Managed only Proprietary

Cloudflare AI Gateway Cloud platform

Cloudflare AI Gateway is a cloud AI platform with a single API in front of 24 upstream providers; it publishes no model count. There is no token markup or per-seat fee; the paid surface is a 5% credit-purchase fee. It cannot be self-hosted. It publishes neither zero data retention nor a HIPAA BAA. You can point it at your own provider accounts. It handles failover, guardrails and request logging.

· 34 of 113 fields dated · 48 sources

Built by Cloudflare, founded 2009 · US company

Compare with others Estimate cost Visit site ↗

Access at a glance

Whether this product can work for you at all, before features matter: who pays the model bill, where it can run, and which of your existing API calls keep working. Every value is the vendor’s own claim, linked to the page it came from.

Cloudflare positions AI Gateway as the way to "gain visibility and control over your AI apps", gathering "insights on how people are using your application with analytics and logging" and controlling scale with "caching, rate limiting, as well as request retries, model fallback, and more" (AI Gateway overview, 2026-04-20). Functionally it is an observability plane that also proxies, exposing "an OpenAI-compatible /chat/completions endpoint" for "integration with multiple AI providers using a single URL" (Unified API (OpenAI compat), 2026-08-07).

Who pays the model bill

Your keys or their credits

You can start on their credits and move to your own provider accounts later.

BYOK lets you "securely store your AI provider API keys directly in the Cloudflare dashboard" (BYOK (Store Keys), 2026-07-31), while Unified Billing runs usage against Cloudflare account credits (Unified Billing; AI Gateway pricing, 2026-05-19). Provider credentials take precedence over Unified Billing credits when both exist (Unified Billing).

Merchant of record: Split by mode: with BYOK the upstream provider bills the customer's own account; with Unified Billing Cloudflare invoices, applying "a 5% fee… to all credits purchased through Unified Billing" (a $100 credit purchase results in a $105 charge) while "inference pricing from providers is passed through with no markup — you pay the same per-token rates as you would directly with the provider" (AI Gateway pricing, 2026-05-19; Unified Billing). Guardrails usage "is billed as Workers AI token-based inference" (AI Gateway pricing). An explicit statement of the invoicing entity for provider tokens: n.a.

Key handling: Stored provider keys live in Cloudflare Secrets Store, which gives "secure storage and limit exposure", "easier key rotation" and pairing with "rate limit, budget limit and other restrictions with Dynamic Routes"; dashboard-created secrets are named automatically, API-created secrets must follow the required naming convention because "the secret_id returned by Secrets Store is not used by AI Gateway for runtime lookup" (BYOK (Store Keys), 2026-07-31). Multiple keys per provider are supported, each with an alias (default when unspecified), selectable per request via cf-aig-byok-alias; the dashboard shows keys by provider with last-used time and active/expired/invalid status, rotation takes effect immediately "without any code changes or downtime", and keys can be deleted (BYOK (Store Keys)). Because it is hosted-only, requests transit Cloudflare and can be persisted as logs (with plan-based storage caps and free DLP scanning); the overview notes logging gives "insight on requests and errors" but does not state whether Cloudflare stores request content by default (AI Gateway pricing, 2026-05-19; AI Gateway overview, 2026-04-20).

Where it can run

1 of 5 shapes documented
  • Vendor-hosted
  • Self-host
  • Your VPC
  • On-premise
  • Air-gapped

Dimmed shapes are not documented by the vendor, which is not the same as unsupported.

hosted SaaS on Cloudflare's network only, "available to use on all plans" (AI Gateway pricing, 2026-05-19; AI Gateway overview, 2026-04-20). Self-host, hybrid/VPC, on-prem, air-gapped: n.a.

No installation: "The default gateway is created automatically on your first request — no setup needed", and a specific gateway ID can replace default; the endpoint embeds the Cloudflare account ID ("Replace {account_id} with your Cloudflare account ID") (Unified API (OpenAI compat), 2026-08-07). Tier gating is on ancillary features, not deployment: core features (dashboard analytics, caching, rate limiting) and DLP scanning are free on all plans; persistent-log storage is capped at 100,000 logs total on Workers Free vs 10,000,000 logs per gateway on Workers Paid; Logpush is "only available on the Workers Paid plan" (10 million requests/month included, then $0.05/million) (AI Gateway pricing, 2026-05-19).

API surfaces your code can keep using

2 of 7 documented
  • OpenAI chatPOST /v1/chat/completionsYes

    An OpenAI-compatible unified endpoint at /compat/chat/completions (provider-native routes also accept paths such as /v1/chat/completions), with models addressed in {provider}/{model} form, e.g. openai/gpt-5-mini, google-ai-studio/gemini-2.5-flash, anthropic/claude-sonnet-4-5 (Unified API (OpenAI compat), 2026-08-07; Custom providers).

  • Anthropic messagesPOST /v1/messagesYes *

    Yes via provider-native passthrough: Anthropic is a supported provider whose native endpoint is proxied (Provider Native, 2026-04-20). The specific /v1/messages path is not shown on the pages fetched: n.a.

  • OpenAI ResponsesPOST /v1/responsesNot documented

    n.a. (not documented on the pages fetched).

  • EmbeddingsPOST /v1/embeddingsNot documented *

    n.a. as a documented gateway path; embedding-capable providers (Cohere, Workers AI, Google) are proxied provider-natively (Provider Native, 2026-04-20).

  • ImagesPOST /v1/images/generationsNot documented *

    n.a. as a documented gateway path, though image providers (Fal AI, Ideogram, Replicate) are supported provider-natively (Provider Native, 2026-04-20).

  • AudioPOST /v1/audio/*Not documented *

    n.a. as a documented gateway path; audio providers are supported provider-natively — Deepgram and ElevenLabs (STT/TTS) and Cartesia (Provider Native, 2026-04-20).

  • Batch jobsPOST /v1/batchesNot documented

    n.a.

An asterisk marks a qualified verdict: support that is indirect (SDK compatibility or provider passthrough rather than a native endpoint), or a gap that is narrower or wider than the label suggests. Read the note before porting.

Two modes: a unified OpenAI-compatible endpoint where you switch providers by changing the model and apiKey parameters (examples use the OpenAI JS SDK), and provider-native pass-through where you keep the provider's own request format and paths (Unified API (OpenAI compat), 2026-08-07; Provider Native, 2026-04-20). Gateway-level auth adds a cf-aig-authorization header, and when using stored keys you "remove provider authorization headers from your requests" while still passing cf-aig-authorization; a non-default stored key is selected with cf-aig-byok-alias (BYOK (Store Keys), 2026-07-31). Streaming caveats: n.a.

How much it reaches

ModelsNot published
Upstream providers24

Providers: Counted from the vendor’s own published list; no aggregate total is published.

n.a.: no model total is published; the overview only invites users to "explore all AI models available through AI Gateway" (AI Gateway overview, 2026-04-20).

24 providers are listed by name — Workers AI, Amazon Bedrock, Anthropic, Azure OpenAI, Baseten, Cartesia, Cerebras, Cohere, Deepgram, DeepSeek, ElevenLabs, Fal AI, Google AI Studio, Google Vertex AI, Groq, HuggingFace, Ideogram, Mistral AI, OpenAI, OpenRouter, Parallel, Perplexity, Replicate, xAI — with no stated total (Provider Native, 2026-04-20).

Whose models: Documented mix: mostly third-party routed providers, plus Cloudflare's own Workers AI as a supported provider, and Guardrails inference runs on Workers AI using @cf/meta/llama-guard-3-8b (Provider Native, 2026-04-20; AI Gateway pricing, 2026-05-19).

Your own endpoints: Yes: register a Custom Provider via the API or "Compute & AI > AI Gateway > Custom Providers" with a unique slug and an HTTPS base_url, and self-hosted models are explicitly supported; management calls need a Cloudflare API token with AI Gateway - Edit (Custom providers). vLLM/Ollama/SageMaker by name: n.a.

How it behaves in production

What happens when an upstream model is slow, wrong, or down — and what you can see and stop while it happens. Reliability features are recorded as where you configure them, not whether the vendor lists them, because almost every product here lists all of them.

