Authenticated Gateway

Last updated Jun 17, 2026 AI Gateway requires a valid Cloudflare API token for each request. This prevents unauthorized access and protects against invalid requests that can inflate log storage usage.

When using the REST API, pass your Cloudflare API token in the standard Authorization header. When using provider-native endpoints at gateway.ai.cloudflare.com, use the cf-aig-authorization header instead.

Note

The cf-aig-authorization header is used with the gateway.ai.cloudflare.com endpoints, which continue to work. For new integrations, we recommend using the REST API at api.cloudflare.com, which uses the standard Authorization header.

Setting up Authenticated Gateway using the dashboard

1. Go to the Settings for the specific gateway you want to enable authentication for.
2. Select Create authentication token to generate a custom token with the required Run permissions. Be sure to securely save this token, as it will not be displayed again.
3. Include the API token in each request:
4. If using the REST API ( /ai/run), include your Cloudflare API token in the standard Authorization header.
5. If using provider-native endpoints at gateway.ai.cloudflare.com, use the cf-aig-authorization header.
6. Return to the settings page and toggle on Authenticated Gateway.

AI Gateway API tokens are account-scoped

The AI Gateway Read, Run, and Edit permissions cannot be restricted to a single gateway — unlike R2, which supports per-bucket scoping. Any token with AI Gateway Run can send requests through every gateway in the account, including any configured with stored provider keys through Bring Your Own Keys (BYOK), consuming those credentials.

For isolation between gateways or tenants, use separate Cloudflare accounts or a Worker-side AI Gateway binding rather than relying on token scope.

Example requests

# Run `wrangler whoami` to get your account ID to replace $CLOUDFLARE_ACCOUNT_ID,
# and `wrangler auth token` to get an auth token to replace $CLOUDFLARE_API_TOKEN.
curl -X POST "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/v1/chat/completions" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"model": "openai/gpt-4.1-mini", "messages": [{"role": "user", "content": "What is Cloudflare?"}]}'

Using the OpenAI SDK:

import OpenAI from "openai";

const openai = new OpenAI({
    apiKey: CLOUDFLARE_API_TOKEN,
    baseURL: `https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/ai/v1`,
});

const response = await openai.chat.completions.create({
    model: "openai/gpt-4.1-mini",
    messages: [{ role: "user", content: "What is Cloudflare?" }],
});

Using the Vercel AI SDK:

import { createOpenAI } from "@ai-sdk/openai";

const openai = createOpenAI({
    apiKey: CLOUDFLARE_API_TOKEN,
    baseURL: `https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/ai/v1`,
});

Expected behavior

Note

When an AI Gateway is accessed from a Cloudflare Worker using a binding, the cf-aig-authorization header does not need to be manually included.
Requests made through bindings are pre-authenticated within the associated Cloudflare account.

The following table outlines gateway behavior based on the authentication settings and header status:

Was this helpful?

YesNo

On this page

Docs

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/ai-gateway/configuration/authentication/#page","headline":"Authenticated Gateway","description":"Add security by requiring a valid authorization token for each request.","url":"https://developers.cloudflare.com/ai-gateway/configuration/authentication/","inLanguage":"en","image":"https://developers.cloudflare.com/ai-gateway/configuration/authentication/og.png?v=49b1d93493341304","dateModified":"2026-06-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

description: Securely store AI provider API keys in AI Gateway and reference them in your gateway configuration. title: BYOK (Store Keys) image: https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/og.png?v=98c98db081b860ba

Skip to content

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/ai-gateway/llms.txt
Use this file to discover all available pages before exploring further.