How to Use — ReviewPR

How to set up access tokens

Before you start

ReviewPR needs two tokens to work: a platform token (GitHub or GitLab) to read PR/MR diffs and post inline comments, and an AI provider key (Anthropic, OpenAI, or Mistral) to run the analysis. Both are stored only in your browser — they are never sent to any server other than the respective API directly.

📖Read PR/MR diffs

💬Post inline comments

🔐Stored in browser only

🤖AI key stays local

GitHub Personal Access Token

Required to read PR diffs and post review comments

Option A — Classic PAT (easier)

Go to GitHub.com → click your profile photo (top-right) → Settings

Scroll to the bottom of the left sidebar → Developer settings

Choose Personal access tokens → Tokens (classic)

Click Generate new token → Generate new token (classic)

Set a descriptive note (e.g. ReviewPR) and choose an expiration that suits you.

Select the following scope:

repoFull control of private repositories (includes reading diffs and writing PR comments)

For public repos only, you can use public_repo instead — it is a narrower scope.

Click Generate token — copy the token immediately (it won't be shown again). It starts with ghp_.

Tip: If you only need ReviewPR to work on specific repositories, use a Fine-grained PAT (Option B) to limit the scope further.

Option B — Fine-grained PAT (more secure)

Go to GitHub.com → Settings → Developer settings → Personal access tokens → Fine-grained tokens

Click Generate new token and set a name + expiration.

Under Repository access, choose Only select repositories and pick the repos you want ReviewPR to access, or choose All repositories.

Under Permissions → Repository permissions, set:

Pull requests

Read and write

Read diff, post review comments

Contents

Read-only

Read file diffs

Metadata

Read-only

Automatically included, cannot be removed

Click Generate token — copy it. Starts with github_pat_.

Important: You must have Write role on the target repository (not just Read). If you only have Read access, posting comments will return a 403 Forbidden error even with the correct token scopes.

Bitbucket App Password

Used as Basic auth — provide as username:app-password

Creating an App Password

Go to Bitbucket.org → click your avatar (bottom-left) → Personal settings

In the left sidebar click App passwords

Click Create app password — give it a label (e.g. ReviewPR).

Select the following permissions:

Repositories

Read

Read PR diffs and file contents

Pull requests

Read

Read PR metadata and existing comments

Pull requests

Write

Post inline review comments

Click Create — copy the generated password immediately (shown only once).

In ReviewPR enter the token as: your-username:the-app-password

Example: johndoe:ATBB12345abcde

Important: The token field must be in username:app-password format. ReviewPR encodes it as HTTP Basic auth automatically — do not base64-encode it yourself.

Workspace & repo: For the Owner field enter your Bitbucket workspace slug (e.g. mycompany), and for Repository enter the repo slug (e.g. my-project). Both are found in the URL: bitbucket.org/{workspace}/{repo}.

GitLab Personal Access Token

Required to read MR diffs and post inline discussions

Creating the token

Go to GitLab.com (or your self-hosted instance) → click your profile photo (top-left) → Preferences

In the left sidebar click Access Tokens

Click Add new token — give it a name (e.g. ReviewPR) and set an expiry.

Select the following scopes:

apiFull access — read MR diffs, post inline comments, and post review discussions

If you prefer minimal scopes, use read_repository + write_repository — but the api scope is simplest and sufficient for all ReviewPR operations.

Click Create personal access token — copy the token immediately. It starts with glpat-.

Important: Your GitLab account must have at least Developer role on the project. Reporter role cannot post MR comments. Owner/Maintainer roles are required to post comments on locked MRs.

Self-hosted GitLab? Everything above applies. Enter your instance URL in the owner/repo field as namespace/project-slug. ReviewPR sends API requests to https://gitlab.com by default — if you're on a self-hosted instance you'll need to update the backend GITLAB_URL env variable.

AI Provider API Keys

Anthropic (Claude)claude-opus-4-8

Get key at: console.anthropic.com → API Keys

Token format: sk-ant-api03-·Recommended — uses extended thinking for deeper analysis

OpenAI (GPT-5.4)gpt-5.4

Get key at: platform.openai.com → API keys

Token format: sk-proj-·Good balance of speed and quality

Mistral (Large)mistral-large-latest

Get key at: console.mistral.ai → API Keys

Token format: xxxx...xxxx·Fast and cost-effective

xAI (Grok)grok-3

Get key at: console.x.ai → API Keys

Token format: xai-·Grok-3 with strong reasoning capabilities

Google (Gemini)gemini-2.5-flash

Get key at: aistudio.google.com → Get API key

Token format: AIzaSy...·Fast and generous free tier available

Pre-flight checklist

Platform token has correct scopes (repo for GitHub / api for GitLab)

Token owner has Write / Developer+ role on the target repository

AI API key is active and has remaining credits

PR/MR number is correct and the PR is open (not merged/closed)

Owner / workspace and repository fields match exactly (case-sensitive for GitHub/Bitbucket)

For Bitbucket: token is entered as username:app-password (not base64-encoded)

Start reviewing