Authenticated Gateway

New AI Gateways require authentication. Existing gateways with authentication turned off can continue without it or turn it on. Once authentication is on, you cannot turn it off. Authentication prevents unauthorized access and protects against invalid requests that can inflate log storage usage.

When using the REST API, pass your Cloudflare API token in the standard Authorization header. When using provider-native endpoints at gateway.ai.cloudflare.com, use the cf-aig-authorization header instead.

1. Go to Settings for your gateway. Authentication is already required for new gateways.
2. Select Create authentication token to generate a custom token with the required Run permissions. Be sure to securely save this token, as it will not be displayed again.
3. Include the API token in each request:
   • If using the REST API (/ai/run), include your Cloudflare API token in the standard Authorization header.
   • If using provider-native endpoints at gateway.ai.cloudflare.com, use the cf-aig-authorization header.
4. If you are using an existing gateway with authentication turned off, return to the settings page and turn on Authenticated Gateway. You cannot turn it off again.

When creating a gateway, authentication defaults to true if you omit the field. Requests with authentication: false return HTTP 400.

When updating a gateway, omit authentication to preserve its current setting. Set authentication: true to turn it on permanently. Setting authentication: false on an authenticated gateway returns HTTP 400 with the message Authentication cannot be disabled once enabled.

Existing unauthenticated gateways can still accept authentication: false in update requests. This does not allow authentication to be turned off after it is on.

# Run `wrangler whoami` to get your account ID to replace $CLOUDFLARE_ACCOUNT_ID,
# and `wrangler auth token` to get an auth token to replace $CLOUDFLARE_API_TOKEN.
curl -X POST "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/v1/chat/completions" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"model": "openai/gpt-4.1-mini", "messages": [{"role": "user", "content": "What is Cloudflare?"}]}'

Using the OpenAI SDK:

import OpenAI from "openai";

const openai = new OpenAI({
	apiKey: CLOUDFLARE_API_TOKEN,
	baseURL: `https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/ai/v1`,
});

const response = await openai.chat.completions.create({
	model: "openai/gpt-4.1-mini",
	messages: [{ role: "user", content: "What is Cloudflare?" }],
});

Using the Vercel AI SDK:

import { createOpenAI } from "@ai-sdk/openai";

const openai = createOpenAI({
	apiKey: CLOUDFLARE_API_TOKEN,
	baseURL: `https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/ai/v1`,
});

The following table outlines gateway behavior based on the authentication settings and header status. The Off setting applies only to existing gateways that have not enabled authentication. Once enabled, authentication cannot be disabled: