LGTM × OpenRouter
BYOK OpenRouter on LGTM: one key unlocks Claude Opus 5, Sonnet 5, Haiku 4.5, Gemini 3.1 Pro / Flash, Grok 4.5, DeepSeek V4 Pro, Llama 4, Mistral Large, Qwen 3.8 Max, plus 400+ more models. Same AES-256-GCM encryption story as OpenAI. Claude models keep prompt caching via cache_control forwarding.
How LGTM uses your OpenRouter key
/dashboard/ai-providers → API Keys tab → Add OpenRouter. Paste your key from openrouter.ai/keys (looks like sk-or-v1-…). LGTM validates by looking up the key against a server-warmed OpenRouter model catalog (refreshed hourly, µs-lookup on validate) instead of making an outbound HTTP request per-model — so validation is fast even for the 400+ model long-tail. Errors surface verbatim ("invalid_key", "insufficient_credits", "model_not_available").
Storage: AES-256-GCM encryption, master key in Fly Secrets, encrypted blob in MongoDB alongside your user record. Multiple keys per provider — each with its own stable id + editable label + lastValidatedAt timestamp — so you can maintain (say) a personal dev-quality key and a team-account production key on the same account.
Per-review: worker decrypts the key into memory, makes the OpenRouter call, drops plaintext after response. OpenRouter routes to the underlying provider (Anthropic, Google, xAI, DeepSeek, Meta, Mistral, Qwen, or OpenAI passthrough) based on the model slug you selected. Token cost flows to your OpenRouter credits balance — no LGTM markup.
Supported models (21 curated + custom-slug input)
Curated slugs surfaced on the Models tab: anthropic/claude-opus-5, claude-sonnet-5, claude-haiku-4.5, claude-opus-4.8, claude-sonnet-4.8 · google/gemini-3.1-pro, gemini-3.1-flash · x-ai/grok-4.5, grok-4.5-fast · deepseek/deepseek-v4-pro, deepseek-v4-flash · meta-llama/llama-4-maverick, llama-4-scout · mistralai/mistral-large, codestral-latest · qwen/qwen-3.8-max, qwen-3.8-coder · openai/gpt-5.4 (OpenAI passthrough) — 21 tested slugs total.
Custom-slug input for anything beyond the curated set: type any slug from openrouter.ai/models (e.g. amazon/nova-pro-v1, cohere/command-r-plus-08-2024) and LGTM validates it against the catalog. Useful for tail models the LGTM team hasn't formally benchmarked but that fit your workload.
Documentation and readability agents auto-route to the same-provider mini/flash/haiku tier — Claude Opus 5 → Claude Haiku 4.5, DeepSeek V4 Pro → V4 Flash, Gemini 3.1 Pro → 3.1 Flash. Typical savings 3-5× on those two agents. Bugs, security, performance, best-practices, verifier, and synthesizer stay on the strong tier.
Claude prompt caching still works
When LGTM sends a request to a Claude model via OpenRouter, cache_control: ephemeral markers on the shared per-review context (diff + files + conventions + repo map) are forwarded to Anthropic upstream. All 6 agents + verifier hit the cache after the first call — ~90% discount on the shared block, same as direct Anthropic BYOK gave you before the pivot.
The cache marker is transparent to your OpenRouter dashboard — you'll see the discounted usage reflected in the underlying Anthropic passthrough cost. No configuration required; LGTM applies it automatically for anthropic/* model slugs.
For non-Claude models, LGTM falls back to the provider-native structured-output path (OpenAI-style json_schema for gpt-5.4 passthrough, Google's function-calling schema for Gemini, etc.) so findings ship as validated JSON regardless of which underlying model you picked.
Cost — OpenRouter vs OpenAI direct math
OpenRouter charges the underlying provider's list price plus a fixed 5-10% routing fee (varies by model). On Claude it's parity with direct Anthropic BYOK after accounting for prompt caching. On DeepSeek V4 Flash it's the cheapest workable code-review model at $0.001-$0.003 per 300-line PR — often 20-40× cheaper than GPT-4o for comparable quality on high-throughput repos.
Comparable to OpenAI direct: Claude Sonnet 5 via OpenRouter ≈ gpt-5.4-mini in cost, Haiku 4.5 ≈ gpt-4.1-mini, DeepSeek V4 Flash < gpt-4.1-mini, Opus 5 > gpt-5.4-pro. Pick by model strength + your OpenRouter credits balance.
Multi-key strategy: many LGTM teams keep both OpenAI direct + OpenRouter keys — OpenAI for the Bugs agent (broader English-language code corpus) and OpenRouter for everything else so Claude / Gemini / DeepSeek diversity absorbs the tail-of-the-distribution issues each single provider misses.
Privacy + data handling
OpenRouter's Terms of Service explicitly commit that user inputs are NOT used for training and are not shared with underlying providers beyond what the API call requires. Inputs flowing through your BYOK key are governed by the agreement you have with OpenRouter, NOT LGTM's contract (there is none).
