DeepSeek Harness

The deepseek-harness template ships DeepSeek's agent harness, dsh, preinstalled.

Setup

pip install ovrin
export OVRIN_API_KEY="ovrin_..."

Run the agent

import ovrin

client = ovrin.Client()  # reads OVRIN_API_KEY

sandbox = client.sandboxes.create(
    template="deepseek-harness",
    env={"DEEPSEEK_API_KEY": "..."},
    timeout=1800,
)

result = sandbox.run('dsh run --task "summarise the files in /workspace"')
print(result.stdout)

sandbox.kill()

Letting the agent transact

dsh is the harness used in the agent payments examples. Create the sandbox with payments=True and Ovrin injects a payments-scoped key, so code inside can call /payments/* without ever holding your Stripe restricted key:

sandbox = client.sandboxes.create(
    template="deepseek-harness",
    env={"DEEPSEEK_API_KEY": "..."},
    payments=True,
)

result = sandbox.run('dsh run --task "invoice acme for sprint 12"')

The injected key authenticates the payments surface and nothing else — it cannot read usage, list secrets, or touch billing. Mint the account's agent key first with client.payments.create_agent_key().

Auth

Variable	Purpose
DEEPSEEK_API_KEY	DeepSeek API key
OVRIN_PAYMENTS_API_KEY	Injected by Ovrin when payments=True
OVRIN_API_URL	Injected alongside it — where to call

Related

• Agent payments (BYOK) — the full payments model
• API keys & scopes — what a scoped key can reach