Quickstart
One API key, your own provider credential, and any coding client that speaks OpenAI or Anthropic. Four steps, about five minutes.
Before you start
- A NexKit account. Email and a password — no card.
- A DeepSeek or Alibaba Model Studio account with an API key of your own. That provider bills you directly.
- Codex or Claude Code installed, or just
curlto prove the chain first.
Create a NexKit API key
Sign in, open the dashboard, and create a key on the API Keys step. It looks like nk_live_….
It is shown exactly once. The gateway stores a SHA-256 hash and a short display prefix, so it cannot be shown again and cannot be recovered. Copy it before you leave the page; if you lose it, revoke it and create another.
Connect a provider
A NexKit key on its own reaches nothing. NexKit does not sell tokens — you bring your own provider credential, and that provider bills you directly.
- DeepSeek — Starts with sk- Get a key
- Alibaba Model Studio (Qwen) — Starts with sk-. Regions are separate accounts — use the key for your region. Get a key
Paste it on the Providers step of the dashboard. It is encrypted before it is stored and you will only ever see the last four characters.
Point your client at NexKit
Pick the client you use. Both pages carry the exact config, already filled in with a live model id.
- Codex — talks
/v1/responses - Claude Code — talks
/v1/messages
Or check the whole chain with no client installed. Replace the key with the one you just created:
curl https://api.nexkit.uk/v1/chat/completions \
-H "Authorization: Bearer nk_live_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"deepseek-v4-flash","messages":[{"role":"user","content":"Say NEXKIT"}]}'Not sure which model ids your key can reach? Ask it:
curl https://api.nexkit.uk/v1/models -H "Authorization: Bearer nk_live_YOUR_KEY"Send your first request
Run your client. If it answers, the whole chain works: your NexKit key, your provider credential, and the model behind it.
What success looks like
The model replies through your client exactly as it would natively. Nothing about NexKit appears in the answer — that is the point.
Once a request lands, it is counted in Usage and journalled in Logs — as counts, timings and a request id. Neither can show you the text, because the text is never stored.
Common errors
| What you see | What it means | What to do |
|---|---|---|
401 · invalid_api_key | The NexKit key is wrong, revoked, or not being sent. | Check the key is the one you copied at mint time — it is shown once and cannot be shown again. If you lost it, revoke it and create another. |
412 · byok_missing | The key is valid, but this account has no credential attached for the provider that owns the model you named. | Connect DeepSeek or Qwen on the Providers screen, then try again. |
404 · model_not_found | The model id does not exist, or is retired. `deepseek-chat` and `deepseek-reasoner` were disabled upstream and never resolve. | The error names what is available. Or run the models check above to list exactly what your key can reach. |
200, but the model list is empty | A valid key with no provider credential attached. This is a correct answer, not a fault. | Attach a provider credential. A key alone reaches nothing — NexKit never fronts the tokens. |
404 on every request, path looks doubled | `ANTHROPIC_BASE_URL` was set with a `/v1` suffix. Claude Code appends its own path, so the request goes to `/v1/v1/messages`. | Set the base URL with no path at all. |
Codex ignores the key, or asks you to log in | `wire_api` or `requires_openai_auth` is missing from the provider block. | Both lines are in the config above. Without them Codex uses the wrong surface, or expects an OpenAI login instead of your key. |
What NexKit stores, and what it does not
- Your `nk_live_*` key is shown exactly once, at the moment it is created. The gateway keeps a SHA-256 hash and a 12-character display prefix, so it cannot be shown again and cannot be recovered — a lost key is revoked and replaced.
- Your provider key is encrypted with AES-256-GCM before it is stored and is decrypted only at the moment a request is made. There is no endpoint anywhere that can read one back. You will only ever see the last four characters.
- No prompt and no output is ever stored. Requests are recorded as counts, timings and identifiers only — that is what Usage and Logs are built from, and it is why neither can show you the text of a request.
- Your provider bills you directly, on your own account. NexKit never fronts the tokens, so there is no NexKit invoice and no card on file.