0. That is a full round trip: Claude Code → /v1/messages → the translation → your provider key → the model.
Once a request lands, it is counted in Usage and journalled in Logs — as counts, timings and a request id. Neither can show you the text, because the text is never stored.
Common errors
| What you see | What it means | What to do |
|---|---|---|
401 · invalid_api_key | The NexKit key is wrong, revoked, or not being sent. | Check the key is the one you copied at mint time — it is shown once and cannot be shown again. If you lost it, revoke it and create another. |
412 · byok_missing | The key is valid, but this account has no credential attached for the provider that owns the model you named. | Connect DeepSeek or Qwen on the Providers screen, then try again. |
404 · model_not_found | The model id does not exist, or is retired. `deepseek-chat` and `deepseek-reasoner` were disabled upstream and never resolve. | The error names what is available. Or run the models check above to list exactly what your key can reach. |
200, but the model list is empty | A valid key with no provider credential attached. This is a correct answer, not a fault. | Attach a provider credential. A key alone reaches nothing — NexKit never fronts the tokens. |
404 on every request, path looks doubled | `ANTHROPIC_BASE_URL` was set with a `/v1` suffix. Claude Code appends its own path, so the request goes to `/v1/v1/messages`. | Set the base URL with no path at all. |
Codex ignores the key, or asks you to log in | `wire_api` or `requires_openai_auth` is missing from the provider block. | Both lines are in the config above. Without them Codex uses the wrong surface, or expects an OpenAI login instead of your key. |
What NexKit stores, and what it does not
- Your `nk_live_*` key is shown exactly once, at the moment it is created. The gateway keeps a SHA-256 hash and a 12-character display prefix, so it cannot be shown again and cannot be recovered — a lost key is revoked and replaced.
- Your provider key is encrypted with AES-256-GCM before it is stored and is decrypted only at the moment a request is made. There is no endpoint anywhere that can read one back. You will only ever see the last four characters.
- No prompt and no output is ever stored. Requests are recorded as counts, timings and identifiers only — that is what Usage and Logs are built from, and it is why neither can show you the text of a request.
- Your provider bills you directly, on your own account. NexKit never fronts the tokens, so there is no NexKit invoice and no card on file.