Code Review Bot API Cost Too High? Cut PR Review Spend in 2026

Last verified: July 24, 2026

Short path: Start with the GPT API guide, compare current AI API pricing, then see the cheap OpenAI-compatible API option. For model-level rates, see GPT-5.6 Terra.

Your code review bot API cost is not high because every pull request needs frontier-model reasoning. It is high because the bot is probably reviewing every commit as if it were the final PR: full diff, full repo instructions, repeated tool output, and a long response that repeats obvious lint feedback.

The practical fix is not “use a cheaper model everywhere.” Put a cheap first-pass model in front of an escalation tier, cap review output, deduplicate commit events, and switch the OpenAI-compatible base URL when the economics justify it. A review bot should spend its expensive reasoning budget on suspicious changes, not whitespace edits and generated lockfiles.

Quick Answer

In short

A PR review bot should not run the same expensive review on every commit. First remove duplicate events and unnecessary context; then classify diffs with a lower-cost model and reserve gpt-5.6-terra or gpt-5.6-sol for changes that actually need deeper reasoning.

That approach cuts spend without quietly turning critical review into a bargain-bin autocomplete task. The savings come from fewer tokens and lower per-token rates—not from pretending a cheap first pass can replace escalation.

What most guides get wrong

The common advice is “switch to a cheaper model.” That helps, but it misses the bill-shaped bug: most code review bots are event processors, not one-shot prompts.

A developer pushes three commits to fix CI, rebases once, and force-pushes again. GitHub sends multiple events. Your worker starts multiple reviews before it notices the head SHA changed. Each worker fetches the same PR description, repository instructions, diff, dependency metadata, and previous bot comments. Then the model produces 800 tokens explaining that a renamed variable looks fine.

You did not buy four independent security reviews. You bought four copies of the same context window.

The fix is to make the review job idempotent by PR number and head SHA, cancel stale runs, and treat generated files as an explicit routing decision. After that, model routing becomes meaningful. Before that, moving from one price card to another only makes an inefficient loop less expensive.

A realistic production scenario

Nadia’s platform team runs a GitHub App that reviews TypeScript and Python pull requests. The worker is a small queue consumer: webhook arrives, it fetches the diff, sends repository rules plus changed files to an LLM, then posts inline comments through the GitHub API.

The bot reviews every synchronize event. On a busy month, it processes 2,000 review runs. The average request contains 18,000 input tokens because the prompt includes a large engineering handbook and repeated diff context. The bot asks for long explanations, averaging 1,500 output tokens per run.

That is 36 million input tokens and 3 million output tokens monthly. Worse, an engineer discovers that roughly one in five runs belongs to a commit SHA that was replaced before the response came back. The team was paying to review stale code.

The turning point is not a new prompt. They add a pr_number:head_sha idempotency key, skip generated files, limit comments to actionable findings, and route ordinary diffs through gpt-5.4-mini. Only security-sensitive files, auth changes, migrations, and uncertain findings go to gpt-5.6-terra.

Expert take

The expensive part of automated review is often output, not input. Review bots have a nasty tendency to ask for “detailed feedback,” then emit a prose essay for a pull request with one meaningful bug. At the verified gpt-5.6-terra catalog price, one million output tokens cost $4.50 through LumeAPI versus $15.00 at the listed official rate. Output discipline is therefore a real cost control, not cosmetic prompt engineering.

Use a review contract that forces the model to make a decision:

• Return no finding when there is no concrete, user-visible, security, correctness, or reliability issue.
• Quote the file and line range only when the bot can explain the failure mode.
• Limit each finding to a short title, impact, evidence, and proposed fix.
• Avoid reviewing formatter-only changes, lockfiles, vendored code, generated clients, and bulk mechanical renames unless your policy says otherwise.
• Escalate based on evidence: a suspicious authorization change, unsafe deserialization path, SQL construction, payment logic change, or migration deserves a stronger pass.

Do not blindly follow this advice when your review workflow depends on a provider-native feature that an OpenAI-compatible gateway does not reproduce. Native Batch workflows, prompt-caching behavior, provider-specific tools, regional controls, enterprise agreements, or specialized compliance requirements may be worth more than a lower token price. Confirm those requirements against the official OpenAI API documentation and your own security review.

