The DeepSeek Harness API key: one key, not a platform key
The deepseek harness api key question has a short answer: it is one Modellix key from the Modellix console—not from DeepSeek, OpenAI, Anthropic, or any other model provider’s platform. The first-party integration doc is explicit about this: the prerequisite is “a Modellix API key—not a vendor platform key.”
That last clause is where most setups go wrong. If you already hold a DeepSeek platform key (sk-… from platform.deepseek.com) or an OpenAI key, it is natural to paste it into the first “API key” field the harness shows you. But the harness distinguishes providers by credential, not by field name: a key issued by another platform is a bearer credential for that platform’s billing, and the Modellix provider will reject it. The key you want is the one created in the console’s API key page, which bills to your Modellix account and authenticates every Modellix host the harness talks to.
If you came here from the configuration-only path—the DeepSeek Harness custom model guide covers swapping the model source without a plugin—this key ownership question is the same one you hit there. It is also the same one the plugin path hits, because both paths hand the harness the same single key. We operate Modellix and maintain its Harness integration, so we have a commercial interest in this working for you; everything below was verified against docs.modellix.ai and the official DeepSeek Harness providers guide on September 1, 2026.
Two key sources, two behaviors
There are two ways to give the harness a Modellix key, and they behave differently in every way that matters later—where the key is stored, what the UI shows you, and how you change it:
| Source | How you add it | Where it is stored | What the UI shows | How to change it |
|---|---|---|---|---|
| Saved key (Web UI / form) | Enter the key in Modellix settings or the custom provider form | Harness Credential service, written to $DSH_HOME/.credentials.yaml |
Only a redacted descriptor after saving, never the key itself | Replace or remove it in the settings page |
| Environment variable | MODELLIX_API_KEY in the harness launch environment |
Outside the harness, in your shell or secret manager | Read-only—the field is not editable in the UI | Change the variable and restart the harness |
The saved-key path is the one the Modellix plugin for DeepSeek Harness uses in its “Connect Modellix” dialog: the key is write-only, and the page shows a redacted descriptor once it is saved. The environment path is the supported pattern for scripts, containers, and anyone who keeps secrets in a manager: MODELLIX_API_KEY in the launch environment, which the plugin docs describe as “read-only in the UI and require a Harness restart after you replace the value.”
Most of the “my key stopped working” reports in this area trace back to one of the two behaviors above: someone rotated the key in the console but the harness still holds the old saved key, or someone edited the environment variable of a running process and expected it to pick up the new value. Neither updates live. The deepseek harness environment variable MODELLIX_API_KEY is resolved at request time from your launch environment, not re-read from a config file.
The two sources side by side: a saved key is stored in the Credential service and shown redacted; an environment key stays outside the harness and needs a restart to change.
Where the key lives: the Credential service, not settings.yaml
The storage detail that surprises people: your key is not in the deepseek harness provider configuration file, settings.yaml. The official providers guide states it plainly:
Keys are write-only. The page receives a redacted descriptor after saving, never the literal secret. The key is stored in
$DSH_HOME/.credentials.yaml, while settings retain only its credential reference.
That is the pattern to remember: settings.yaml holds a reference, the Credential service holds the value. Most deepseek harness credentials questions are really storage questions, and the answer is always the same split. The Modellix integration doc says it about the config-file route: “Credentials stay out of this file—apiKeyEnv is a reference resolved per request.” When you declare the Modellix provider directly in $DSH_HOME/settings.yaml, the file looks like this:
1 | llm-pi-ai: |
There is no key literal anywhere in that file. apiKeyEnv names the environment variable whose value is resolved when a request is made—so the plaintext lives either in your environment or in the Credential service’s $DSH_HOME/.credentials.yaml, never in the configuration file itself.