3 of 6 reachable from code4 of 4 can block3 documented destinations

When something goes wrong

Each row says where the knob is, not whether the feature is on the marketing page. A control you can only reach by hand in someone else’s dashboard cannot be reviewed or version-controlled.

  • Request timeoutPer request

    Your application decides per call, so one noisy endpoint can have its own timeout without a redeploy.

    Header cf-aig-request-timeout, set on a provider-specific endpoint, in milliseconds. Behavior is first-response based: as long as the first part of the response returns in time, "such as when streaming a response", the gateway waits. Default value not stated (Cloudflare AI Gateway request handling).

  • RetriesPer request

    Also available:Dashboard only

    per_request plus dashboard_only defaults. Headers cf-aig-max-attempts, cf-aig-retry-delay (ms, max 5 seconds) and cf-aig-backoff (constant | linear | exponential), with "a maximum of five retry attempts". "On the final retry attempt, your gateway will wait until the request completes, regardless of how long it takes." Gateway-level defaults ("up to 5 attempts", constant/linear/exponential, 100ms–5s delay) apply to all requests and can be overridden per request. The default attempt count itself is not published: n.a. (Cloudflare AI Gateway request handling, Cloudflare auto-retry changelog).

  • Fallback to another modelPer request

    ORDERED, expressed as an array of request objects to the Universal Endpoint: "You can add as many fallbacks as you need, just by adding another object in the array", and the response header cf-aig-step reports which step served (0 primary, 1 second model, 2 third, incrementing per fallback). No weighted split at this layer, and the fallback key itself is not named (Cloudflare AI Gateway fallbacks).

  • Load balancingDashboard only

    Only reachable by hand in the vendor UI, so it cannot be reviewed, version-controlled, or changed from code.

    dashboard_only (plus JSON config), via Dynamic Routing: the Percentage node "Routes requests probabilistically across multiple outputs", i.e. weighted-by-percentage splitting; Rate Limit and Budget Limit nodes "switch to fallback when exceeded". Routes are built in a visual interface or JSON-based configuration (Cloudflare Dynamic Routing). The product page adds "Automatically route requests based on latency, cost, or availability" (Cloudflare AI Gateway product page).

  • Upstream health trackingNot documented

    The vendor does not document this, so any behaviour you observe today is unversioned and may change.

    There is no upstream health check, circuit breaker or provider-ejection control; the documented mechanism is retry-then-fallback on error (Cloudflare auto-retry changelog).

  • Cross-region failoverFixed, cannot change

    The behaviour is fixed by the vendor. Predictable, but you cannot tune it for your workload.

    Cloudflare runs the network: the Gateway Worker "operates near the user's location" on "Cloudflare's vast network of data centers", but no user-configurable cross-region failover exists (Cloudflare AI Gateway scaling blog).

Fallback chain: Weighted split — Traffic splits by percentage across targets, so you can shift 5% to a new model and watch it before committing.

Defaults: per_request plus dashboard_only defaults. "On the final retry attempt, your gateway will wait until the request completes, regardless of how long it takes." Gateway-level defaults ("up to 5 attempts", constant/linear/exponential, 100ms–5s delay) apply to all requests and can be overridden per request.

Two different retry/fallback surfaces coexist: header-driven retries with cf-aig-* on provider endpoints, and node-based Dynamic Routing where a fallback is a graph edge. The scaling blog also shows an older-style "retry": 2 / "delay": 200 / "onComplete" JSON shape, which does not match the header names in the current docs (Cloudflare AI Gateway scaling blog, Cloudflare AI Gateway request handling).

How fast the hop is

Edge worker

Runs in a V8 isolate at the network edge, so the routing hop is cheap and starts fast, but you cannot run it inside your own network.

Explicitly built on Cloudflare Workers ("a serverless platform that runs on the Cloudflare network"), with a Gateway Worker and Durable Objects (each Account Manager with its own SQLite database) for logging (Cloudflare AI Gateway scaling blog).

You can run the request path yourselfNo
StreamingYes

No self-host artifact; usage is via the gateway URL or Workers bindings such as env.AI.gateway("my-gateway").getUrl("openai") (Cloudflare AI Gateway product page).

Streaming caveats: Supported. Caveat tied to the timeout semantics: cf-aig-request-timeout is evaluated on the first part of the response, so once streaming starts the gateway will wait for the rest (Cloudflare AI Gateway request handling).

Published figures, grouped by what each one measured. Figures in different groups are different quantities and cannot be compared with one another — nor, in most cases, with another vendor’s figure in the same group.

Marketing claim, not a measurement

Fleet totals and unquantified claims. Recorded here because it is all the vendor published, not because it means anything operationally.

  • over 2B requests/yearfleet totalVendor-published

    Aggregate proxied volume in one year, not a capacity benchmark.

    Source

Vendor-published operational statistics only; no benchmark and no claims about competitors (Cloudflare AI Gateway scaling blog).

What it will stop

4 of 4 can block

Two separate questions per control: can it stop a request at all, and what does it do before you change any settings? A control that inspects and forwards is a logging feature, however it is named.

  • Personal data in promptsCan block the request

    Out of the box: You pick the action when configuring

    AI Gateway DLP scans prompts and responses in real time using Cloudflare's DLP detection engines and account-level profiles. On Block, "the provider response is discarded and replaced with a DLP error response (status 400)"; on Flag, findings are attached to the cf-aig-dlp response header and logged while the original response is still returned. The page does not state that DLP redacts (DLP)

  • Prompt injection and jailbreaksCan block the request

    Out of the box: You pick the action when configuring

    Prompt-injection detection uses the Workers AI model @cf/meta/prompt-guard-2-86m, exposed as category P1 with per-category Flag / Ignore / Block actions (Guardrails, Guardrails usage considerations)

  • Harmful contentCan block the request

    Out of the box: You pick the action when configuring

    Llama Guard 3 8B on Workers AI evaluates hazard categories S1–S13 inline, again with Flag / Ignore / Block per category (Guardrails)

  • Your own policiesCan block the request

    Out of the box: You pick the action when configuring

    Custom policy takes the form of Cloudflare One DLP detection profiles (predefined or custom) selected at the gateway level; "There is no per-request header to select specific DLP profiles or to bypass DLP scanning", and different policies require separate gateways (DLP)

Where checks runOn the vendor's servers
If the guardrail itself failsYou choose

Documented per action rather than per outage: with a category set to Block, "the request will be blocked" (fail closed for that category), while Flag returns the response and records the finding (fail open) (Guardrails usage considerations, DLP). Behaviour when the guardrail model itself is unavailable is not_documented

Two enforcement caveats matter. Guardrails do not enforce on streaming responses — streaming traffic is evaluated/logged through the REST path but not blocked (Guardrails usage considerations). DLP on streaming SSE responses "buffers the full streamed response before scanning", which removes the latency benefit of streaming, while request-only scanning avoids that cost; base64 images, external URLs, and binary multipart data are not inspected (DLP).

What you can see

Exports to a few places
What gets loggedFull prompts and responses

Prompt and completion bodies are stored by default. Powerful for debugging, and a data-residency question you have to answer before you ship.

You can turn bodies offYes

cf-aig-collect-log-payload: false keeps the log entry as metadata only, and cf-aig-collect-log: false disables the log entry for that request (Logging)

TracesNot documented

n.a. — no OpenTelemetry or agent-trace representation documented for AI Gateway (Logging)

Logging is enabled by default and includes prompt and response payloads, along with DLP FLAG/BLOCK fields (Logging)

Where telemetry can go

  • Logpush
  • R2
  • Webhook

Workers Logpush to R2 and other object-storage/HTTP destinations, limited to 10 million logs per gateway across up to 4 Logpush jobs (Logpush)

Records user feedbackYes
Scores live trafficYes

Yes — the response header cf-aig-log-id identifies the log entry, and a PATCH to the AI Gateway logs API records feedback (for example -1 for negative), requiring an API token with AI Gateway - Edit/Write (Add human feedback using API)

Yes, on Cloudflare's platform — Evaluations run against datasets built from filtered logs, reporting performance, speed, and cost; human feedback is the first evaluator and is in open beta (Evaluations)

Retention: Storage-limit driven and configurable: when the gateway's log limit is reached, the oldest logs are automatically deleted (Logging)

Whether it fits how you work

How much work stands between you and a first call, how different that is from running it in production, and whether it slots into the stack you already have. Recorded as the shape of the work rather than a number of minutes — how long it takes you depends on which accounts and quota you already hold, which no comparison can know.

to try: cloud console setupto run: cloud console setupfits 4 of 10 common stacks

Getting to a first call

13 numbered steps
Shape of the workSet it up in a cloud console

You cannot start from an empty editor. An account, a project or a deployed resource has to exist first, and that step is done by hand.

