diff --git a/src/content/docs/ai-gateway/configuration/bring-your-own-keys.mdx b/src/content/docs/ai-gateway/configuration/bring-your-own-keys.mdx
index 8217c013de4..16737152a80 100644
--- a/src/content/docs/ai-gateway/configuration/bring-your-own-keys.mdx
+++ b/src/content/docs/ai-gateway/configuration/bring-your-own-keys.mdx
@@ -68,7 +68,7 @@ The `secret_id` returned by Secrets Store is not used by AI Gateway for runtime
 Once you've configured your API keys in the dashboard:
 
 1. **Remove API keys from your code**: Delete any hardcoded API keys or environment variables.
-2. **Update request headers**: Remove provider authorization headers from your requests. Note that you still need to pass `cf-aig-authorization`.
+2. **Update request headers**: Remove provider authorization headers from your requests. AI Gateway substitutes the stored provider key only when the provider authorization header is absent. If you send a provider authorization header, AI Gateway forwards its value to the provider. Placeholder values cause a provider authentication error. You still need to pass `cf-aig-authorization`.
 3. **Test your integration**: Verify that requests work without including API keys.
 
 ## Example
diff --git a/src/content/docs/ai-gateway/usage/providers/deepseek.mdx b/src/content/docs/ai-gateway/usage/providers/deepseek.mdx
index e6d7837d922..fa33c6700f2 100644
--- a/src/content/docs/ai-gateway/usage/providers/deepseek.mdx
+++ b/src/content/docs/ai-gateway/usage/providers/deepseek.mdx
@@ -39,7 +39,7 @@ So your final URL will come together as:
 
 ## Examples
 
-### cURL
+### cURL with a provider key
 
 ```bash title="Example fetch request"
 curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/deepseek/chat/completions \
@@ -56,6 +56,25 @@ curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/deepseek/cha
 }'
 ```
 
+### cURL with stored keys (BYOK)
+
+Store your DeepSeek key with [bring your own keys (BYOK)](/ai-gateway/configuration/bring-your-own-keys/). Then omit the `Authorization` header so AI Gateway can substitute the stored key:
+
+```bash title="Example BYOK request"
+curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/deepseek/chat/completions \
+ --header 'content-type: application/json' \
+ --header 'cf-aig-authorization: Bearer {CF_AIG_TOKEN}' \
+ --data '{
+    "model": "deepseek-chat",
+    "messages": [
+        {
+            "role": "user",
+            "content": "What is Cloudflare?"
+        }
+    ]
+}'
+```
+
 ### Use DeepSeek with JavaScript
 
 If you are using the OpenAI SDK, you can set your endpoint like this: