AuthenticationError
deepseek.AuthenticationError: Missing API key: DEEPSEEK_API_KEY
Stack trace
Traceback (most recent call last):
File "script.py", line 12, in <module>
response = client.chat.completions.create(
File "site-packages/deepseek/api.py", line 89, in create
self._validate_api_key()
File "site-packages/deepseek/auth.py", line 34, in _validate_api_key
raise AuthenticationError("Missing API key: DEEPSEEK_API_KEY environment variable not found or empty")
deepseek.AuthenticationError: Missing API key: DEEPSEEK_API_KEY environment variable not found or empty Why it happens
DeepSeek-R1 SDK requires authentication via the DEEPSEEK_API_KEY environment variable to make API requests to the DeepSeek reasoning model endpoints. When this variable is not set, not exported, or contains an empty string, the client initialization fails before any API call is made. This is a security measure to prevent accidental credential exposure in code and enforce proper credential management.
Detection
Check that DEEPSEEK_API_KEY is defined and exported before importing the DeepSeek client. Add `echo $DEEPSEEK_API_KEY` to your terminal to verify the variable is accessible, and confirm your .env file is loaded before running Python code.
Causes & fixes
DEEPSEEK_API_KEY environment variable is not set at all in the shell or process
Export the variable in your shell before running Python: `export DEEPSEEK_API_KEY='sk-xxx'` on Linux/macOS or `set DEEPSEEK_API_KEY=sk-xxx` on Windows, or add it to your .env file and load it with python-dotenv
.env file exists but python-dotenv is not installed or load_dotenv() is not called before importing DeepSeek client
Install python-dotenv (`pip install python-dotenv`) and call `from dotenv import load_dotenv; load_dotenv()` at the start of your script before any DeepSeek imports
DEEPSEEK_API_KEY is set but contains an empty string or only whitespace
Verify the key value is non-empty and correct: add `print(os.environ.get('DEEPSEEK_API_KEY', 'NOT SET'))` to debug, and ensure your .env or shell export includes the full API key without truncation
Running in a containerized environment (Docker, Lambda, cloud function) where environment variables are not passed through
Add the DEEPSEEK_API_KEY to your Docker .env file, use `docker run -e DEEPSEEK_API_KEY='sk-xxx'`, or configure it in your cloud platform's environment variable settings (AWS Lambda, Google Cloud Functions, etc.)
Code: broken vs fixed
from deepseek import DeepSeek
# BROKEN: API key is not set — this will crash immediately
client = DeepSeek() # AuthenticationError: Missing API key: DEEPSEEK_API_KEY
response = client.chat.completions.create(
model="deepseek-reasoner",
messages=[
{"role": "user", "content": "Solve 17 * 23 step by step"}
],
max_completion_tokens=8000
)import os
from dotenv import load_dotenv
from deepseek import DeepSeek
# FIXED: Load environment variables from .env file first
load_dotenv()
# Verify the API key is actually set before creating client
api_key = os.environ.get('DEEPSEEK_API_KEY')
if not api_key:
raise ValueError("DEEPSEEK_API_KEY not found. Set it in your .env file or export it in your shell.")
# Now safe to create client — it will find the API key
client = DeepSeek(api_key=api_key)
response = client.chat.completions.create(
model="deepseek-reasoner",
messages=[
{"role": "user", "content": "Solve 17 * 23 step by step"}
],
max_completion_tokens=8000
)
print(f"Reasoning output: {response.choices[0].message.content}")
print("✓ Authentication successful!")Workaround
If you cannot modify your environment setup immediately, hardcode the API key temporarily in a protected local script (never commit to version control): `client = DeepSeek(api_key='sk-your-actual-key')`. This is a temporary measure only: migrate to environment variables immediately after. Better: use Python's getpass module to prompt for the key at runtime without storing it: `from getpass import getpass; api_key = getpass('Enter DEEPSEEK_API_KEY: '); client = DeepSeek(api_key=api_key)`
Prevention
Adopt a three-layer credential strategy: 1) Always use environment variables via load_dotenv() for development, 2) Never commit .env files to git (add to .gitignore), 3) Use your platform's secrets manager for production (AWS Secrets Manager, Google Secret Manager, HashiCorp Vault). For CI/CD, configure secrets as masked environment variables in GitHub Actions, GitLab CI, or Jenkins, never as hardcoded strings in workflows.