Read off: the vendor’s own quickstart — 13 numbered steps.

13 entries spread across three separate numbered lists (2 + 7 + 4), so no single steps-to-first-call figure exists.

Before step one

Everything you need first: A Cloudflare account, your Account ID, and a Cloudflare API token with "AI Gateway - Read", "AI Gateway - Edit" and "Workers AI - Read" permissions. No credit card, cloud account, cluster or provider key stated; pricing page says "all it takes is a Cloudflare account and one line of code to get started." (Getting started · Cloudflare AI Gateway docs, Pricing · Cloudflare AI Gateway docs)

Copyable snippet: none published. Copy-pasteable completion request was rendered on the fetched pages; the documented request shape is a Workers AI model with the @cf/ prefix plus header cf-aig-gateway-id: default, and the unified API exposes an OpenAI-compatible /chat/completions endpoint where you "replace {account_id} with your Cloudflare account ID" (Getting started · Cloudflare AI Gateway docs, Unified API (OpenAI compat) · Cloudflare AI Gateway docs)

Running it in production

The same scale applied to the path the vendor recommends for production traffic. Kept separate from the quickstart because for several products here the two are barely related pieces of work.

Shape of the workSet it up in a cloud console

You cannot start from an empty editor. An account, a project or a deployed resource has to exist first, and that step is done by hand.

What production needs: n.a. (not documented): "Production infrastructure requirements: None stated." Prepaid AI Gateway credits are mentioned for unified billing (Pricing · Cloudflare AI Gateway docs, Getting started · Cloudflare AI Gateway docs)

Can you run it yourself

Install command publishedNo self-hosting

This runs on the vendor’s infrastructure only.

How it fits your stack

4 of 10

Each row is a thing you might already run. “With a caveat” means it works but not the way the vendor’s marketing implies — read the reason, because that is usually where the surprise lives.

  • FitsThe OpenAI SDKDrop-in once set up — but first-call work is cloud console setup.
  • FitsThe Vercel AI SDKai-gateway-provider
  • FitsCloudflare WorkersCalling it from a Worker is documented.
  • NoKubernetesNo Kubernetes deployment published.
  • FitsTerraform or OpenTofucloudflare/cloudflare with cloudflare_ai_gateway and cloudflare_ai_gateway_dynamic_routing
  • NoAn existing API gatewayNothing published about running behind your gateway.
  • NoCloud IAM I already runStatic upstream credentials only. Your calls to it still use its own key.
  • With a caveatLangChain or LlamaIndexLlamaIndex only.
  • With a caveatMCP servers to governMCP tools in the API — governs nothing on your side.
  • NoNothing — plain Node or PythonA cloud console or resource has to exist before your first call.

Reading this the other way round — pick what you already run and see every product scored against it.

The integration surfaces behind those answers

  • Vercel AI SDKOfficial provider package

    Install the package, swap the model factory, done. Maintained by a party with a stake in it.

    Named: ai-gateway-provider

    Vercel AI SDK integration is documented through the ai-gateway-provider npm package. The package provides createAiGateway, createUnified, createOpenAI, createAnthropic, createGoogle, and createXai; Cloudflare Workers usage can also use workers-ai-provider. (Cloudflare AI Gateway full documentation)

  • Cloudflare WorkersDocumented from your Worker

    The docs show calling this product from inside a Worker, including the runtime flags you need.

    Cloudflare Workers support is documented through the env.AI binding, including env.AI.run() and env.AI.gateway(), third-party models, Workers AI models, logging, feedback, metadata, and gateway configuration. Workers AI can also integrate with AI Gateway by adding a gateway object to a Workers AI request; the gateway must be in the same account as the Worker. (Cloudflare AI Gateway full documentation)

  • KubernetesNot documented

    No Kubernetes story published.

    n.a. (not documented)

  • TerraformOfficial Terraform provider

    You can manage this product as first-class Terraform resources, versioned on the Registry.

    Named: cloudflare/cloudflare with cloudflare_ai_gateway and cloudflare_ai_gateway_dynamic_routing

    Official Terraform support is documented through the cloudflare/cloudflare provider. Documented resources include cloudflare_ai_gateway and cloudflare_ai_gateway_dynamic_routing, with the latter documented at registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/ai_gateway_dynamic_routing. (Terraform Cloudflare AI Gateway resource)

  • Existing API gatewayNot documented

    Nothing published about sitting behind an existing gateway. Treat it as a separate hop you route to yourself.

    n.a. (not documented)

  • Cloud identityStatic provider credentials only

    You paste static provider credentials into this product so it can reach upstream models. Your own calls to it still use its own API key, and those pasted secrets are yours to rotate.

    Amazon Bedrock support is documented with AWS SigV4 credentials, including accessKeyId, secretAccessKey, region, and an optional AWS STS sessionToken. Google Vertex AI supports service-account JSON credentials or direct GCP access tokens, including GCP service-account authentication; Azure OpenAI documentation specifies an Azure OpenAI API key rather than Entra or managed identity. (Cloudflare AI Gateway full documentation)

  • MCPMCP tools in the API

    The completion API accepts MCP tool definitions, so the model can call MCP tools. A model capability, not an MCP control plane.

    Cloudflare Agents explicitly support MCP tools, but an AI Gateway MCP server, MCP gateway or registry, and dedicated MCP tool proxy are not documented. Separately, Cloudflare Zero Trust documents MCP server portals that proxy upstream MCP tools and prompts behind one HTTP endpoint at /mcp. (Cloudflare MCP server portals)

Python frameworks
  • LlamaIndex

LlamaIndex integration is documented through the llama-index-llms-cloudflare-ai-gateway package and the CloudflareAIGateway class (Bases: LLM). LangChain support for Cloudflare AI Gateway is not documented in the provided evidence. (LlamaIndex Cloudflare AI Gateway integration)

First-party client libraries
  • JavaScript
  • Python

Documented clients include the OpenAI SDK for JavaScript and Python; Anthropic SDK for JavaScript and Python; @google/genai; @mistralai/mistralai; the Cohere Python SDK; Groq SDK for JavaScript; HuggingFace @huggingface/inference; Fal AI @fal-ai/client; ai-gateway-provider for the Vercel AI SDK; and Cloudflare Workers env.AI bindings. (Cloudflare AI Gateway full documentation)

Agent features: The provided Cloudflare documentation describes function calling and tool use through supported models and provider tools, Agents SDK sessions, durable state, WebSockets, scheduling, recoverable execution, and multi-step agent harnesses controlling planning, tool use, tool results, streaming, and continuation. A2A is not documented. (Cloudflare AI Gateway full documentation)

Gateway creation can be skipped: the cf-aig-gateway-id: default header auto-creates the default gateway on the first authenticated request. Workers AI requests use Standard billing by default and can be switched to Unified billing (Getting started · Cloudflare AI Gateway docs)

AI Gateway is operated through a Cloudflare account and dashboard/control plane, with Cloudflare API tokens, gateway configuration, billing, logging, analytics, and provider-key management. It supports Workers AI, Anthropic, Google Gemini, OpenAI, Replicate, custom providers with HTTPS endpoints and custom domains, caching, rate limiting, retries, DLP, OpenTelemetry, and Stripe-related configuration; self-hosting and on-premises deployment are not documented. (Cloudflare AI Gateway full documentation)

Silence in the docs: 2 of the integration questions on this card have no published answer either way. That is recorded as undocumented, not as a no — but it does mean you would be verifying it yourself.