Also, do not treat a low-cost model’s “no issue found” as proof that a sensitive diff is safe. The right pattern is selective escalation, not selective blindness.

Why a code review bot API cost too high after every commit

A code review request has four cost multipliers:

1. Event count

A PR with six pushes can trigger six independent reviews unless you collapse events. The correct unit is usually the latest reviewable head SHA, not every webhook delivery.

1. Context size

Teams often send a repository handbook, a full PR diff, prior comments, and tool output every time. A 2,000-token policy copied into 2,000 reviews costs 4 million input tokens before the model reads a line of changed code.

1. Output length

“Be thorough” is an invoice instruction. It leads to repetitive summaries, style suggestions, and speculative findings. Ask for a bounded number of actionable comments instead.

1. Retry behavior

If your queue retries a completed review because the final GitHub comment post failed, you may pay for the model call twice. Store the model result before publishing comments, then retry publishing separately.

The last point is especially easy to miss. A failed comment API call is not a reason to call the model again. Split generation from delivery. Persist the generated review keyed by repository, PR number, and head SHA; make the GitHub posting step retryable on its own.

For a related failure mode, see how to prevent duplicate AI agent tool calls.

The monthly math: one expensive review loop

Here is a straightforward scenario using the 2,000-run workload from the production example:

• Review runs per month: 2,000
• Average input per run: 18,000 tokens
• Average output per run: 1,500 tokens
• Monthly input: 36M tokens
• Monthly output: 3M tokens
• Rates: dollars per 1M input / output tokens
• Pricing basis: Live catalog updated July 22, 2026; official reference rates are supplied in the catalog brief. Check OpenAI API pricing before making a purchasing decision.

For gpt-5.6-terra, the calculation is:

Input:  36M × $0.75  = $27.00
Output:  3M × $4.50  = $13.50
Total through LumeAPI = $40.50

Correction: the table’s $54.00 calculation reflects the stated 36M input and 3M output scenario at the catalog rates only if the inputs and outputs are summed incorrectly. The correct math is $40.50 through LumeAPI and $135.00 at the listed official rate. That is a $94.50 difference for this scenario.

The corrected comparison is below.

The bigger win comes when you fix the workflow first. If idempotency and filtering remove 20% of stale or irrelevant reviews, the same gpt-5.6-terra workload becomes 28.8M input and 2.4M output tokens:

28.8M × $0.75 input  = $21.60
 2.4M × $4.50 output = $10.80
Monthly total         = $32.40

That is why “reduce coding assistant API cost” should start with review volume and context discipline. The gateway discount compounds with the token reduction.

Use a tiered review policy instead of one default model

A reasonable policy is not “mini for everything” or “frontier for everything.” It is a decision tree tied to the risk of the diff.

The decision rule matters: escalate a specific uncertainty, not an entire category of PR. If the mini pass flags an authorization bypass in one handler, send the relevant handler, call path, policy rules, and test coverage to gpt-5.6-terra. Do not re-send every changed file just because one finding exists.

For teams choosing between the stronger GPT tiers for coding work, see GPT-5.6 Sol vs Terra for coding agents.

A cost-control checklist for GitHub PR review

Before changing providers, make these controls observable in your application logs:

• [ ] Store a review job key as repository_id + pull_request_number + head_sha.
• [ ] Cancel or mark stale jobs when a newer head SHA arrives.
• [ ] Record input tokens, output tokens, model ID, PR number, and commit SHA for each call.
• [ ] Exclude generated, vendored, minified, lockfile, and formatter-only changes.
• [ ] Cap the maximum number of findings per review.
• [ ] Require a concrete failure mode before publishing a finding.
• [ ] Persist model output before posting review comments.
• [ ] Retry GitHub comment delivery without repeating the model request.
• [ ] Escalate only risk-tagged diffs or low-confidence findings.
• [ ] Sample “no finding” decisions from high-risk PRs for human quality checks.

That last item protects quality. Savings are only real if missed critical bugs do not create a larger incident bill later.

Send the same Chat Completions request through LumeAPI

LumeAPI exposes an OpenAI-compatible Chat Completions endpoint. If your bot already builds a standard chat request, the operational change can be as small as setting the base URL, replacing the API key, and selecting a catalog model ID.

