When we added AI-written SEO analysis to Site Audit reports, the obvious path was the one every SaaS takes: buy one API key, put the feature behind a paywall or a usage cap, and charge per report or per month. We did the opposite. Every SEO Loop user brings their own key. Here's the actual reasoning, and what it means in practice.

What BYOK actually means, concretely

In Profile Settings, you can add your own API key for ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google), or DeepSeek — any or all four, your choice. When you click "Generate report" on any audit, SEO Loop sends that audit's check results to whichever provider you selected, using your key for that one request, and shows you the response. We never see your key in plaintext at rest: it's encrypted using Laravel's built-in encryption layer, keyed to our application's own secret key, and it's only ever decrypted momentarily, in memory, to attach it to your outbound request to the provider you chose. It is never logged, never included in error reports, and never visible to us through the admin panel.

Getting a key, provider by provider

All four providers offer either a genuinely free tier or a low-cost pay-as-you-go tier that costs a few cents per report, not dollars — you are not signing up for a subscription to use this feature.

• OpenAI (ChatGPT): create an account at platform.openai.com, generate an API key under API Keys in your account settings, and add a small amount of prepaid credit.
• Anthropic (Claude): sign up at console.anthropic.com, generate a key, and again a small prepaid balance covers a large number of reports given how compact a single audit summary is.
• Google (Gemini): Google AI Studio offers a genuinely free tier with generous rate limits for Gemini — for most individual users running the occasional report, this alone may never cost anything.
• DeepSeek: DeepSeek's API is priced aggressively low and is a solid option if you're running a large number of reports across many audits.

Whichever you choose, paste the key into Profile Settings once — it's saved (encrypted) for every future report, so you don't re-enter it each time.

Why not just give everyone free AI access ourselves?

Because that model doesn't survive contact with reality, and we'd rather tell you that plainly than pretend otherwise. A single shared API key either gets rate-limited into uselessness the moment more than a handful of people use the feature simultaneously, or it becomes a real, ongoing cost center that eventually has to be paid for somehow — through ads, a paywall on the feature, or worse, quietly monetizing user data. We've committed publicly, elsewhere on this site, to running no ad network at all. BYOK is what makes that commitment sustainable rather than aspirational: the AI feature costs SEO Loop literally nothing to operate, which means it can stay free and available indefinitely without ever needing to become a revenue line that pressures us to compromise on the free-tools mission.

There's a second, quieter benefit: your prompts and your audit data go directly from your browser session to the provider you personally chose and trust, under whatever data-handling terms that provider offers you directly — not filtered through a middleman's infrastructure and business incentives.

What you actually get back from a report

Not a re-statement of the checklist you already have in front of you — that would be pointless. The AI reads your full set of passed and failed checks (or, for a full-site crawl, the aggregated issue list across every page that was crawled) and writes a prioritized, plain-language action plan structured in four parts: a short overall health summary, the highest-priority fixes explained in terms of why they actually matter for your specific site rather than generically, quick wins that take minutes rather than hours, and longer-term strategic suggestions that go beyond anything a fixed checklist could ever surface, because it's reasoning about your specific combination of issues rather than checking boxes in isolation.

The security model, in plain terms

To be direct about exactly what we promise and how it holds up: your API key is encrypted at rest in our database using Laravel's standard encryption (AES-256), tied to our application's secret key. It is decrypted only in memory, only for the single moment it takes to attach it as an authorization header on the outbound request to your chosen provider, and it is never written to logs, error trackers, or anywhere else. If you delete the key from Profile Settings, it's gone — not soft-deleted, not archived, actually removed from the database. If you delete your account entirely, every associated key and every generated report is deleted along with it, described in full in our Data Policy.

Is this actually cheaper than a paid competitor's built-in AI feature?

For nearly everyone, yes, by a wide margin. A single audit-summary prompt is short — audit check results are compact structured data, not a full page of raw HTML — so the token cost per report is small, typically a fraction of a cent to a few cents depending on the provider and model. Compare that to a monthly SaaS subscription that bundles in an AI feature you might use a handful of times, and BYOK usually wins decisively for anyone who isn't running hundreds of reports a day.

Add a key at your Profile Settings right now, then generate a report from any existing or new audit — it takes about the same time as reading the result once it's back.

Choosing between the four providers

There's no universally "best" choice — it depends on what you already use and what's cheapest for your volume. If you already have a ChatGPT Plus or API account for other work, reusing that key is the path of least friction. If you care most about not paying anything at all for occasional use, Gemini's free tier through Google AI Studio is the most generous starting point. If you're running reports at real volume across dozens of client audits, DeepSeek's low per-token pricing will noticeably beat the others on total cost. Claude tends to produce especially well-structured, clearly reasoned prose for this kind of analytical writing task, which matters if you're forwarding the report directly to a client with minimal editing.

What if you don't want to add a key at all

Nothing else on SEO Loop requires it. Every check, every score, every category breakdown in a Site Audit works exactly the same with or without an AI key configured — the AI report is a genuinely optional layer on top, not a gate in front of the core feature. If you'd rather read the raw checklist yourself, or paste it into whatever AI tool you already use elsewhere, that works exactly as well; we're not trying to lock you into our specific integration.

What happens to old reports if you remove your key

Reports you've already generated stay saved and viewable on their audit page — removing your key only stops you from generating new ones going forward, it doesn't retroactively delete past reports. If you want those gone too, deleting the underlying audit report removes any AI analysis attached to it, and deleting your account removes everything at once.

A note on rate limits and failures

Free tiers, by their nature, sometimes rate-limit you during high demand. If a report generation fails, it's almost always the provider's API responding with an error rather than anything wrong on our end — the same request usually succeeds on a retry a minute later. We show you the provider's error message directly rather than a generic failure, specifically so you know whether it's worth retrying immediately or waiting.

Why we're telling you all of this instead of just shipping the feature quietly

Most products don't explain their architecture decisions this openly — they just ship a feature and let you assume whatever you want about how it works behind the scenes. We're doing the opposite here on purpose. If a tool is going to touch something as sensitive as an API key you're trusting us with, you should be able to understand exactly what happens to it without needing to take our word for it on faith. That's the same reasoning behind writing a real, specific Privacy Policy and Data Policy instead of generic legal boilerplate nobody reads — the goal is that you could, in principle, verify every claim made in this post against the actual behavior of the product, not just believe it because we said so.

One more practical tip: set a small spending cap or usage alert on whichever provider account you connect, available through each provider's own billing dashboard. It costs nothing to set up, takes a couple of minutes, and means you'll never be surprised by usage even if you end up generating far more reports than you originally expected to.

And if a provider ever changes its pricing or terms in a way you're not comfortable with, switching which key you've added takes seconds in Profile Settings — you're never locked into one provider by this design, which is very much the point of building it this way.