Authentication

Configure the required session cookie and authorization header for requests to DeepSeek Web with `@orcushq/deepseek`.

@orcushq/deepseek communicates with the DeepSeek Web endpoint. It does not require an Orcus API key or a DeepSeek API key. Every request requires two values from a valid signed-in DeepSeek Web session: the ds_session_id cookie value and the authorization header value.

The SDK does not sign in, discover browser credentials, refresh expired sessions, or read environment variables automatically. Your application must obtain the credentials, load any environment variables, and pass the values to DeepSeekWeb.

Required credentials

  • `dsSessionId` - Required. The value of the ds_session_id cookie from your DeepSeek Web session. Pass only the cookie value, not the complete Cookie header.
  • `authorization` - Required. The complete authorization value associated with your session. If the header value includes a prefix such as Bearer, pass the prefix and token together. The SDK sends this value as the HTTP Authorization header.

Both values must be present and non-empty. The SDK validates them locally and throws DeepSeekAuthenticationError if either value is missing or blank. This local check does not prove that the session is still valid or accepted by DeepSeek Web.

Configure credentials

Store both values in server-side environment variables or a secrets manager. The variable names below are examples chosen by your application; the SDK does not read them automatically. Keep the .env file out of version control.

.env
DEEPSEEK_SESSION_ID="your_ds_session_id_value"DEEPSEEK_AUTHORIZATION="your_authorization_header_value"

Initialize the client

src/deepseek.ts
import 'dotenv/config'import { DeepSeekWeb } from '@orcushq/deepseek' const dsSessionId = process.env.DEEPSEEK_SESSION_IDconst authorization = process.env.DEEPSEEK_AUTHORIZATION if (!dsSessionId?.trim() || !authorization?.trim()) {  throw new Error(    'DEEPSEEK_SESSION_ID and DEEPSEEK_AUTHORIZATION are required',  )} const model = new DeepSeekWeb({  model: 'deepseek-v3',  dsSessionId,  authorization,}) const response = await model.invoke('Say hello')console.log(response.content)

Credential validation is not session verification

Successful local validation only means both values are present. It does not guarantee that the upstream service accepts the session or that the account can access every model or feature.