Cloudflare AI Gateway vs Gemini 4 Hydrogen

Cloudflare AI Gateway 80

Router, read on the model lines. Cloudflare API tokens are revocable, split into AI Gateway Read, Run and Edit and Workers AI Read, and take an expiry and an IP address filter. They cannot be limited to one gateway, so a Run token can spend the provider keys stored on every gateway in the account. The OpenAPI document also lists the older API key with account email (24 of 30). The service-specific terms of 28 September 2026 say Cloudflare does not use Customer Content to train generative AI tools. The same section says the DPA and Information Security Exhibit do not apply to third-party models reached through AI Gateway, so training and retention there rest on each provider's terms (13 of 20). Prompts and responses are logged by default. Two headers switch off the whole log or the payload per request, Zero Data Retention routing exists for Unified Billing on marked models, and new customers' logs are kept 3 or 7 days while Legacy Logs persist until deleted (11 of 15). Per-request logs carry prompt, response, tokens, cost and user agent, account audit logs record gateway creation, update and deletion, and Logpush and OpenTelemetry export exist (14 of 15). security.txt, re-read on 1 November, names a HackerOne programme and a disclosure policy, with no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), ISO 27018 and ISO 27701, with a scope of the Cloudflare global cloud platform, which doesn't name AI Gateway. 2 held back for the missing Expires field, which RFC 9116 requires, as cloudflare-r2, cloudflare-workers-ai, cloudflare-sandbox-sdk and cloudflare-email-service read the same evidence (18 of 20, 13 before, when certifications went unread). Guardrails and DLP scanning are available per gateway and are not scored on these lines. 24 + 13 + 11 + 14 + 18 = 80.

Gemini 4 Hydrogen 50

Model reading for gemini-4-hydrogen on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Keys bound to a service account and restricted to the Gemini API, with no scopes and a token accepted in the URL (15 of 30, the platform's deduction). Hydrogen is on the free tier, where Google's terms say content is used to improve products and may be read by humans; paid-tier content isn't (10 of 20, the platform's reading; Carbon, paid tier only, got 15). Abuse retention has no number and new paid projects store requests by default since 26 October; Google's prompt-injection figure (2.3 times more resilient on Gray Swan's benchmark) is its own, and the model card says jailbreak resistance is still being improved (5 of 15). Request logs for billed projects (15). security.txt and a reward programme, no certification naming the API (5 of 20). 15 + 10 + 5 + 15 + 5 = 50.

Cloudflare AI Gateway 63

x402 is in beta on POST /ai/run since 30 September 2026 for four open models of 241 in the catalogue. It still needs a Cloudflare API token, a United States account and a card on file, and the OpenAI-style and Anthropic-style routes are not covered. We did not call it (12 of 40). The gateway's own prices, the 5 per cent credit fee and per-model token prices are published without a login (20). Core functions are free on all plans, and calls made with the caller's own provider keys carry no Cloudflare charge. We did not sign up to confirm that no card is asked for (20). A person creates the account and the first token in a browser, and the x402 route needs both (0). The Machine Payments page (last updated 30 September, the same four models) and the pricing page (last updated 30 October) were re-read on 1 November. 12 + 20 + 20 + 0 = 52. Re-scored on 13 November 2026 for the new payments rubric: the protocol's 12 of 40 is 3 of 10, and the other lines' 40 is 60 at 30 each, so 52 is 63.

Gemini 4 Hydrogen 40

Model reading for gemini-4-hydrogen on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. No machine payment protocol (0). Prices published in Google's announcement without a login, $1.50 input and $7.50 output per million tokens, flat across the window; the Gemini API pricing page, now at aistudio.google.com, is still to be read for Hydrogen's row (20). A free tier with no card: Google's announcement puts Hydrogen on all tiers of the Gemini API, and the free tier needs no billing account per the gemini-api listing; its limits for Hydrogen are on that pricing page (20). A Google account and AI Studio for a key (0). 0 + 20 + 20 + 0 = 40.