What it does well

  • Core gateway features are free on every Cloudflare plan, with no markup on provider tokens
  • Free DLP scanning for PII, financial and healthcare data, plus llama-guard-based guardrails
  • Dynamic Routing gives visual, code-free routing by user segment, geography, content or A/B split
  • Spend limits scoped by model, provider or custom metadata, with automatic blocking
  • Edge caching claimed to cut latency up to 90% and analytics via GraphQL API

Where it falls short

  • Upstream provider list (~23) is far narrower than OpenRouter or Requesty, and no model count or public catalog endpoint is published
  • Unified Billing adds a 5% fee on credit purchases
  • No published SOC 2 / HIPAA / ZDR posture specific to AI Gateway
  • Log storage caps (100k on Workers Free) and Logpush restricted to Workers Paid

Choose it when

Teams already on Cloudflare Workers who want free caching, analytics, spend limits, DLP and guardrails at the edge.

Look elsewhere when

You need a broad model marketplace, a public pricing catalog endpoint, or documented gateway-level compliance commitments.

Cloud platform: A hyperscaler surface offering several vendors models under one contract, one bill, and one identity system. Strong compliance story, limited to that cloud.

How hard is it to leave?

Derived from six published facts, not from an opinion. The weights are fixed and the same for every product — see the arithmetic.

58/78Some work to leave
Portability score breakdown for Cloudflare AI Gateway
What helps you leave Points Source
Works with standard OpenAI codeSwitching away is a base-URL change rather than a rewrite of every call site.not published—
No vendor-specific SDK requiredA proprietary client library spreads through your codebase and has to be torn out again.10/10 vendor page
Can use your own provider accountsYour keys and billing relationship stay yours, so removing the gateway does not cut off model access.20/20 vendor page
Can be self-hostedYou can run it yourself instead of accepting a pricing or policy change.0/20 vendor page
Configuration lives in version controlRouting and budget rules are a file you keep, not dashboard state you would have to rebuild.16/16 vendor page
Your request history can be exportedYou leave with your own logs instead of abandoning them.12/12 vendor page

1 of the 6 inputs is not published, so the highest reachable score here is 78 rather than 100. That is a gap in the public documentation, not a mark against the product — no points are deducted, they simply cannot be claimed. This measures technical switching cost only. It does not price the engineering time to re-test prompts against a different routing stack.

Full specification

Every field we track. Blank fields say "Not published" rather than "No" — we do not infer an absence from silence. Switch to Technical in the header for the precise field names and the low-level details.

Overview

What kind of product Category
Cloud platform Not verified
Marketplaces resell many providers behind one key. Gateways add governance on top. Open-source projects you run yourself. Cloud platforms are hyperscaler surfaces. Inference providers host models on their own hardware.
Who runs it Deployment model
Managed only Verified 3 days ago
Managed means the vendor operates it. Self-host means you run it on your own infrastructure. Both means you can choose.
Licence Licence
Proprietary Verified 3 days ago
Proprietary products cannot be inspected or forked. Open licences such as MIT and Apache-2.0 let you audit, modify, and run the code without permission.
Company Company
Cloudflare Not verified
The organisation that maintains the product.
Who you would be signing with Vendor status
Large cloud vendor product Not verified
Whether the product is still an independent company, has been acquired, is a large cloud vendor’s product line, is run by a software foundation, or has been put into maintenance mode. Maintenance mode means bug fixes and security patches only — no new features.
Last shipped an update Latest release
2026-08-19 Not verified
The date of the most recent release or version tag. A product that has not shipped in a year is a different risk from one that shipped last week, regardless of what its marketing site says.
GitHub stars GitHub stars
Not published Not verified
A rough proxy for community size on open-source projects. Not a quality measure.

Cost

Markup on model prices Token markup
None Verified 3 days ago
How much the product adds on top of what the underlying model provider charges. Zero means you pay the same per-token price you would pay the model provider directly.
Fee to add funds Credit purchase fee
5% Verified 3 days ago
A percentage charged when you top up your balance, separate from token prices. It is easy to miss because it does not appear on the per-token price list.
Monthly cost per person Seat fee
None Verified 3 days ago
A recurring per-user platform charge that applies regardless of how much you use the models.
Can use your own provider accounts BYOK supported
Yes Verified 3 days ago
Bring Your Own Key: you keep direct contracts with OpenAI, Anthropic and others, and the gateway only routes traffic. This preserves negotiated rates and committed-spend discounts.
Cost of using your own accounts BYOK terms
BYOK is a built-in feature at no stated extra cost: provider keys are stored encrypted in Cloudflare and rotated without code changes across 20+ providers. Verified 3 days ago
What the product charges to route traffic through your own provider keys.
Free tier Free tier
AI Gateway core features (dashboard analytics, caching, rate limiting) are free on all plans; DLP scanning is free on all plans; Workers Free stores 100,000 logs total across gateways, Workers Paid 10,000,000 logs per gateway. Verified 3 days ago
What you can do without paying, useful for evaluation.
Enterprise plan from Enterprise plan from
Not published Not verified
Annual entry price for the enterprise tier, where one is published or credibly reported.
Cost to run it yourself Self-host cost
Not published Not verified
What self-hosting actually costs once you account for infrastructure and any paid tier.
How the vendor makes money Pricing model
Percentage on tokens or top-ups Not verified
The shape of the vendor’s bill: does the routing layer charge a percentage on top of tokens, a flat monthly fee, both, neither (because inference is the product), or nothing at all (open source with no paid tier).
How pricing works, briefly Pricing model detail
Free gateway core + credit top-up fee (Unified Billing, 5% on credit purchases) + plan-tied log/Logpush limits. Inference passed through at cost — 0% markup. Not verified
A one-paragraph description that covers the caveats a pricing category cannot: introductory rates, per-feature meters, tier gating, and pricing that resets on a specific date.
Minimum commitment Minimum commitment
None stated. Enterprise customers reach out to their account team. Not verified
Whether the vendor requires a minimum contract term, a minimum spend, or a provisioned-capacity purchase to get its published rate.
Charges that fire after you go over an allowance Overage terms
The bite is on logs, not requests. Persistent log storage capped at 100,000 logs total across all gateways on Workers Free and 10,000,000 logs per gateway on Workers Paid, with automatic log deletion. Logpush is Workers Paid only, includes 10M requests/month then charges +$0.05/million. Guardrails usage is billed as Workers AI token-based inference. Not verified
The line items that scale with usage after an included allowance is exhausted — log storage, extra requests, per-feature meters, data export — which is where cost estimates usually go wrong.
Prompt cache offered Cache mechanism
Exact-match cache Not verified
Whether the gateway offers its own response cache, what kind of match it does (exact request, prefix, semantic), or simply passes provider caching through unchanged.
Discount on cached input Cache-read discount
Not published Not verified
How much cheaper cached tokens are than fresh input, when the vendor publishes a single figure. Bundled-inference clouds usually price this per model instead of as one number.
Premium on cache writes Cache-write premium
Not published Not verified
How much more the first write of a cached prefix costs versus a plain input token. A high write premium and a low hit rate can leave you paying more than you save, so this matters as much as the read discount.
Who captures the cache saving Cache economics
Exact-match caching: based on exact match of the entire request. Disabled by default. Serves cached provider responses from Cloudflare's cache. No differential cached-token pricing published. A cache hit skips the provider call entirely — customer captures the full saving and Cloudflare charges nothing for the cache itself. The only related cost is log storage of the cached requests. Not verified
Whether the customer keeps the full saving from caching or the vendor captures part of it — and any conditions attached (write premium, storage fees, best-effort hits).
What you can split spend by Cost attribution
Not stated. Not verified
The dimensions the vendor documents for splitting spend — per key, per user, per team, per tag, per customer. Matters if you need to chargeback internally or bill an end customer.
How you get cost data out Cost export
Logpush on Workers Paid (10M requests/month included, then $0.05/million). CSV, cost API, webhook and warehouse export not stated. Not verified
The mechanisms the vendor publishes for exporting cost and usage data: CSV, an API, webhooks, S3, a data warehouse, or nothing at all. Any per-unit price is included.
Who pays the model bill BYOK mode
Your keys or their credits Not verified
Whether you bring your own provider accounts (BYOK), buy inference from this vendor, or can do either. This is the single biggest commercial difference between these products: it decides who holds the contract with the model provider and who carries the spend.

