Connect DeepSeek
NexKit does not sell tokens. You bring your own DeepSeek key, it is encrypted before it is stored, and DeepSeek bills you directly on your own account.
Before you start
- A NexKit account.
- A DeepSeek account. Get an API key.
Create a NexKit API key
Sign in, open the dashboard, and create a key on the API Keys step. It looks like nk_live_….
It is shown exactly once. The gateway stores a SHA-256 hash and a short display prefix, so it cannot be shown again and cannot be recovered. Copy it before you leave the page; if you lose it, revoke it and create another.
Connect your DeepSeek key
Open Providers, choose DeepSeek, and paste the key. Starts with sk-
It is validated when you attach it, encrypted with AES-256-GCM at rest, and decrypted only at the moment a request is made. There is no endpoint that can read it back — you will only ever see the last four characters.
Model ids
These are the DeepSeek models NexKit can route to:
deepseek-v4-flashrecommendeddeepseek-v4-pro
deepseek-chat and deepseek-reasoner were disabled by DeepSeek upstream on 2026-07-24. NexKit carries them as retired: they never list and never resolve, so a config naming one fails with a 404 that tells you what to use instead.
The live answer for your own key is always one request away:
curl https://api.nexkit.uk/v1/models -H "Authorization: Bearer nk_live_YOUR_KEY"Check it works
curl https://api.nexkit.uk/v1/chat/completions \
-H "Authorization: Bearer nk_live_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"deepseek-v4-flash","messages":[{"role":"user","content":"Say NEXKIT"}]}'What success looks like
A normal OpenAI-shaped chat completion, with the model's answer in choices[0].message.content. That proves the whole chain: your NexKit key, your DeepSeek credential, and the model behind it.
Once a request lands, it is counted in Usage and journalled in Logs — as counts, timings and a request id. Neither can show you the text, because the text is never stored.
Next
Common errors
| What you see | What it means | What to do |
|---|---|---|
401 · invalid_api_key | The NexKit key is wrong, revoked, or not being sent. | Check the key is the one you copied at mint time — it is shown once and cannot be shown again. If you lost it, revoke it and create another. |
412 · byok_missing | The key is valid, but this account has no credential attached for the provider that owns the model you named. | Connect DeepSeek or Qwen on the Providers screen, then try again. |
404 · model_not_found | The model id does not exist, or is retired. `deepseek-chat` and `deepseek-reasoner` were disabled upstream and never resolve. | The error names what is available. Or run the models check above to list exactly what your key can reach. |
200, but the model list is empty | A valid key with no provider credential attached. This is a correct answer, not a fault. | Attach a provider credential. A key alone reaches nothing — NexKit never fronts the tokens. |
404 on every request, path looks doubled | `ANTHROPIC_BASE_URL` was set with a `/v1` suffix. Claude Code appends its own path, so the request goes to `/v1/v1/messages`. | Set the base URL with no path at all. |
Codex ignores the key, or asks you to log in | `wire_api` or `requires_openai_auth` is missing from the provider block. | Both lines are in the config above. Without them Codex uses the wrong surface, or expects an OpenAI login instead of your key. |
What NexKit stores, and what it does not
- Your `nk_live_*` key is shown exactly once, at the moment it is created. The gateway keeps a SHA-256 hash and a 12-character display prefix, so it cannot be shown again and cannot be recovered — a lost key is revoked and replaced.
- Your provider key is encrypted with AES-256-GCM before it is stored and is decrypted only at the moment a request is made. There is no endpoint anywhere that can read one back. You will only ever see the last four characters.
- No prompt and no output is ever stored. Requests are recorded as counts, timings and identifiers only — that is what Usage and Logs are built from, and it is why neither can show you the text of a request.
- Your provider bills you directly, on your own account. NexKit never fronts the tokens, so there is no NexKit invoice and no card on file.