Cloudflare AI Gateway 66

Hosted reading. www.cloudflarestatus.com is a Statuspage with AI Gateway, Workers AI and API as separate components (20). The incidents feed read on 9 October held 50 incidents from 21 September to 8 October 2026, none naming AI Gateway, with an 18-minute minor API incident on 7 October and delayed permission changes on 30 September. On 1 November the host's history.atom held only scheduled maintenance for 2 to 6 November, and the history page loads by script. Whether the incidents posted from 16 to 31 October name AI Gateway wasn't read for this listing (cloudflare-r2, cloudflare-workers-ai and cloudflare-email-service read that list for their own components only), and 3 August to 20 September and 9 to 15 October went unread too. An unread window isn't credited, so the line rests on the 21 September to 8 October reading alone, as on 9 October (10 of 30). Unified Billing traffic is limited to 200 requests per 60 seconds per gateway, re-read on 1 November, the Cloudflare API to 1,200 requests per five minutes per token, and BYOK traffic has no gateway limit (15). Over-limit and over-budget requests return 429, the Cloudflare API returns retry-after and Ratelimit headers for its own limit, and retries with backoff and model fallbacks can be set per request or per gateway. No Retry-After was found for the gateway's own 429, and nothing separates a rate-limit 429 from a spend-limit 429 (11 of 15). No SLA naming AI Gateway was found. The Enterprise SLA lists service-specific SLAs for R2, Queues and Workers only (0). The core product carries no beta label, and Machine Payments is in beta (10). 20 + 10 + 15 + 11 + 0 + 10 = 66.

Gemini 4 Hydrogen 45

Model reading for gemini-4-hydrogen on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Status page at aistudio.google.com/status with no readable components or history (10 of 20) and no readable incident record (5 of 30). Rate-limit tiers and spend limits published, per-model limits in AI Studio (5 of 15). Backoff guidance for 429 and 503 and SDK retries (15). No SLA (0). Google Cloud's release notes and model page call Hydrogen generally available, a short-term release, under the same model ID; the Gemini API pages read don't name a stage, so full marks rest on Cloud's statement (10, a judgement call; Carbon, with no stage stated anywhere, got 5). 10 + 5 + 5 + 15 + 0 + 10 = 45.

Cloudflare AI Gateway 73

Router, read on the model lines (tool use, structured output, caching, context, batch, SDKs, errors). Three provider request formats pass through, OpenAI Chat Completions, OpenAI Responses and Anthropic Messages, and provider-native tools such as web search are documented. Tool behaviour depends on the routed model (15 of 20). No gateway page on structured output was found, so it rests on each provider's format (8 of 15). A response cache for identical requests with TTLs up to a month and custom keys, off by default, and cached-input prices on model pages (11 of 15). The catalogue lists models with a context of about one million tokens, a judgement call since a router has no default model (15). Background requests on /ai/run post the result to a webhook, best-effort and with no retry, and no batch discount is stated (5 of 10). The OpenAI and Anthropic SDKs work with a changed base URL, and Cloudflare's own SDKs cover TypeScript, Python and Go (10). Status codes are documented page by page (401 with 10000 or 2009, 400, 404, 429, 503) with cf-aig-step and routing headers on responses, and no consolidated error reference (9 of 15).

Gemini 4 Hydrogen 90

Model reading for gemini-4-hydrogen on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Function calling, with forced calls by FunctionCallingConfig on the API (20). Structured output to a response_schema, listed as supported on the Cloud model page (13 of 15). Implicit caching on prefixes of 4,096 tokens or more with durable caching on by default and explicit caches not supported, per the Cloud model page; the announcement names no cached-input price (12 of 15). 1,048,576 tokens shared between input and output, with background long decode up to 1M (15). Batch at half price on the platform (10). Python and JavaScript SDKs, and an OpenAI-compatible Chat Completions surface (10). Error codes with backoff guidance (10 of 15). 20 + 13 + 12 + 15 + 10 + 10 + 10 = 90.

