DeepSeek API and Dome

1. 01

   Add the connections

   The provider id is deepseek. Dome uses https://api.deepseek.com/v1 and DeepSeek's own model ids; Together uses its own.

   $ dome models add deepseek-direct \
     --provider deepseek \
     --model deepseek-v4-pro \
     --api-key "$DEEPSEEK_API_KEY" \
     --gateway prod-gateway
    
   $ dome models add deepseek-together \
     --provider together \
     --model deepseek-ai/DeepSeek-V4-Pro-0813 \
     --api-key "$TOGETHER_API_KEY" \
     --attributes '{"residency":"us"}' \
     --gateway prod-gateway

2. 02

   Pool them

   DeepSeek goes first and Together second. Agents call deepseek-v4-pro, the pool.

   $ dome models pool create deepseek-v4-pro \
     --failover-max all --gateway prod-gateway
    
   $ dome models pool member add deepseek-v4-pro deepseek-direct --priority 0
   $ dome models pool member add deepseek-v4-pro deepseek-together --priority 1

3. 03

   Point your agent at the Gateway

   Swap the base URL for the Gateway and DeepSeek's key for the agent's. OpenAI-compatible code runs as before.

   from openai import OpenAI
    
   client = OpenAI(base_url=f"{GATEWAY_URL}/v1", api_key=DOME_AGENT_KEY)
   client.chat.completions.create(
       model="deepseek-v4-pro",
       messages=[{"role": "user", "content": "Refactor this function and explain the change."}],
   )

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about DeepSeek itself, see DeepSeek's documentation.

forbid (principal, action == Dome::Action::"llm:invoke", resource is Dome::LLMModel)
when {
  principal has act_as &&
  principal.act_as.groups.contains("regulated-data")
}
unless { resource has residency && resource.residency == "us" };