Fix "Failed to fetch available models" 401 error in DeepSeek Harness

A 401 on "Failed to fetch available models" in DeepSeek Harness is an authentication failure: model discovery calls the OpenAI-compatible GET /models endpoint, and an invalid/expired API key or a base URL pointing outside the official endpoint gets rejected with 401. The rule underneath is that the base URL, key and model name must all match the same provider. Fix it in four steps: replace the key, fix the base URL, check the proxy, verify.

DeepSeek Harness 401 error text and when it triggers

The message is "Failed to fetch available models" returning 401 — when opening the model settings, switching models or sending a chat, model discovery's call to GET /models is rejected by the server. Triggers and how to read them (source):

1. Open Settings → Models; the UI tries to fetch the available model list and gets 401;
2. Or when switching models / starting a chat, the model discovery step fails first with 401;
3. Key judgment: 401 is an authentication-layer error, not a missing model — the server never accepted your identity; UNKNOWN_MODEL is a different layer;
4. The search order is fixed: suspect the key first, then the base URL, then the proxy environment.

Why DeepSeek Harness 401s: invalid key, wrong base URL, proxy interference

The 401 has two root causes — an invalid key (expired, mistyped, extra whitespace) and a wrong base URL (not the official DeepSeek endpoint) — both under the rule that the base URL, key and model name must all match. In detail:

1. Invalid key: model discovery calls the OpenAI-compatible GET /models endpoint, and a wrong key returns 401 (source); the DeepSeek API docs confirm Bearer Token authentication (source);
2. Wrong base URL: pointing the base URL at a custom gateway, an old domain or an address with an extra path sends the request to the wrong endpoint, which 401s;
3. Three-way match: the key is issued by DeepSeek, the base URL is the official DeepSeek endpoint, and the model name lives in the DeepSeek model list — the providers.md doc states these must match (source);
4. Proxy interference: a system proxy or HTTPS_PROXY env var intercepting the request can make the server see malformed headers and return 401.

Fix DeepSeek Harness 401: replace the key, fix the base URL, check the proxy, verify

Follow the order credential → endpoint → environment: replace the key, fix the base URL, rule out the proxy, then re-trigger "fetch available models" to verify. Step by step:

1. Replace the key — generate a fresh key on the DeepSeek open platform (confirm the account has balance and the key is not expired), and swap it in on Settings → Models; when pasting, watch for leading/trailing spaces and compare it character by character;
2. Fix the base URL — confirm the provider's base URL is the official DeepSeek endpoint:
   text

   https://api.deepseek.com
   

   No extra path at the end; if it currently points at a custom gateway, switch to the official endpoint, or make sure the gateway and key belong to the same provider;
3. Check the proxy environment — run:
   bash

   env | grep -i proxy
   

   If HTTPS_PROXY / HTTP_PROXY are set, inspect the rules: add api.deepseek.com to the direct/whitelist, or temporarily disable the global proxy and retry;
4. Verify — back on Settings → Models, re-trigger "fetch available models"; you should get the model list (e.g. deepseek-chat, deepseek-reasoner). Then send one test message — a normal reply means it is fixed;
5. If it still 401s, restart dsh and retry — config and credentials load at startup, and changed config may not take effect until a restart.

How to verify a DeepSeek Harness 401 fix: curl the official endpoint and retry in the UI

Verification works in two layers: first use curl to test the key and endpoint directly, bypassing dsh, then re-trigger "fetch available models" in the UI — only when both pass is the fix complete. In order:

1. curl the endpoint without a key — expect a 401 as confirmation that the endpoint is reachable and authentication is actually enforced:

   bash

   curl -i https://api.deepseek.com/v1/models
   

   An HTTP/1.1 401 response means the official endpoint works and auth is intercepting; if you do not even get a 401 (timeout / connection failure), check the network and proxy first.

2. curl the endpoint with your key — a valid key should return 200 with the model list:

   bash

   curl https://api.deepseek.com/v1/models -H "Authorization: Bearer <your-key>"
   

   200 → key and endpoint are both correct; 401 → the key is still invalid, back to step 1 of the fix section.

3. Retry in the UI — back on Settings → Models, re-trigger "fetch available models"; you should see deepseek-chat, deepseek-reasoner and other models in the list.

4. Close with one chat message — send a test message in a session; a normal reply means the fix is complete.

Notes: DeepSeek Harness 401 — replace the key before the base URL

1. 401 is an authentication problem — replace the key first, then fix the base URL; do not touch the model name.
2. The base URL and key must be same-source: an official key goes with the official endpoint, a custom gateway goes with its own key.
3. Rule out the proxy early: env | grep -i proxy takes ten seconds and saves time spent on the wrong track.
4. Restart dsh after config changes before verifying, to avoid stale config confusing the diagnosis.
5. See install error troubleshooting for other DeepSeek Harness install issues.

Sources: dshbase troubleshooting, DeepSeek API official docs, DeepSeek Harness providers.md