Cloudflare AI Gateway 75

Router, scored on the API lines. Cloudflare's public OpenAPI 3.0.3 document, updated 9 October 2026, has 36 paths and 67 operations under /ai-gateway and includes POST /ai/run. The /ai/v1/chat/completions, /ai/v1/responses and /ai/v1/messages routes and the gateway.ai.cloudflare.com endpoints are not in it (20 of 25). An AI Gateway llms.txt and a Markdown copy of every page (10). Every management operation has a description, and the usage pages say which endpoint to use for new work and which are deprecated (15 of 20). Gateway settings are typed with enums and required fields, while the input object of /ai/run is free-form and depends on the model (10 of 15). Curl, SDK and Worker examples on most pages. No table of gateway error codes was found. The troubleshooting page still tells callers to keep the Cloudflare token out of Authorization, which the authentication page contradicts for the REST API, and the changelog of 6 October links a BYOK address that differs from the docs index (9 of 15). A dated changelog with RSS. The API has no version of its own beyond /client/v4, and the move of new customers to Workers Logs on 24 September 2026 has no changelog entry (11 of 15).

Gemini 4 Hydrogen 85

Model reading for gemini-4-hydrogen on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Discovery document for GenerateContent (20 of 25). llms.txt with Markdown twins (10). The Cloud developer guide says what Hydrogen takes, every parameter that's ignored or returns 400, the thought-signature rules and how to migrate from Gemini 3.8 Flash, though it doesn't document forced calls (15 of 20). Structured output to a JSON Schema with some keywords not enforced (10 of 15). Examples and an errors page (15). Dated changelog and model versions (15). 20 + 10 + 15 + 10 + 15 + 15 = 85.

Cloudflare AI Gateway 75

Router, read on the model lines. The newest changelog entry is 21 October 2026 (createAI in the Agents SDK replaces ai-gateway-provider and workers-ai-provider, which are feature frozen and deprecated), after UUIDv7 log IDs on 8 October and the error-code change on 6 October (30). No minimum notice for API changes was found. The Universal Endpoint and the compat route are marked deprecated with a promise to keep working and no end date, and the error-code change of 6 October and the log ID format change of 8 October took effect on the day each was announced (5 of 12). No gateway endpoint was shut down in the last 90 days that we found. Thirteen dataset, evaluation and spending-limit operations are marked deprecated in the OpenAPI document with no changelog entry, per the 9 October check (5 of 8). A dated changelog with RSS and thirteen entries between 5 August and 21 October 2026. The Discord community was not sampled (11 of 15). Replies on the SDK repositories were not examined (3 of 10). cloudflare for TypeScript 7.3.0 and Python 5.9.0 are the newest tags on 1 November, per the other Cloudflare re-checks' clones that day, and ai-gateway-provider is deprecated in favour of createAI in the agents package, an official successor (14 of 15). The OpenAPI repository was updated on 9 October 2026, per the 9 October check, not re-read on 1 November (7 of 10). 30 + 5 + 5 + 11 + 3 + 14 + 7 = 75.

Gemini 4 Hydrogen 85

Model reading for gemini-4-hydrogen on the Gemini API. Platform facts are the Gemini API listing's (gemini-api, re-read 1 November), carried over as RULES.md allows for a model on an already graded platform. Released on 12 November 2026, recorded in Google Cloud's release notes; the Gemini API changelog, last updated 30 October, has no entry for it yet (30). Google Cloud states a minimum of 45 days' notice before Hydrogen is retired, short and stated for Cloud only; the Gemini API's deprecations give earliest dates with no stated minimum (6 of 12). Shutdowns in the last 90 days kept to their table (4 of 8). Dated changelog (15). SDK replies not sampled (5 of 10). Current SDKs; the developer guide names the minimum google-genai, @google/genai, Go and Java versions (15). Runtimes stated (10). 30 + 6 + 4 + 15 + 5 + 15 + 10 = 85.