This curl request uses gpt-5.4-mini for a constrained first-pass review:

curl https://api.lumeapi.site/v1/chat/completions \
  -H "Authorization: Bearer $LUMEAPI_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5.4-mini",
    "messages": [
      {
        "role": "system",
        "content": "You review pull-request diffs. Report only concrete correctness, security, reliability, or data-loss issues. Ignore style. Return at most three findings. If there is no actionable issue, say NO_FINDINGS."
      },
      {
        "role": "user",
        "content": "Review this diff. Focus on changed behavior and cite the relevant file and line.\n\n--- diff ---\n<INSERT_FILTERED_PR_DIFF>"
      }
    ]
  }'

For escalation, keep the same request shape but change the model and narrow the evidence package:

curl https://api.lumeapi.site/v1/chat/completions \
  -H "Authorization: Bearer $LUMEAPI_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5.6-terra",
    "messages": [
      {
        "role": "system",
        "content": "Review a suspected pull-request defect. Validate whether the reported issue is real. Return an actionable finding only if you can explain the failure path and a safe fix."
      },
      {
        "role": "user",
        "content": "Suspected issue: authorization may be bypassed after a route refactor.\n\nRelevant diff:\n<INSERT_RELEVANT_DIFF>\n\nRelevant policy and tests:\n<INSERT_SMALL_CONTEXT_PACKET>"
      }
    ]
  }'

Do not put a secret key in repository configuration, PR comments, or workflow logs. Keep $LUMEAPI_KEY in your deployment secret store, and redact request bodies if your logs may contain proprietary source code.

How to measure whether the cheaper path misses bugs

Do not declare victory because the monthly invoice falls. Measure review quality with a small, repeatable evaluation set.

Build a set of merged PRs that includes known defects, reverted changes, security fixes, incidents, and ordinary clean diffs. For each PR, record:

• Whether the bot identified the meaningful issue.
• Whether the finding was specific enough for an engineer to act on.
• False positives per PR.
• Whether the first-pass model escalated the PR when it should have.
• Input and output tokens consumed by the run.

A useful operational target is not “the mini model catches everything.” It is: low-risk PRs consume a cheap first pass, and the escalation rules capture the risky cases your team cares about. If a category of defect repeatedly gets missed—authorization checks, concurrency, database migrations—add a deterministic risk tag that routes those diffs straight to gpt-5.6-terra or a human gate.

This is also where a generic ai code review llm bill becomes useful engineering telemetry. Track spend by repository, team, PR label, file type, and risk route. A single repository with huge generated diffs can distort your entire budget and hide the fact that the rest of the system is efficient.

FAQ

Why is my code review bot API cost too high when PRs are small?

Small PRs can still be expensive when the bot sends large fixed context on every request. Repository policies, prior comments, tool output, duplicate webhook jobs, and verbose responses often outweigh the changed lines.

How can I reduce coding assistant API cost without lowering review quality?

Use a lower-cost model for routine triage, then escalate risk-tagged or uncertain findings to a stronger model. Pair that with head-SHA deduplication, diff filtering, and bounded output so the stronger model sees fewer but better-targeted requests.

Is a GitHub PR review API expensive because of output tokens?

It often is. Review bots can generate long explanations and multiple low-value comments. Restrict findings to concrete bugs, require evidence, and cap the number of comments per PR to control output-token spend.

Should every pull request use gpt-5.6-terra?

No. Use gpt-5.6-terra when the diff crosses a meaningful risk boundary or when a first-pass review finds a plausible issue that needs validation. Running it on documentation edits, generated code, and repeated commit events is wasted budget.

Does LumeAPI work with an OpenAI-compatible code review bot?

LumeAPI provides an OpenAI-compatible Chat Completions endpoint at https://api.lumeapi.site/v1. Update authentication, set the base URL, use an exact catalog model ID, and validate your bot’s expected request and response behavior before production rollout.

Next steps

1. Instrument one week of review traffic: review runs, head SHAs, input tokens, output tokens, and stale-job rate.
2. Add idempotency and file filtering before changing models; this removes spend without changing review intelligence.
3. Route routine reviews through gpt-5.4-mini, reserve gpt-5.6-terra for escalation, and review the current LumeAPI OpenAI-compatible API pricing against your measured token mix.