[AI Gateway] Clarify BYOK authorization headers

src/content/docs/ai-gateway/configuration/bring-your-own-keys.mdx

@@ -71,6 +71,10 @@ Once you've configured your API keys in the dashboard:
 2. **Update request headers**: Remove provider authorization headers from your requests. Note that you still need to pass `cf-aig-authorization`.
 3. **Test your integration**: Verify that requests work without including API keys.
 
+:::caution[Remove provider authorization headers]
+AI Gateway substitutes a stored provider key only when the provider authorization header is absent. If your request includes this header, AI Gateway forwards its value to the provider instead. Placeholder values cause a provider authentication error.
+:::
+
 ## Example
 
 With BYOK enabled, your workflow changes from:

src/content/docs/ai-gateway/usage/providers/deepseek.mdx

@@ -39,7 +39,7 @@ So your final URL will come together as:
 
 ## Examples
 
-### cURL
+### cURL with a provider key
 
 ```bash title="Example fetch request"
 curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/deepseek/chat/completions \
@@ -56,6 +56,25 @@ curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/deepseek/cha
 }'
 ```
 
+### cURL with stored keys (BYOK)
+
+Store your DeepSeek key with [bring your own keys (BYOK)](/ai-gateway/configuration/bring-your-own-keys/). Then omit the `Authorization` header so AI Gateway can substitute the stored key:
+
+```bash title="Example BYOK request"
+curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/deepseek/chat/completions \
+ --header 'content-type: application/json' \
+ --header 'cf-aig-authorization: Bearer {CF_AIG_TOKEN}' \
+ --data '{
+    "model": "deepseek-chat",
+    "messages": [
+        {
+            "role": "user",
+            "content": "What is Cloudflare?"
+        }
+    ]
+}'
+```
+
 ### Use DeepSeek with JavaScript
 
 If you are using the OpenAI SDK, you can set your endpoint like this: