Cloudflare AI Gateway: what the proxy does and what it does not

What it is, precisely

Cloudflare AI Gateway is an observability and control layer for AI traffic. You change your base URL, your requests route through Cloudflare on the way to the provider, and Cloudflare records what happened and applies whatever policies you configured.

The distinction that matters when you are comparing gateways: by default there is no Cloudflare wallet in the loop. Your OpenAI key still bills your OpenAI account. Cloudflare sees the request, caches it, counts it, and forwards it. That is a different product shape from OpenRouter or Vercel AI Gateway, where the vendor holds the provider relationship and you buy credits from them.

Cloudflare states these work across 20+ supported AI providers, including Workers AI, OpenAI, Anthropic, Google Gemini, and Replicate.

The two ways to call it

There are three integration shapes in the docs and one of them is on the way out. Pick the OpenAI-compatible endpoint unless you have a reason not to.

OpenAI-compatible endpoint (recommended)

curl -X POST \
  https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat/chat/completions \
  -H 'cf-aig-authorization: Bearer {CF_AIG_TOKEN}' \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "openai/gpt-5.2",
    "messages": [{"role": "user", "content": "What is Cloudflare?"}]
  }'

const client = new OpenAI({
  apiKey: "{cf_api_token}",
  baseURL: "https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat",
});

const response = await client.chat.completions.create({
  model: "anthropic/claude-4-5-sonnet",
  messages: [{ role: "user", content: "Hello, world!" }],
});

Provider-native passthrough

Append the provider slug to your gateway URL and send the provider's own request body unchanged. This is the route when you need a provider feature the OpenAI schema cannot express.

Universal Endpoint (deprecated)

The Universal Endpoint took an array of provider objects and walked down it on failure, reporting which entry succeeded in the cf-aig-step response header. It still works and the documentation still describes it, but Cloudflare now recommends the OpenAI-compatible endpoint for new integrations. Do not build new fallback chains on it.

Setting one up

export OPENAI_BASE_URL="https://gateway.ai.cloudflare.com/v1/$CF_ACCOUNT_ID/$CF_GATEWAY_ID/compat"

What it costs

Unified Billing, and when it is worth 5%

Unified Billing is Cloudflare's answer to "I do not want six provider accounts". You buy credits, Cloudflare pays OpenAI, Anthropic, Google AI Studio, Google Vertex AI, xAI, and Groq on your behalf, and you get one bill. Provider inference passes through at their rates; the 5% applies to the credit purchase.

It does not replace BYOK. The credential precedence stays: request-level key first, stored BYOK key second, Unified Billing last. So you can run most traffic on your own OpenAI contract and let Unified Billing catch the two providers you have not opened accounts with.

The honest limits

• It is a proxy, not a catalogue. Outside Unified Billing's six providers, you still open and manage every provider account yourself. If the reason you want a gateway is "one key for everything", this is only two-thirds of that.
• The Workers Free log cap is tight. 100,000 logs across all gateways, total, not per month per gateway. A moderately busy agent fleet burns that in days, and logs are the whole point of putting a gateway in the path.
• Guardrails are metered inference. Evaluating long prompts with a Workers AI model is not free, and the cost scales with exactly the traffic you most want to inspect.
• Unified Billing is six providers. Not twenty. Check yours is on the list before planning a migration around it.
• The Universal Endpoint is deprecated while remaining the shape most third-party tutorials teach.
• The account and gateway IDs are in the URL. That is fine, but it means rotating a gateway is a config change everywhere, not a key rotation.

Questions people ask

Keep reading

Continue through LLM gateways and routing with Databricks AI Gateway: Mosaic AI Gateway is now Unity AI Gateway.