Why does the storage location matter in practice? Two reasons. First, if you back up, sync, or commit $DSH_HOME anywhere, the credential document is what you must protect—a GitHub discussion on the harness repository, Storage of API Key #3503, notes the document is plaintext YAML protected only by file permissions (0600 under a 0700 directory) and by keeping the path out of the model’s context. Second, when you are told to “check $DSH_HOME/.credentials.yaml“, it must exist and contain a modellix entry—if it does not, the key was never saved through the form, which usually means the harness is looking for MODELLIX_API_KEY instead.
One key, three hosts
A single Modellix key authenticates every host the harness can reach through Modellix. There is no separate “search key,” “image key,” or “model key” to create:
| Host | What it serves | Where the key is checked |
|---|---|---|
https://llm.modellix.ai/v1 |
LLM model calls (OpenAI-compatible Chat Completions) | Every request to the LLM gateway |
https://api.modellix.ai |
Design: image, video, and audio generation tasks | Every media task submission |
https://tool.modellix.ai |
Web Search and Web Fetch tools | Every web tool call |
The same key that unlocks the model selector also covers media generation and the web tools, which is why the plugin’s setup has exactly one credential field. The Modellix Tools overview documents the api.modellix.ai and tool.modellix.ai hosts; the LLM gateway’s endpoint, protocol, and models live in the LLM overview. One boundary from the same docs: the Modellix LLM is a text gateway—use text-only prompts and do not attach images to model requests; media goes to the Design host, not the LLM host.
One consequence worth knowing: because all three hosts authenticate with the same key, rotating that key in the console affects every Modellix feature in the harness at once. There is no way to keep media working while the LLM host rejects an old key—they share one credential.
The one-key-three-hosts model: a single Modellix key authenticates the LLM gateway, the Design API, and the Web tools.
The web-tool host is covered in detail by the web search and fetch guide in this series, including how the native web_search and web_fetch tools authenticate through it.
Which key goes where: the new-profile popup trap
A fresh profile does not present one dialog—it presents two, and they ask for different keys. This is the single most common “which key does what” confusion in the plugin’s local-usage notes:
- First, the harness’s own DeepSeek initialization popup appears. It wants a DeepSeek key, because the harness ships with DeepSeek’s own provider as its default model source.
- Only after that, the plugin’s “Connect Modellix” dialog appears. It wants a Modellix key.
People see the first popup, decide they do not want to use DeepSeek’s platform, and either paste a Modellix key into it (which the DeepSeek provider will reject) or close everything and conclude the plugin failed to load. Neither is the case: complete or dismiss the DeepSeek initialization step first, and the plugin’s dialog takes its turn. If you skipped the plugin dialog, the plugin stays unavailable and asks again the next time you use an enabled Modellix capability.
The one-line rule that resolves every popup and form in this article: the DeepSeek provider accepts a DeepSeek platform key; the Modellix provider accepts a Modellix console key. Filling a DeepSeek, OpenAI, or other platform key into the Modellix provider is the most common misconfiguration in this setup, and it fails with authentication errors that look like network problems.
Changing, replacing, and removing a key
How you change a key depends on which source it came from, matching the table above:
- Saved key: open the Modellix settings section and use the replace action. The page shows a redacted descriptor plus the source (saved key vs
MODELLIX_API_KEY); replace or remove the writable local credential there. - Environment-sourced key: edit the variable in your shell profile or secret manager, then restart the harness. The UI will not let you type over an environment credential.
- Invalid key: only an HTTP
401marks a credential invalid. A402means check account status and balance in the console,429means wait for the rate-limit window, and timeouts mean restore connectivity—do not assume the key is bad when the failure is something else. - Missing credential: a
MISSING_CREDENTIALerror means the provider has no stored key and no resolvableapiKeyEnv—store the key through the settings page or provide the referenced environment variable, per the integration doc’s troubleshooting table.