Spend governance in detail

Seven signals matter when a bill starts to hurt: who can spend, how much, on what, and who gets paged when it goes wrong. Everything below is drawn from the vendor’s own pricing and docs pages — how we read these.

  • Virtual or scoped keysNot published

    Keys that carry their own budget and rate-limit policy, so an intern experiment cannot spend against a production budget.

    Not stated.

  • Budget caps per keyNot published

    A dollar or token ceiling attached to an individual key. Where enforcement is soft, one over-limit request still completes before the block kicks in.

    Not stated.

  • Budget caps per team or workspaceNot published

    A ceiling applied at a higher scope than one key — a team, a workspace, a customer, or an entire environment.

    Not stated.

  • Rate limiting as a cost controlYes — free

    Configurable request-per-time-window caps. Platform-set rate limits do not count as spend controls; user-configurable ones do.

    Supported, free on all plans, enforced pre-request.

  • Model allowlistsNot published

    A policy that constrains which models a key or team can call, keeping expensive frontier models out of the wrong hands.

    Not stated.

  • Spend alertsNot published

    Alerts fired as spend approaches a threshold. Alerts that only fire after the meter has rolled over are marked as such.

    Not stated; only stated monitoring is 'You can monitor your usage in the AI Gateway dashboard' (after-the-fact).

  • Webhook notificationsNot published

    Programmatic notifications on spend events, so budget breaches can page an on-call or open a ticket.

    Not stated.

Enforcement:Enforced before each request

Catalog

Models available Models available
Not published Not verified
How many models you can call, shown as a range because several vendors publish different totals on different pages. Vendor-reported either way, so counts are not directly comparable — some count every provider variant of the same model separately.
Model providers reachable Upstream providers
24 Verified 3 days ago
How many distinct model providers or labs you can reach, shown as a range where the vendor’s own pages disagree. More providers usually means better redundancy when one has an outage.
Works with standard OpenAI code OpenAI-compatible API
Not published Not verified
If yes, you can usually switch to it by changing one base URL, and switch away just as easily. This is the main defence against lock-in.
OpenAI chat endpoint POST /v1/chat/completions
Yes Not verified
The endpoint almost every application ports first. "Not documented" means the vendor never states it, which is different from a documented no.
Anthropic messages endpoint POST /v1/messages
Yes Not verified
Whether Anthropic-shaped calls work without rewriting them. Several products support this only as SDK compatibility or provider passthrough rather than a native endpoint — the detail page says which.
OpenAI Responses endpoint POST /v1/responses
Not documented Not verified
The newer stateful OpenAI surface. Support is much thinner across this market than chat completions.
Embeddings endpoint POST /v1/embeddings
Not documented Not verified
Whether you can generate vectors through the same gateway, or need a second integration for retrieval workloads.
Image generation endpoint POST /v1/images/generations
Not documented Not verified
Whether image models are reachable through the same surface as text.
Audio endpoints POST /v1/audio/*
Not documented Not verified
Speech-to-text and text-to-speech. Frequently the first gap in an otherwise complete gateway.
Batch jobs endpoint POST /v1/batches
Not documented Not verified
Asynchronous bulk processing, usually at a discount. Commonly undocumented, and commonly the reason a migration stalls late.
Needs the vendor’s own code library Requires a vendor-specific SDK
No Verified 3 days ago
A proprietary client library spreads through your codebase and has to be torn out again if you leave. “No” is the better answer here, and it means the standard OpenAI client works.
You can export your request history Logs / usage data export
Yes Verified 3 days ago
Whether you can get your own request logs, traces, or usage records back out — through an API, a bulk export, or a download. Decides whether you leave with your history or abandon it.
Settings can live in version control Declarative config-as-code
Yes Verified 3 days ago
Whether routing, fallback, and budget rules can be declared in a file you keep in Git, rather than existing only as settings clicked into a hosted dashboard.
Embeddings Embeddings
Not published Not verified
Text-to-vector models, needed for search and retrieval features.
Image generation Image generation
Yes Verified 3 days ago
Whether image models are reachable through the same interface.
Speech and audio Speech and audio
Yes Verified 3 days ago
Text-to-speech or transcription models through the same interface.
Video generation Video generation
Not published Not verified
Whether video models are reachable through the same interface.
Batch processing Batch processing
Not published Not verified
Submitting large jobs for cheaper, slower processing. Often 50% off for work that is not time-sensitive.

Routing & reliability

Uptime it promises in writing Contractual SLA uptime
Not published Not verified
The uptime percentage in a published, contractual service level agreement. A public status page is not an SLA — it reports what happened, it does not promise anything or pay you back when it breaks.
Automatic failover Automatic failover
Yes Verified 3 days ago
When a model provider goes down or rate-limits you, traffic moves to a backup automatically instead of returning errors to your users.
Load balancing Load balancing
Not published Not verified
Spreads requests across several providers or keys to raise your effective rate limit.
Rule-based routing Conditional routing
Yes Verified 3 days ago
Send different requests to different models based on rules — for example a cheap model for free users and a strong model for paying ones.
Response caching Response caching
Yes Verified 3 days ago
Reuses the answer when the exact same request comes in again, which cuts both cost and latency.
Similar-question caching Semantic cache
Not published Not verified
Reuses an answer when a new question means roughly the same thing as an earlier one. Saves far more than exact-match caching but can return subtly wrong answers if tuned loosely.
Where you set the timeout Request timeout surface
Per request Not verified

Header `cf-aig-request-timeout`, set on a provider-specific endpoint, in milliseconds. Behavior is first-response based: as long as the first part of the response returns in time, "such as when streaming a response", the gateway waits. Default value not stated ([Cloudflare AI Gateway request handling](https://developers.cloudflare.com/ai-gateway/configuration/request-handling/)).

Where a request timeout can be set: per request, in a config file, in the vendor dashboard, or nowhere. Nine of the twenty products documented here do not describe a request timeout at all, so the worst case of a hung upstream call is unknowable from the docs.
Where you set retries Retry policy surface
Per request Not verified

`per_request` plus `dashboard_only` defaults. Headers `cf-aig-max-attempts`, `cf-aig-retry-delay` (ms, max 5 seconds) and `cf-aig-backoff` (`constant` | `linear` | `exponential`), with "a maximum of five retry attempts". "On the final retry attempt, your gateway will wait until the request completes, regardless of how long it takes." Gateway-level defaults ("up to 5 attempts", constant/linear/exponential, 100ms–5s delay) apply to all requests and can be overridden per request. The default attempt count itself is not published: `n.a.` ([Cloudflare AI Gateway request handling](https://developers.cloudflare.com/ai-gateway/configuration/request-handling/), [Cloudflare auto-retry changelog](https://developers.cloudflare.com/changelog/post/2026-04-02-auto-retry-upstream-failures/)).

Where retry count and backoff are configured. Worth knowing alongside billing: a retried streaming call can be charged more than once.
Where you set fallbacks Fallback surface
Per request Not verified

ORDERED, expressed as an array of request objects to the Universal Endpoint: "You can add as many fallbacks as you need, just by adding another object in the array", and the response header `cf-aig-step` reports which step served (`0` primary, `1` second model, `2` third, incrementing per fallback). No weighted split at this layer, and the fallback key itself is not named ([Cloudflare AI Gateway fallbacks](https://developers.cloudflare.com/ai-gateway/configuration/fallbacks/)).

Where the fallback chain is defined. Almost every product claims fallback; the useful question is whether you can change it from code or only by hand in a dashboard.
Shape of the fallback chain Fallback shape
Weighted split Not verified
An ordered list tries targets in sequence; a weighted split sends a percentage of traffic to each, which is what you need to trial a new model on 5% of requests. Weighted splits are much rarer than the marketing implies.
Upstream health tracking Health checks / circuit breaking
Not documented Not verified

There is no upstream health check, circuit breaker or provider-ejection control; the documented mechanism is retry-then-fallback on error ([Cloudflare auto-retry changelog](https://developers.cloudflare.com/changelog/post/2026-04-02-auto-retry-upstream-failures/)).

