DeepSeek BYOK

Bring your DeepSeek key. Keep the fallback.

Put one or more DeepSeek API keys on your Tekiz host, point Codex or any OpenAI-compatible client at port 8790, and keep failures isolated to the key that failed.

Create a DeepSeek key Self-host Tekiz Configure Codex

Customer-controlled keys

Your DeepSeek key stays in the router process on your machine or server. Agents receive only the Tekiz endpoint and optional client key.

Credential-level failover

A 401, 402, 403, or 429 cools the affected credential fingerprint. Other DeepSeek keys and eligible provider routes remain available.

One agent configuration

Use deepseek/deepseek-v4-flash directly or let Balanced and Frontier profiles choose among authorized routes.

From key to first request

  1. Create an API key in the DeepSeek platform. DeepSeek currently documents API-key access for this integration.
  2. Set DEEPSEEK_API_KEY on the machine running Sage Router, then start the router on port 8790.
  3. Point your client at http://127.0.0.1:8790/v1. The provider key does not need to be copied into Codex or another agent.

60-second local setup

export DEEPSEEK_API_KEY=your_deepseek_key
git clone https://github.com/earlvanze/sage-router.git
cd sage-router
python3 router.py --port 8790

curl http://127.0.0.1:8790/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "deepseek/deepseek-v4-flash",
    "messages": [{"role": "user", "content": "Reply with DEEPSEEK_OK"}]
  }'

Use a key pool

Teams can configure an ordered pool for separate accounts, quota domains, or key rotation. A failed key does not disable DeepSeek provider-wide. 

export SAGE_ROUTER_DEEPSEEK_API_KEYS='["team-a-key","team-b-key"]'
export SAGE_ROUTER_CREDENTIAL_STRATEGY=failover

Supported strategies are failover, round-robin, lru, and random.

Use it from Codex

[model_providers.sage_router]
name = "Tekiz"
base_url = "http://127.0.0.1:8790/v1"
env_key = "SAGE_ROUTER_API_KEY"
wire_api = "responses"

[profiles.sage_deepseek]
model_provider = "sage_router"
model = "deepseek/deepseek-v4-flash"

DeepSeek currently documents V4 Flash as its Codex-compatible model. Use codex --profile sage_deepseek.

Hosted and self-hosted are separate custody paths

A generated sk_sage_* key uses hosted capacity enabled for your Tekiz account. A DEEPSEEK_API_KEY environment variable belongs on your self-hosted router; setting it on a client does not upload it to the hosted service. See the integration matrix for BYOK, BYOS, local, and managed-access boundaries.