LGTM-side persistence: identical to OpenAI direct — diff and context bodies are NOT persisted, only the LLM-generated review output. Findings are hard-deleted on request within 24h. Logs include timing + model + token count, never content.
If you need a DPA / BAA / data-residency commitment, those go through your direct OpenRouter account. LGTM is the orchestration layer; your OpenRouter contract governs the LLM relationship. Direct Anthropic BYOK was retired 2026-08-10 in favor of OpenRouter for the unified surface — if your team requires a direct Anthropic contract with no intermediary, contact us and we can discuss an Enterprise carveout.
Setup
(1) Sign in to LGTM via GitHub OAuth at app.looksgoodtomeow.in. (2) /dashboard/ai-providers → API Keys tab → Add OpenRouter. (3) Paste your key from openrouter.ai/keys. (4) Click Validate. (5) Models tab → pick a default review model (Claude Sonnet 5 or DeepSeek V4 Pro are strong defaults).
Per-agent model selection is not a first-class knob — the auto-routing logic (docs+readability → mini/flash tier) handles the cost/quality tradeoff for you. If you want finer control, per-repo overrides let you pick a distinct model for a specific repo.
Per-repo overrides: /dashboard/repos/:id/settings → Model tab. Force a specific model (or a specific key of yours) for that repo. Useful for a critical payments repo using Claude Opus 5 while a marketing site uses DeepSeek V4 Flash. Separate PR chat key + model override available for teams that want a different model backing @lgtm chat than backing the automated review.
Implementation examples
async function validateOpenRouterKey(key: string) {
// LGTM keeps a cached OpenRouter model catalog warmed on server boot
// + refreshed hourly. Validation is a µs Set lookup after we do a
// single /v1/credits round-trip to confirm the key itself is live.
const res = await fetch('https://openrouter.ai/api/v1/credits', {
headers: { authorization: `Bearer ${key}` },
});
if (res.status === 401) throw new Error('invalid_key');
if (res.status === 402) throw new Error('insufficient_credits');
if (res.status === 429) throw new Error('rate_limited');
if (!res.ok) throw new Error('provider_error');
return encryptKey(key);
}Configure OpenRouter on LGTM
21 curated slugs + 400+ via custom slug · Claude cache_control forwarded · µs validation via boot-warmed catalog · per-repo overrides
Go to the product pageOpenRouter integration FAQs
Why did LGTM drop direct Anthropic BYOK in favor of OpenRouter?
Three reasons. (1) One key surfaces the whole non-OpenAI model universe — Claude, Gemini, Grok, DeepSeek, Llama, Mistral, Qwen — instead of asking teams to manage a separate account per provider. (2) Prompt caching for Claude still works via cache_control forwarding, so the tokenomics are the same. (3) The custom-slug input covers any tail model that emerges without an LGTM code release. Direct-Anthropic users got a persistent migration banner in-app on 2026-08-09 and can switch with a single click.
Does OpenRouter train on my code?
No. OpenRouter's ToS explicitly excludes API inputs from training and prohibits underlying providers from doing so for OpenRouter-brokered traffic. The BYOK path uses the API surface, not the consumer product.
Which OpenRouter model is best for code review?
Claude Sonnet 5 is the strong-tier default (best code-review quality per dollar in early 2026). DeepSeek V4 Pro is the value pick (~5-10× cheaper for comparable reasoning). Grok 4.5 is fastest for high-throughput monorepos. Claude Haiku 4.5 handles the docs+readability agents cheaply via auto-routing. Managed AI mode (LGTM-funded) uses DeepSeek V4 Flash / CoreWeave :nitro routing — if you don't want to buy OpenRouter credits at all.
Can I use OpenAI + OpenRouter simultaneously?
Yes. Add both keys on the API Keys tab, then set defaults on the Models tab. Common pattern: OpenAI direct for the Bugs agent (broadest code corpus), OpenRouter → Claude Sonnet 5 for Security (safety-trained catches more), OpenRouter → DeepSeek V4 Flash for Documentation (cheap, fast enough). Per-repo overrides let you swap the mix on a per-project basis.
What's the OpenRouter rate-limit story?
OpenRouter enforces per-model rate limits pulled from the underlying provider — LGTM auto-detects a 429 and retries once with exponential backoff. If the retry fails, the agent surfaces the error gracefully rather than failing the whole review. If you're consistently hitting limits on Claude Opus 5, either top up your OpenRouter credits (its own separate quota system) or switch that repo to a lower-tier default like Sonnet 5 or DeepSeek V4 Pro.
Related across LGTM
Other integrations
OpenAI
BYOK with OpenAI on LGTM: paste your platform.openai.com key, we encrypt with AES-256-GCM, decrypt only inside worker memory at review time. Zero markup, your bill, your model choice.
GitHub
LGTM's GitHub App: 4 permissions (contents:read, pull-requests:write, checks:write, metadata:read), webhook subscriptions on pull_request + push + installation. No access to secrets, can't push code.