DeepSeek

DeepSeek builds highly capable open-weight models known for strong reasoning and coding performance at competitive price points. Keeptrusts gateways requests to DeepSeek's API through its policy engine, enforcing safety rules, content redaction, and audit logging before traffic reaches the upstream endpoint.

Use this page when

You need the exact command, config, API, or integration details for DeepSeek.
You are wiring automation or AI retrieval and need canonical names, examples, and constraints.
If you want a guided rollout instead of a reference page, use the linked workflow pages in Next steps.

Primary audience

Primary: AI Agents, Technical Engineers
Secondary: Technical Leaders

Prerequisites

A DeepSeek account with an active API key (platform.deepseek.com)
The DEEPSEEK_API_KEY environment variable set in the runtime environment where kt gateway run executes
Keeptrusts CLI installed (kt --version to verify)

Configuration

Add a DeepSeek provider to your policy-config.yaml under the providers list:

policy-config.yaml
pack:
  name: deepseek-providers-1
  version: 1.0.0
  enabled: true
providers:
  targets:
  - id: deepseek-chat
    provider: deepseek:chat:deepseek-chat
    base_url: https://api.deepseek.com/v1
    secret_key_ref:
      env: DEEPSEEK_API_KEY
policies:
  chain:
  - audit-logger
policy:
  audit-logger:
    immutable: true
    retention_days: 365
    log_all_access: true

The provider field uses the format deepseek:chat:<model>. You can also use the short form "deepseek" and specify the model separately:

pack:
  name: deepseek-providers-2
  version: 1.0.0
  enabled: true
providers:
  targets:
  - id: deepseek-default
    provider: deepseek
    model: deepseek-chat
    secret_key_ref:
      env: DEEPSEEK_API_KEY
policies:
  chain:
  - audit-logger
policy:
  audit-logger:
    immutable: true
    retention_days: 365
    log_all_access: true

base_url and secret_key_ref are auto-detected for the deepseek provider. You only need to set them explicitly if you use a custom endpoint or a non-default environment variable name.

Provider Fields

Field	Type	Required	Default	Description
`id`	string	Yes	—	Unique identifier for this provider entry. Used in routing rules and logs.
`provider`	string	Yes	—	Provider identifier. Use `"deepseek"` or `"deepseek:chat:<model>"`.
`model`	string	No	—	Model name. Required when `provider` does not embed the model.
`base_url`	string	No	`https://api.deepseek.com/v1`	Upstream API base URL. Auto-detected for DeepSeek.
`secret_key_ref`	object	No	`DEEPSEEK_API_KEY`	Object reference to the environment variable holding the API key. Auto-detected.
`timeout_seconds`	integer	No	`60`	Maximum time in seconds to wait for a response from the upstream API.
`format`	string	No	`"openai"`	Wire format. DeepSeek uses OpenAI-compatible endpoints.
`description`	string	No	—	Human-readable description shown in the console and logs.
`weight`	integer	No	`100`	Relative weight for load-balancing when multiple providers are configured.
`pricing`	object	No	—	Token pricing metadata for cost tracking. Contains `input_per_1k_tokens` and `output_per_1k_tokens`.
`health_probe`	object	No	—	Health check configuration. Fields: `enabled`, `interval_seconds`, `timeout_seconds`.

Supported Models

Model	Context Window	Use Case
`deepseek-chat`	128K	General-purpose chat, instruction following, analysis
`deepseek-coder`	128K	Code generation, completion, debugging, and review
`deepseek-reasoner`	64K	Multi-step reasoning with chain-of-thought (R1-based)

deepseek-reasoner (DeepSeek R1) uses extended thinking internally. Responses may include a reasoning_content field in addition to the standard content field. Keeptrusts policy rules apply to both fields.

Client Examples

Once kt gateway run is started, point your client SDK at the local gateway address (default http://127.0.0.1:41002).