Whether the product notices a failing upstream and stops sending traffic to it, and whether you can tune the thresholds. This is what turns a provider outage into a blip rather than a sustained error rate, and only four of the twenty expose it.
Cross-region failover you control Multi-region failover surface
Fixed, cannot change Not verified

Cloudflare runs the network: the Gateway Worker "operates near the user's location" on "Cloudflare's vast network of data centers", but no user-configurable cross-region failover exists ([Cloudflare AI Gateway scaling blog](https://blog.cloudflare.com/billions-and-billions-of-logs-scaling-ai-gateway-with-the-cloudflare/)).

Whether you can define what happens when a region degrades. A vendor running many regions is not the same as a vendor letting you configure failover between them; only three document a user-controlled mechanism.
Where you set load balancing Load balancing surface
Dashboard only Not verified

`dashboard_only` (plus JSON config), via Dynamic Routing: the **Percentage** node "Routes requests probabilistically across multiple outputs", i.e. weighted-by-percentage splitting; Rate Limit and Budget Limit nodes "switch to fallback when exceeded". Routes are built in a visual interface or JSON-based configuration ([Cloudflare Dynamic Routing](https://developers.cloudflare.com/ai-gateway/features/dynamic-routing/)). The product page adds "Automatically route requests based on latency, cost, or availability" ([Cloudflare AI Gateway product page](https://www.cloudflare.com/products/ai-gateway/)).

Where traffic distribution across upstreams or keys is configured.

Operations

Usage dashboards and logs Observability
Yes Verified 3 days ago
Built-in visibility into what was sent, what came back, what it cost, and how long it took.
Spending limits Budget controls
Yes Verified 3 days ago
Hard caps that stop spend before it becomes a surprise invoice. The single most valuable control for a small team.
Rate limits Rate limits
Yes Verified 3 days ago
Caps on request volume per key or per user, useful for protecting against abuse and runaway loops.
Separate keys per team or app Virtual keys
Not published Not verified
Issue scoped keys with their own budgets and permissions so you can attribute cost and revoke access without rotating everything.
Prompt versioning Prompt management
Not published Not verified
Store and version prompts outside your code so they can be changed without a deploy.
Quality testing Evals
Not published Not verified
Built-in tooling to score model output against test cases, so you can tell whether a model swap made things better or worse.
MCP support MCP support
Not published Not verified
Native support for the Model Context Protocol, the emerging standard for connecting models to external tools.
What gets logged Logged content
Full prompts and responses Not verified

Logging is enabled by default and includes prompt and response payloads, along with DLP FLAG/BLOCK fields ([Logging](https://developers.cloudflare.com/ai-gateway/observability/logging/))

Whether full prompts and responses are stored, only metadata, or nothing. Full-body logging is the most useful debugging feature here and the one most likely to need a conversation with your compliance team.
You can turn logging off Body-logging opt-out
Yes Not verified

`cf-aig-collect-log-payload: false` keeps the log entry as metadata only, and `cf-aig-collect-log: false` disables the log entry for that request ([Logging](https://developers.cloudflare.com/ai-gateway/observability/logging/))

Whether prompt and response bodies can be suppressed while still keeping usage metrics. Nineteen of the twenty document a way to do this; the mechanisms range from a per-request header to an organisation-wide setting.
Traces you can take elsewhere Distributed tracing
Not documented Not verified

`n.a.` — no OpenTelemetry or agent-trace representation documented for AI Gateway ([Logging](https://developers.cloudflare.com/ai-gateway/observability/logging/))

Whether the product emits OpenTelemetry, a proprietary format, or nothing. OpenTelemetry means the traces land in the tooling you already run instead of only in the vendor’s dashboard.
Where telemetry can go Export destinations
Logpush, R2, Webhook Not verified

Workers Logpush to R2 and other object-storage/HTTP destinations, limited to 10 million logs per gateway across up to 4 Logpush jobs ([Logpush](https://developers.cloudflare.com/ai-gateway/observability/logging/logpush/))

Documented sinks for logs and metrics. This is a good proxy for how replaceable the vendor’s own dashboard is: around twenty destinations means you never have to depend on it, while a CSV download means you do.
Can record user feedback Feedback capture API
Yes Not verified

Yes — the response header `cf-aig-log-id` identifies the log entry, and a `PATCH` to the AI Gateway logs API records feedback (for example `-1` for negative), requiring an API token with `AI Gateway - Edit`/Write ([Add human feedback using API](https://developers.cloudflare.com/ai-gateway/evaluations/add-human-feedback-api/))

Whether there is an API to attach a rating or score to a logged request, which is what lets production traffic feed quality work later.
Scores live traffic Online eval hooks
Yes Not verified

Yes, on Cloudflare's platform — Evaluations run against datasets built from filtered logs, reporting performance, speed, and cost; human feedback is the first evaluator and is in open beta ([Evaluations](https://developers.cloudflare.com/ai-gateway/evaluations/))

Whether automated scorers can run against real production requests, rather than only against a test set you assemble yourself.

Performance

Delay it adds Proxy overhead
Not published Not verified
Extra time the product itself adds to each request, on top of however long the model takes. Usually irrelevant next to multi-second model latency, but it matters for high-volume or streaming-sensitive workloads.
Requests per second ceiling Throughput
Not published Not verified
Published sustained request rate before the product becomes the bottleneck. Only relevant at genuinely high volume.
What the request path runs on Architecture class
Edge worker Not verified

Explicitly built on Cloudflare Workers ("a serverless platform that runs on the Cloudflare network"), with a Gateway Worker and Durable Objects (each Account Manager with its own SQLite database) for logging ([Cloudflare AI Gateway scaling blog](https://blog.cloudflare.com/billions-and-billions-of-logs-scaling-ai-gateway-with-the-cloudflare/)).

The comparable way to talk about latency here. An edge worker, a compiled Go or Rust binary, and a Python proxy have different overhead floors no matter which figures each vendor publishes. Products that never disclose their runtime are recorded as undisclosed rather than assumed.
You can run the request path yourself Self-hostable data plane
No Not verified

No self-host artifact; usage is via the gateway URL or Workers bindings such as `env.AI.gateway("my-gateway").getUrl("openai")` ([Cloudflare AI Gateway product page](https://www.cloudflare.com/products/ai-gateway/)).

Whether the component that actually carries your prompts can run on your own infrastructure. Distinct from a vendor offering a self-hosted control plane while still proxying traffic through their network.
Streaming responses Streaming support
Yes Not verified

Supported. Caveat tied to the timeout semantics: `cf-aig-request-timeout` is evaluated on the first part of the response, so once streaming starts the gateway will wait for the rest ([Cloudflare AI Gateway request handling](https://developers.cloudflare.com/ai-gateway/configuration/request-handling/)).

Whether token-by-token streaming is documented. The caveats matter more than the yes: some products cannot cancel a stream without still being billed, and several timeout and fallback mechanisms stop applying once the first token has been sent.

Security & compliance

Does your prompt reach their servers Prompt transits vendor
Yes Not verified

A proxy that sits between your application and the model, so every request passes through Cloudflare.

Whether the text you send passes through this company’s own infrastructure. If it does, every other promise on this page is a policy commitment rather than a physical impossibility. Self-hosted products can answer no outright.
What they keep if you change nothing Logging default
Yes — prompts and replies Not verified

The most permissive default in this catalogue. Logs are enabled by default for each gateway and include the user prompt and the model response alongside metadata. Opting out is per request, via the cf-aig-collect-log-payload header.

Defaults matter more than options. A product that stores full prompts and replies unless you find the right header will have stored them by the time you read the docs.
How long they keep it Default content retention (days)
Not published Not verified

Retention is capped by count, not time: 100,000 logs per account on the free plan and 10 million per gateway on paid. Logs persist until the cap is reached, at which point new logs stop being saved.

Default retention for request content, in days. Zero means nothing is kept. Read the note: several products keep nothing as a rule but make timed exceptions for abuse review or specific models.
Could they train on your prompts Training on customer data
No Not verified

Cloudflare does not use customer content to train any large language models, and does not train its own machine-learning models on customer content without consent.

