Bring Your Own Key (BYOK)

BYOK (Bring Your Own Key) means you connect an OpenRouter or CrofAI (nahcrof) API key in Critique Settings. Critique still runs the product — sandboxes, GitHub checks, repository context, usage telemetry — but model inference is billed to your provider account, not drawn from Critique’s bundled credit pool.

BYOK is about who pays for tokens. BYOA is about who runs the fix agent (Cursor, Codex, Claude Code, Copilot). Teams often combine both: OpenRouter BYOK for review depth, then Cursor or a fix prompt for execution.

Bundled credits vs BYOK harness

The harness fee covers orchestration Critique would run anyway: E2B sandboxes for sandbox-native review, OpenCode inside those sandboxes, chat streaming, GitHub publication, repository retrieval, encrypted key storage, and usage ledgers. It is not a markup on every token.

Set up OpenRouter BYOK

1. Create or sign in to an OpenRouter account and create an API key.
2. In Critique, open Settings → Bring your own OpenRouter key.
3. Paste the key and Save encrypted key. Critique stores only a hint (last characters) in the UI after save.
4. Confirm Usage shows OpenRouter-backed runs as externally billed where applicable.

Set up CrofAI BYOK

CrofAI (nahcrof) hosts open-weight models through an OpenAI-compatible API. Critique uses the same $8/month harness but switches the upstream endpoint to https://crof.ai/v1 and maps OpenRouter catalog ids (for example moonshotai/kimi-k2.6) to Crof slugs (kimi-k2.6).

1. Create a Crof account at ai.nahcrof.com and create an API key.
2. In Critique Settings, open Bring your own CrofAI key.
3. Save the key encrypted. New chat and sandbox review runs bill Crof directly.
4. If you also save an OpenRouter key, Crof takes precedence until you remove it.

Keys are encrypted at rest and decrypted only server-side for model calls. They are never returned to the browser after save.

What uses your OpenRouter key

When a saved key is enabled:

Critique continues to record stages, call metadata, and token counts where available so you can reconcile against the OpenRouter dashboard.

Credits and review gates

With an active OpenRouter key:

• Model calls on the BYOK path typically show 0 Critique credits in Usage (OpenRouter invoices you separately).
• PR review queue gate — Teams with BYOK can queue automated reviews even when the Critique credit balance is below the usual minimum for managed review (because inference is not on Critique’s pool). You still need an active Critique subscription that includes the BYOK harness where your plan requires it.
• Non-model work — Sandboxes, indexing, Remedy on managed models, builder jobs, and similar surfaces may still consume Critique credits unless they are also on a BYOK path.

Check Dashboard → Usage after onboarding — it is the source of truth for your account.

When to choose BYOK

Choose BYOK if you:

• Already centralize spend on OpenRouter with budgets, alerts, and model allowlists.
• Run high-variance review volume and want provider-native invoices instead of larger bundled tiers.
• Want frontier models on OpenRouter without buying the largest Critique credit bundle.

Choose bundled credits if you:

• Prefer one line item from Critique for procurement.
• Are evaluating Critique before wiring another vendor key.
• Want simplicity over splitting harness + OpenRouter bills.

Operations checklist

1. Set OpenRouter spend limits on the key you give Critique.
2. Pick models in review policy that your OpenRouter account can access (Models, Policy fields).
3. After the first PR review and chat session, open Usage and confirm externally billed / BYOK labeling matches expectations.
4. For fixes, pick Remedy, BYOA queueing (Cursor, Claude, Codex), or Fix prompt — BYOK does not auto-run those agents.

Related

• Billing & credits
• Bring your own agent — Cursor, Claude Managed Agent, OpenAI Codex, Fix prompt
• Settings — OpenRouter and BYOA key panels