Bring-your-own-key, or BYOK, means the AI review tool calls the model provider with your API key instead of the vendor's. The tool still does the work of reading pull requests, prompting the model, posting comments, and computing scores, but the model usage shows up on your OpenAI or Anthropic invoice rather than on the tool's bill. This post explains when that is the better deal, what to check before you paste a key into anyone's settings page, and how DiffNova handles it.
When BYOK is cheaper
BYOK wins when at least one of these is true:
- You already have a provider account with volume or negotiated pricing. Large organisations often pay less per token than a small SaaS vendor can.
- You want a model the platform does not offer on its own credits. DiffNova's platform-paid reviews run on OpenAI models. If you want Claude Sonnet or Opus reviewing your code, BYOK is how you get it.
- Your review volume is high. Platform credits carry a margin to cover the vendor's risk. At scale, paying the provider directly and a small flat fee to the tool comes out ahead.
- Procurement prefers one AI bill. Some finance teams would rather see all model spend on a single provider invoice.
BYOK loses when your usage is small. If your team's reviews would cost a few dollars a month in credits, the convenience of prepaid credits with no key to manage is worth more than the saving.
What to check before handing over a key
A key that can spend money on your account deserves the same care as a database password. Ask the vendor:
- How is the key stored? It should be encrypted at rest with a real cipher (AES-256-GCM or equivalent), with the encryption key kept separately from the database. "We hash it" is wrong; a hash cannot be used to make API calls, so if they can call the API they are not hashing it.
- Is the key ever returned to the browser? It should not be. The settings page should show a hint such as the last four characters and nothing more.
- Is the key validated when saved? A good tool makes a test call immediately so you find out about a typo now, not when your first PR silently goes unreviewed.
- What happens if the key stops working? Rotated, revoked, or out of provider credit. Reviews should pause with a clear message in the dashboard, and nothing broken should be posted to GitHub.
- Can I scope the key? On the provider side, create a dedicated key for the review tool with a spending limit. Both OpenAI and Anthropic support per-key limits.
- Can I remove it in one click? Removing the key should immediately stop all use of it.
How DiffNova implements BYOK
DiffNova's bring-your-own-key plan is $5 per month and unlocks every feature of the Pro plan: model choice, contributor scores, and manual re-review. It works with one provider at a time, OpenAI or Anthropic.
- Storage: the key is encrypted with AES-256-GCM using a key derived from a server-side secret. The database holds only the ciphertext and a four-character hint.
- Validation: the key is tested live when you save it and again before every review, including a check that the provider account still has credit.
- Failure mode: if the key is missing, invalid, or the provider account is out of funds, reviews pause and a banner appears in the dashboard with the reason. Nothing is posted to GitHub in that state.
- Cost visibility: each review still records tokens and an estimated cost at the provider's list price, so the dashboard shows what a run cost even though DiffNova is not the one billing it.
- Models: with an Anthropic key you can pick Claude Haiku, Sonnet, or Opus models. With an OpenAI key you get the full OpenAI catalogue, including the reasoning models.
Setting it up
- Create a dedicated API key on your provider's dashboard and set a monthly spending limit on it.
- In DiffNova, open Billing, choose the Own API key plan, and pick your provider.
- Paste the key. DiffNova tests it and shows the last four characters.
- Pick a review model. A fast, inexpensive model is usually the right default; switch specific repositories to a stronger model where it pays off.
- Open a pull request. The summary comment shows the model used and the token counts for that run.
Platform credits or BYOK?
A simple rule: start on platform credits during the free trial, look at the ledger after a week, and multiply by four. If that monthly figure is small, stay on credits and forget about key management. If it is large, or if you want Claude models, switch to BYOK. You can change at any time; the review history, scores, and settings stay exactly as they were.
Start the trial at diffnova.com and decide with real numbers.