Whether the vendor may use your prompts and outputs to train models. “Not published” means we could not find any position, which is not the same as a no — ask for it in writing.
Where it runs, and what you can pin Region and residency control
A global edge with platform-level data-residency support, but no AI-Gateway-specific region pinning and no customer-VPC deployment. Not verified
Which regions are offered and whether you can force processing to stay in one. A global endpoint that silently picks a region is a different compliance story from an endpoint you pin yourself.
Where safety filters run Guardrail execution location
In the vendor’s cloud Not verified

Guardrails inspect interactions in real time using a Llama Guard model on Workers AI — Cloudflare's infrastructure, not yours.

A filter that strips personal data only helps if it runs before the data leaves your boundary. If guardrails execute in the vendor’s cloud, the vendor has already received whatever you wanted redacted.
Who else touches the data Subprocessor list
https://www.cloudflare.com/gdpr/subprocessors/ Not verified
The published list of third parties the vendor passes your data to. No list means you cannot know the full chain, which most data-protection agreements require you to.
SOC 2 audited SOC 2 audited
Not published Not verified
An independent audit of security controls. Enterprise buyers and their procurement teams routinely require it.
Will sign a HIPAA agreement HIPAA BAA
Not published Not verified
Required before you may send protected health information through the service. Without a signed BAA, healthcare data is off limits.
GDPR commitments GDPR commitments
Not published Not verified
Published data processing terms for handling personal data of people in the EU and UK.
Can keep data in the EU EU data residency
Not published Not verified
Requests can be processed inside the EU rather than routed to US infrastructure. Often the deciding constraint for European customers.
Does not retain your data Zero data retention
Not published Not verified
Prompts and responses are not stored after the request completes. Sometimes a paid add-on rather than the default.
Strips personal data PII redaction
Yes Verified 3 days ago
Detects and removes identifiers such as names, emails, and card numbers before the request reaches the model provider.
Content guardrails Content guardrails
Yes Verified 3 days ago
Policy checks on inputs and outputs — blocking unsafe content, enforcing formats, or catching prompt-injection attempts.
Runs fully disconnected Air-gapped deployment
No Verified 3 days ago
Can be deployed in a network with no internet access, which some regulated and defence environments require.
Blocks personal data in prompts PII / DLP enforcement
Can block the request Not verified

AI Gateway DLP scans prompts and responses in real time using Cloudflare's DLP detection engines and account-level profiles. On **Block**, "the provider response is discarded and replaced with a DLP error response (status 400)"; on **Flag**, findings are attached to the `cf-aig-dlp` response header and logged while the original response is still returned. The page does not state that DLP redacts ([DLP](https://developers.cloudflare.com/ai-gateway/features/dlp/))

Whether personal data detection sits on the request path and can stop the call, merely inspects and forwards it, or is not documented. A control that only reports is a logging feature, not a policy control.
Blocks prompt injection Injection / jailbreak enforcement
Can block the request Not verified

Prompt-injection detection uses the Workers AI model `@cf/meta/prompt-guard-2-86m`, exposed as category P1 with per-category Flag / Ignore / Block actions ([Guardrails](https://developers.cloudflare.com/ai-gateway/features/guardrails/), [Guardrails usage considerations](https://developers.cloudflare.com/ai-gateway/features/guardrails/usage-considerations/))

Whether injection and jailbreak detection can stop a request. Most products offering this call a partner classifier rather than shipping their own.
Blocks harmful content Toxicity / moderation enforcement
Can block the request Not verified

Llama Guard 3 8B on Workers AI evaluates hazard categories S1–S13 inline, again with Flag / Ignore / Block per category ([Guardrails](https://developers.cloudflare.com/ai-gateway/features/guardrails/))

Whether hate, violence, sexual and self-harm categories are checked inline and can stop a request, in either direction.
Your own policy rules Custom policy hooks
Can block the request Not verified

Custom policy takes the form of Cloudflare One DLP detection profiles (predefined or custom) selected at the gateway level; "There is no per-request header to select specific DLP profiles or to bypass DLP scanning", and different policies require separate gateways ([DLP](https://developers.cloudflare.com/ai-gateway/features/dlp/))

Whether you can add your own rule — a regex, a webhook, or your own classifier — rather than choosing from the vendor library.
Where guardrails run Guardrail execution location
On the vendor's servers Not verified
Whether guardrail evaluation happens inside your infrastructure or on the vendor’s servers. This decides whether the prompt you are trying to protect leaves your network in order to be checked.
If the guardrail itself fails Guardrail failure mode
You choose Not verified

Documented per action rather than per outage: with a category set to Block, "the request will be blocked" (fail closed for that category), while Flag returns the response and records the finding (fail open) ([Guardrails usage considerations](https://developers.cloudflare.com/ai-gateway/features/guardrails/usage-considerations/), [DLP](https://developers.cloudflare.com/ai-gateway/features/dlp/)). Behaviour when the guardrail model itself is unavailable is `not_documented`

What happens when the guardrail service times out or errors: does the request proceed unchecked, or is it blocked? This is the worst-documented field in the entire catalogue — only two vendors state it plainly, which means most teams are running a control whose failure behaviour they cannot know.
Third-party guardrail vendors Guardrail integrations
Not published Not verified
Named external guardrail services the product can call. A long list means the product is a router for policy engines rather than a policy engine itself — which also means another vendor bill and another hop.

Compliance evidence

Graded by how strong the evidence is, not whether the word appears on the vendor’s website. An audited report and a marketing claim are different things, and only one of them will satisfy your own auditor.

  • SOC 2 Certified Type II covering security, confidentiality and availability
  • ISO 27001 Certified also 27018 and 27701
  • GDPR DPA Certified subprocessor list and GDPR programme published
  • HIPAA BAA Alignment only, no agreement offered services described as aligning to HIPAA needs; no BAA offer found
  • FedRAMP Certified High authorisation for Cloudflare for Government
  • ITAR Not published

Vendor source

Fit & integration

Work to try it Evaluation work shape
Set it up in a cloud console Not verified
The shape of the work on the vendor’s own quickstart, from swapping one base URL through to deploying infrastructure. An ordinal class rather than a duration, because elapsed time depends on accounts and quota we cannot see.
Work to run it Production work shape
Set it up in a cloud console Not verified
The same scale applied to the vendor’s recommended production path. For several products this is much heavier than the quickstart, which is exactly why both are recorded.
Steps on the quickstart Numbered quickstart steps
13 Not verified

13 entries spread across three separate numbered lists (2 + 7 + 4), so no single steps-to-first-call figure exists.

A literal count of numbered steps on the vendor’s quickstart, recorded as evidence beside the work shape. Zero means the page publishes no numbered procedure at all. Large counts usually mean interleaved language tracks rather than more work.
Can you self-host it today Self-host install documentation
No self-hosting Not verified
Whether an install command is actually published. Several products advertise self-hosting while publishing no command to start from, which a plain yes/no would hide.
Works with the OpenAI SDK OpenAI SDK drop-in
Yes Not verified

OpenAI-compatible SDK usage is documented. The exact documented base URL is `https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/openai`; the OpenAI JavaScript and Python SDKs are shown, and Grok documentation also says to replace the xAI endpoint with `https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/grok`. ([Cloudflare AI Gateway full documentation](https://developers.cloudflare.com/ai-gateway/llms-full.txt))

Whether an existing OpenAI-compatible client can be pointed at it by changing the base URL and key.
Vercel AI SDK support AI SDK provider package
Official provider package Not verified

Vercel AI SDK integration is documented through the `ai-gateway-provider` npm package. The package provides `createAiGateway`, `createUnified`, `createOpenAI`, `createAnthropic`, `createGoogle`, and `createXai`; Cloudflare Workers usage can also use `workers-ai-provider`. ([Cloudflare AI Gateway full documentation](https://developers.cloudflare.com/ai-gateway/llms-full.txt))

Whether a first-party AI SDK provider package exists, or only a community package, a documented workaround, or the generic OpenAI provider pointed at a custom base URL.
Python framework integrations Documented Python frameworks
LlamaIndex Not verified