Python
Node.js
cURL

from openai import OpenAI

client = OpenAI(
    base_url="http://127.0.0.1:41002/v1",
    api_key="not-used",  # auth handled by gateway
)

response = client.chat.completions.create(
    model="deepseek-chat",
    messages=[
        {"role": "system", "content": "You are a helpful assistant."},
        {"role": "user", "content": "Compare the trade-offs between microservices and monolithic architectures."},
    ],
    temperature=0.7,
    max_tokens=1024,
)

print(response.choices[0].message.content)

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "http://127.0.0.1:41002/v1",
  apiKey: "not-used",
});

const response = await client.chat.completions.create({
  model: "deepseek-chat",
  messages: [
    { role: "system", content: "You are a helpful assistant." },
    { role: "user", content: "Compare the trade-offs between microservices and monolithic architectures." },
  ],
  temperature: 0.7,
  max_tokens: 1024,
});

console.log(response.choices[0].message.content);

curl http://127.0.0.1:41002/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "deepseek-chat",
    "messages": [
      {"role": "system", "content": "You are a helpful assistant."},
      {"role": "user", "content": "Compare the trade-offs between microservices and monolithic architectures."}
    ],
    "temperature": 0.7,
    "max_tokens": 1024
  }'

Streaming

DeepSeek supports server-sent events (SSE) streaming through the gateway. Set stream: true in your request:

Python
Node.js
cURL

from openai import OpenAI

client = OpenAI(
    base_url="http://127.0.0.1:41002/v1",
    api_key="not-used",
)

stream = client.chat.completions.create(
    model="deepseek-chat",
    messages=[{"role": "user", "content": "Write a Python function to find all prime numbers up to N using a sieve."}],
    stream=True,
)

for chunk in stream:
    delta = chunk.choices[0].delta.content
    if delta:
        print(delta, end="", flush=True)
print()

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "http://127.0.0.1:41002/v1",
  apiKey: "not-used",
});

const stream = await client.chat.completions.create({
  model: "deepseek-chat",
  messages: [{ role: "user", content: "Write a Python function to find all prime numbers up to N using a sieve." }],
  stream: true,
});

for await (const chunk of stream) {
  const delta = chunk.choices[0]?.delta?.content;
  if (delta) process.stdout.write(delta);
}
console.log();

curl http://127.0.0.1:41002/v1/chat/completions \
  -H "Content-Type: application/json" \
  -N \
  -d '{
    "model": "deepseek-chat",
    "messages": [
      {"role": "user", "content": "Write a Python function to find all prime numbers up to N using a sieve."}
    ],
    "stream": true
  }'

Keeptrusts inspects and enforces policies on streamed content in real time. Redaction and disclaimers apply to individual chunks as they pass through the gateway.

Advanced Configuration

Fallback Providers

Configure a fallback chain so requests automatically route to an alternative provider when DeepSeek Chat is unavailable:

policy-config.yaml
pack:
  name: deepseek-providers-3
  version: 1.0.0
  enabled: true
providers:
  targets:
  - id: deepseek-primary
    provider: deepseek:chat:deepseek-chat
    secret_key_ref:
      env: DEEPSEEK_API_KEY
  - id: deepseek-coder-fallback
    provider: deepseek:chat:deepseek-coder
    secret_key_ref:
      env: DEEPSEEK_API_KEY
policies:
  chain:
  - audit-logger
policy:
  audit-logger:
    immutable: true
    retention_days: 365
    log_all_access: true

Weighted Load Balancing

Distribute traffic across DeepSeek models by weight:

policy-config.yaml
pack:
  name: deepseek-providers-4
  version: 1.0.0
  enabled: true
providers:
  targets:
  - id: deepseek-chat
    provider: deepseek:chat:deepseek-chat
    secret_key_ref:
      env: DEEPSEEK_API_KEY
  - id: deepseek-reasoner
    provider: deepseek:chat:deepseek-reasoner
    secret_key_ref:
      env: DEEPSEEK_API_KEY
policies:
  chain:
  - audit-logger
policy:
  audit-logger:
    immutable: true
    retention_days: 365
    log_all_access: true

Task-Specific Routing

Route coding requests to DeepSeek Coder and reasoning-heavy tasks to DeepSeek Reasoner:

policy-config.yaml
pack:
  name: deepseek-providers-5
  version: 1.0.0
  enabled: true
providers:
  targets:
  - id: deepseek-coder
    provider: deepseek:chat:deepseek-coder
    secret_key_ref:
      env: DEEPSEEK_API_KEY
  - id: deepseek-reasoner
    provider: deepseek:chat:deepseek-reasoner
    secret_key_ref:
      env: DEEPSEEK_API_KEY
  - id: deepseek-general
    provider: deepseek:chat:deepseek-chat
    secret_key_ref:
      env: DEEPSEEK_API_KEY
policies:
  chain:
  - audit-logger
policy:
  audit-logger:
    immutable: true
    retention_days: 365
    log_all_access: true