Two traps around “where the key is stored” belong to this section. First, the modellix-cli command-line tool keeps its own Keychain, and it is a separate store from the Harness Credential service: the plugin does not install or invoke modellix-cli at runtime, and it does not auto-read your CLI login state. Logging in with the CLI does not configure the harness, and there is no “login once, works everywhere” shortcut. Second, if you are reinstalling or updating the plugin, remove the writable key in settings first (or revoke the environment credential), then remove the plugin and restart the profile—the plugin add guide walks through the dsh plugin add install-and-restart sequence for the dsh api key setup. For failures that survive all of the above, the companion error recovery article in this batch goes deeper into each error state.
Key hygiene: places a key should never end up
Once you know where a key is supposed to live, the inverse is worth stating explicitly. A real Modellix key should never appear in:
- a repository (including a private one—credentials in git history are permanent),
- a command-line argument (visible in process listings and shell history),
- a log file or debug output,
- a screenshot or screen recording,
- an HTTP archive (HAR) capture,
- or a test snapshot.
This is the plugin’s own guidance, paraphrased: never put a real key in a repository, command argument, log, screenshot, HAR, recording, or test snapshot. The supported pattern is MODELLIX_API_KEY in your shell profile or secret manager, or the saved-key path with its redacted descriptor.
The “why” has a concrete edge case for Harness users: the credential document in $DSH_HOME/.credentials.yaml is readable by any process running as your user—including the harness’s own tool subprocesses. The repository’s security discussion #3503 calls file permissions “discretion, not a boundary” and proposes at-rest encryption or an OS keychain as the stronger answer. Until that lands, treat the file as a secret: do not sync $DSH_HOME to cloud storage, do not commit it, and do not paste its contents into a support thread. If you suspect a key leaked through any of the channels above, rotate it in the console—the old value stops working immediately for all three hosts.
Is there a “free” API key for the harness?
The short version: there is no automatic free tier for Modellix right now, and the deepseek harness api key free searches deserve a direct answer rather than a workaround. Modellix is pay-as-you-go: you add credit to your account and each request bills per call, with transparent per-call pricing shown in the console. The $1 signup credit that previously came with new accounts was removed on August 19, 2026, and there is currently no automatic free tier. Trial credit requires an email request to the team, which is how the evaluation path works today.
Two adjacent points so the answer does not mislead. First, a free DeepSeek account’s API key is not a free Modellix key—it authenticates DeepSeek’s own platform, which bills its own usage. Second, “free” in the community sense of the open-source harness itself is unchanged: DeepSeek Harness is open source and free to run locally; what costs money is the model usage behind the key, on whichever provider you configure. This article is about key ownership, not about comparing providers—that selection decision is a separate topic.
Where this fits: what to do now
You now know the three facts that matter: the key is a Modellix console key, not a vendor platform key; it lives either in the Credential service’s $DSH_HOME/.credentials.yaml or in MODELLIX_API_KEY, never in settings.yaml; and changing it is either a settings-page replace or an environment edit plus restart. The rest of the series covers the surrounding decisions: the custom model guide for the configuration-only path, the plugin article for bundle mechanics, and the pillar DeepSeek Harness article that ties the cluster together. The companion piece on token usage and metering, being published in the same batch, covers what each request actually costs on the LLM host.
Your next three steps: create a key in the Modellix console, add it through the saved-key path or MODELLIX_API_KEY, and confirm a model call succeeds. When you later rotate it, come back to the table in this article—the source determines the change procedure.
DeepSeek Harness Integration Docs
Read the full Modellix–DeepSeek Harness reference: custom provider fields, apiKeyEnv semantics, and the credential troubleshooting table.
View DocsCreate Your Modellix API Key
Log in to the Modellix console to create your API key and check live per-call pricing before your first harness run.
LoginKey sources, storage paths, and behaviors reflect Modellix public documentation and the official DeepSeek Harness repository as of September 1, 2026, and change as both projects evolve; confirm current rates and fields in the Modellix console before committing. Access 210+ image and video models, plus LLM and web tools, through a single API key at modellix.ai.