LlamaIndex integration is documented through the `llama-index-llms-cloudflare-ai-gateway` package and the `CloudflareAIGateway` class (`Bases: LLM`). LangChain support for Cloudflare AI Gateway is not documented in the provided evidence. ([LlamaIndex Cloudflare AI Gateway integration](https://developers.llamaindex.ai/python/framework-api-reference/llms/cloudflare_ai_gateway/))

LangChain, LangGraph, LlamaIndex and similar orchestration frameworks with a documented integration.
Callable from Cloudflare Workers Cloudflare Workers support
Documented from your Worker Not verified

Cloudflare Workers support is documented through the `env.AI` binding, including `env.AI.run()` and `env.AI.gateway()`, third-party models, Workers AI models, logging, feedback, metadata, and gateway configuration. Workers AI can also integrate with AI Gateway by adding a gateway object to a Workers AI request; the gateway must be in the same account as the Worker. ([Cloudflare AI Gateway full documentation](https://developers.cloudflare.com/ai-gateway/llms-full.txt))

Whether the docs show calling this product from your own Worker. Deliberately separated from the several products whose own gateway runs on Workers, which is a fact about their infrastructure and not about your edge compatibility.
Kubernetes install Helm chart availability
Not documented Not verified

n.a. (not documented)

Whether a named, published Helm chart exists, versus Helm being referenced with no chart named, versus generic cluster documentation that has nothing to do with this product.
Terraform support Terraform provider or modules
Official Terraform provider Not verified

Official Terraform support is documented through the `cloudflare/cloudflare` provider. Documented resources include `cloudflare_ai_gateway` and `cloudflare_ai_gateway_dynamic_routing`, with the latter documented at `registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/ai_gateway_dynamic_routing`. ([Terraform Cloudflare AI Gateway resource](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/ai_gateway))

Whether you can declare this in code: an official provider, official modules, resources inside a hyperscaler’s provider, a community provider, or only Terraform code shipped in a repo.
Reuses your cloud identity Cloud IAM reuse
Static provider credentials only Not verified

Amazon Bedrock support is documented with AWS SigV4 credentials, including `accessKeyId`, `secretAccessKey`, `region`, and an optional AWS STS `sessionToken`. Google Vertex AI supports service-account JSON credentials or direct GCP access tokens, including GCP service-account authentication; Azure OpenAI documentation specifies an Azure OpenAI API key rather than Entra or managed identity. ([Cloudflare AI Gateway full documentation](https://developers.cloudflare.com/ai-gateway/llms-full.txt))

Whether you can authenticate with IAM roles, workload identity or managed identities instead of another long-lived API key. Distinguished from products that only accept static upstream provider credentials.
Fits behind your API gateway API gateway integration
Not documented Not verified

n.a. (not documented)

Whether AI traffic can go through a gateway you already run, and who documented that — the product’s vendor or the gateway’s.
MCP support MCP surface shape
MCP tools in the API Not verified

Cloudflare Agents explicitly support MCP tools, but an AI Gateway MCP server, MCP gateway or registry, and dedicated MCP tool proxy are not documented. Separately, Cloudflare Zero Trust documents MCP server portals that proxy upstream MCP tools and prompts behind one HTTP endpoint at `/mcp`. ([Cloudflare MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/))

Which kind of MCP support this is: a gateway that governs many MCP servers, a hosted MCP server you connect to, MCP tools accepted inside the completion API, or client tooling. These are different products behind one acronym.
Needs your own provider key Upstream provider key required
Not needed Not verified

No for the documented Workers AI call; provider authentication options are "Unified Billing, BYOK, or request headers" ([Getting started · Cloudflare AI Gateway docs](https://developers.cloudflare.com/ai-gateway/get-started/))

Whether an upstream provider account and key must exist before your first call works. A prerequisite rather than a step, and it can differ between the hosted and self-hosted forms of the same product.
Gate before models work Model access gate
No gate Not verified

n.a. (not documented). No approval, enablement, quota or waitlist gate is stated ([Getting started · Cloudflare AI Gateway docs](https://developers.cloudflare.com/ai-gateway/get-started/), [Pricing · Cloudflare AI Gateway docs](https://developers.cloudflare.com/ai-gateway/reference/pricing/))

Whether an enablement click, a quota grant, a paid tier or an approval form stands between a valid key and a working model call.
Official client languages First-party client SDK languages
JavaScript, Python Not verified

Documented clients include the OpenAI SDK for JavaScript and Python; Anthropic SDK for JavaScript and Python; `@google/genai`; `@mistralai/mistralai`; the Cohere Python SDK; Groq SDK for JavaScript; HuggingFace `@huggingface/inference`; Fal AI `@fal-ai/client`; `ai-gateway-provider` for the Vercel AI SDK; and Cloudflare Workers `env.AI` bindings. ([Cloudflare AI Gateway full documentation](https://developers.cloudflare.com/ai-gateway/llms-full.txt))

Languages with a first-party client library. An empty list can still mean the product is usable from any language via an OpenAI-compatible SDK.

Additional charges

These are the fees that do not appear on a per-token price list, and they are where estimates usually go wrong.

  • Unified Billing credit purchases 5% fee on all credits purchased ($100 of credit costs $105)
  • Logpush Workers Paid only: 10 million requests/month included, then $0.05 per million
  • Guardrails inference Billed as Workers AI token usage for @cf/meta/llama-guard-3-8b evaluations
Back to top ↑

Common questions

Answered from the fields above, so these move when the catalog moves. Every figure quoted here appears in the specification with its source.

Does Cloudflare AI Gateway charge a markup on model prices?

Cloudflare AI Gateway adds no percentage markup to model prices. Buying credit costs 5%. Other charges on the page: unified billing credit purchases (5% fee on all credits purchased ($100 of credit costs $105)), logpush (Workers Paid only: 10 million requests/month included, then $0.05 per million) and guardrails inference (Billed as Workers AI token usage for @cf/meta/llama-guard-3-8b evaluations).

Can Cloudflare AI Gateway be self-hosted?

No. Cloudflare AI Gateway is available only as a service the vendor operates; there is no self-hosted build. The licence is Proprietary.

Is Cloudflare AI Gateway SOC 2 audited, and will it sign a HIPAA BAA?

Cloudflare AI Gateway publishes neither a SOC 2 report nor a HIPAA business associate agreement. Each of these is linked to the vendor's own page in the compliance section below.

Does Cloudflare AI Gateway retain your prompts?

Cloudflare AI Gateway does not publish a zero-data-retention position. Prompt and response bodies are logged by default. Logging can be turned off. It states that it does not train on customer data.

Can you use your own provider keys with Cloudflare AI Gateway?

Yes. Cloudflare AI Gateway can route through your own accounts with the underlying model providers, so inference is billed to you directly. BYOK is a built-in feature at no stated extra cost: provider keys are stored encrypted in Cloudflare and rotated without code changes across 20+ providers.

How many models does Cloudflare AI Gateway support?

Cloudflare AI Gateway publishes no total model count. It reaches 24 upstream providers. Cloudflare publishes no gateway model count. Its upstream list is narrower than the marketplaces: docs say all features work across 20+ supported AI providers, and the provider-native page enumerates 23 (Workers AI, Bedrock, Anthropic, Azure OpenAI, Baseten, Cartesia, Cerebras, Cohere, Deepgram, DeepSeek, ElevenLabs, Fal AI, Google AI Studio, Vertex AI, Groq, HuggingFace, Ideogram, Mistral, OpenAI, OpenRouter, Parallel, Perplexity, Replicate, xAI).

Back to top ↑

What has changed here

  1. catalog entry catalog entry Not published Added to the catalog source ↗
See this in the full changelog Back to top ↑

Read the head-to-head

These pairs have a written verdict, not just a table.

Cloudflare AI Gateway vs Vercel AI Gateway Read the verdict → Cloudflare AI Gateway vs LiteLLM Read the verdict →

Usually weighed against

Cloudflare AI Gateway vs Amazon Bedrock Compare → Cloudflare AI Gateway vs Azure AI Foundry Compare → Cloudflare AI Gateway vs Google Vertex AI Compare →