Health Probes

Enable active health monitoring to automatically remove unhealthy providers from the rotation:

pack:
  name: deepseek-providers-6
  version: 1.0.0
  enabled: true
providers:
  targets:
  - id: deepseek-chat
    provider: deepseek:chat:deepseek-chat
    secret_key_ref:
      env: DEEPSEEK_API_KEY
policies:
  chain:
  - audit-logger
policy:
  audit-logger:
    immutable: true
    retention_days: 365
    log_all_access: true

Best Practices

Use DeepSeek Reasoner for complex tasks — deepseek-reasoner excels at multi-step logic, math, and analysis. Use it when chain-of-thought reasoning is valuable, but expect higher latency.
Route code tasks to DeepSeek Coder — deepseek-coder is specifically tuned for programming and outperforms the general chat model on code benchmarks.
Set generous timeouts — DeepSeek Reasoner in particular can take 30–60 seconds for complex reasoning chains. Set timeout_seconds to at least 120 for reasoner workloads.
Enable health probes in production — DeepSeek's API can experience high load during peak hours. Health probes ensure the gateway auto-routes around degraded endpoints.
Monitor reasoning_content in policies — When using deepseek-reasoner, Keeptrusts policies apply to both the content and reasoning_content fields. Ensure your redaction and safety rules account for extended thinking output.
Set pricing metadata — DeepSeek offers highly competitive pricing. Populate the pricing field to enable accurate cost tracking and comparison against other providers in the Keeptrusts console.

For AI systems

Canonical terms: Keeptrusts gateway, DeepSeek, DeepSeek-V3, DeepSeek-R1, deepseek-reasoner, reasoning_content, provider target, policy-config.yaml, provider: "deepseek".
Config field names: provider, model, base_url: "https://api.deepseek.com", secret_key_ref.env: "DEEPSEEK_API_KEY", format: "openai", pricing.
Key behavior: DeepSeek-R1 (reasoner) outputs both content and reasoning_content — Keeptrusts policies apply to both fields.
Best next pages: OpenAI integration, Together AI integration, Policy configuration.

For engineers

Prerequisites: DeepSeek API key (DEEPSEEK_API_KEY env var from platform.deepseek.com), kt CLI installed.
Start command: kt gateway run --listen 0.0.0.0:41002 --policy-config policy-config.yaml.
Validate: curl http://localhost:8080/v1/chat/completions -H 'Content-Type: application/json' -d '{"model":"deepseek-chat","messages":[{"role":"user","content":"hello"}]}'.
When using deepseek-reasoner, policies apply to both content and reasoning_content fields — ensure redaction and safety rules account for extended thinking output.
DeepSeek uses OpenAI-compatible API — standard OpenAI SDKs work without modification.

For leaders

DeepSeek offers highly competitive pricing (significantly below GPT-4o) — populate pricing fields for accurate cost comparison across providers.
DeepSeek-R1's reasoning capabilities rival frontier models at a fraction of the cost, making it attractive for reasoning-heavy workloads.
Chinese-origin provider — evaluate data handling policies and regulatory requirements for your jurisdiction before production deployment.
Extended thinking output (reasoning_content) increases token usage — monitor actual costs vs estimates in the Keeptrusts console.

Next steps

OpenAI integration — compare with GPT-4o for quality/cost tradeoffs
Together AI integration — alternative hosting for open models including DeepSeek
Provider routing strategies — cost-optimized routing between providers
Policy configuration — safety and PII policy reference
Quickstart — install kt and run your first gateway

Use this page when​

Primary audience​

Prerequisites​

Configuration​

Provider Fields​

Supported Models​

Client Examples​

Streaming​

Advanced Configuration​

Fallback Providers​

Weighted Load Balancing​

Task-Specific Routing​

Health Probes​

Best Practices​

For AI systems​

For engineers​

For leaders​

Next steps​