{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/google-model-armor.json", "name": "Google Cloud Model Armor", "score": 77.9, "shared": [ "guard.pii", "guard.moderation" ], "slug": "google-model-armor" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/amazon-bedrock-guardrails.json", "name": "Amazon Bedrock Guardrails", "score": 74.8, "shared": [ "guard.pii", "guard.moderation" ], "slug": "amazon-bedrock-guardrails" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/openai-guardrails.json", "name": "OpenAI Guardrails", "score": 69.5, "shared": [ "guard.pii", "guard.moderation" ], "slug": "openai-guardrails" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/openrouter.json", "name": "OpenRouter", "score": 68.5, "shared": [ "inference.llm", "inference.router" ], "slug": "openrouter" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nemo-guardrails.json", "name": "NVIDIA NeMo Guardrails", "score": 68.4, "shared": [ "guard.pii", "guard.moderation" ], "slug": "nemo-guardrails" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/vela.json", "name": "Vela 2.0", "score": 66.5, "shared": [ "guard.pii", "guard.moderation" ], "slug": "vela" } ], "tool": { "slug": "cloudflare-ai-gateway", "name": "Cloudflare AI Gateway", "vendor": "Cloudflare, Inc.", "vendorUrl": "https://www.cloudflare.com", "kind": "router", "category": "inference", "summary": "AI Gateway is Cloudflare's proxy and router for model providers. Agents call OpenAI-style, Anthropic-style or native endpoints on the Cloudflare API, with logging, caching, rate and spend limits, retries, fallbacks and one prepaid credit balance.", "url": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-ai-gateway.json", "repo": "https://github.com/cloudflare/ai", "license": "Proprietary service under Cloudflare's Self-Serve Subscription Agreement and its service-specific terms. Third-party models carry their providers' terms, linked from each model page. `ai-gateway-provider` is MIT and Cloudflare's OpenAPI repository is BSD-3-Clause", "transports": [ "http" ], "remoteUrl": "https://api.cloudflare.com/client/v4/accounts/{account_id}/ai", "packages": [ { "registry": "npm", "name": "ai-gateway-provider" }, { "registry": "npm", "name": "cloudflare" }, { "registry": "pypi", "name": "cloudflare" } ], "auth": "api-key", "authNotes": "A Cloudflare API token as a Bearer header, created by a person in the dashboard. The `/ai/*` inference routes need Workers AI Read, and the `/ai-gateway/*` management routes need AI Gateway Read or Edit. Provider-native endpoints on `gateway.ai.cloudflare.com` take the token in `cf-aig-authorization`. Tokens can carry an expiry and an IP address filter and cannot be limited to one gateway. Access is self-serve, with no review or sales step.", "pricing": "freemium", "pricingNotes": "Free on all plans for analytics, caching and rate limiting, with a Cloudflare account. Third-party models are paid from prepaid Unified Billing credits at provider prices plus a 5 per cent fee on each credit purchase, or with the caller's own provider keys at no Cloudflare charge. Logs for new customers follow Workers Logs pricing, 200,000 events a day free. An account on the Free plan starts without a contract (https://developers.cloudflare.com/ai-gateway/reference/pricing/, checked 2026-10-09).", "priceSummary": "5% fee", "where": "hosted", "x402": { "level": "partial", "evidence": "Machine Payments, in beta since 30 September 2026, takes x402 payment on `POST /ai/run` for four open models when the request carries `Payment-Method: x402`. It needs a Cloudflare API token, a United States account and a card on file. The OpenAI-style and Anthropic-style routes are not covered. We did not call it (https://developers.cloudflare.com/ai-gateway/features/machine-payments/, checked 2026-10-09).", "endpoints": [ { "url": "https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/run", "priceUsd": null, "network": "" } ] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 250648, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://developers.cloudflare.com/ai-gateway/", "llmsTxt": "https://developers.cloudflare.com/ai-gateway/llms.txt", "openapi": "https://raw.githubusercontent.com/cloudflare/api-schemas/main/openapi.json", "capabilities": [ "inference.llm", "inference.router", "obs.gateway", "guard.moderation", "guard.pii" ], "tags": [ "hosted", "router", "free-tier", "usage-based", "x402", "openapi", "llms-txt", "openai-compatible", "typescript", "python", "go", "status-page", "bug-bounty" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 66.8, "grade": "B", "agentReady": false, "rank": 275, "ranked": true, "rankOf": 950, "categoryRank": 8, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 75, "payments": 52, "reliability": 66, "schema": 75, "security": 75, "transparency": 73 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 66, "points": 13.2, "reason": "Hosted reading. www.cloudflarestatus.com is a Statuspage with AI Gateway, Workers AI and API as separate components (20). The incidents feed held 50 incidents from 21 September to 8 October 2026, none naming AI Gateway. The API component, which carries the REST routes, had an 18-minute minor incident on 7 October and delayed permission changes for four and a half hours on 30 September. The history page loads by script, so the rest of the 90 days went unread (10 of 30). Unified Billing traffic is limited to 200 requests per 60 seconds per gateway, the Cloudflare API to 1,200 requests per five minutes per token, and BYOK traffic has no gateway limit (15). Over-limit and over-budget requests return 429, the Cloudflare API returns `retry-after` and `Ratelimit` headers for its own limit, and retries with backoff and model fallbacks can be set per request or per gateway. No `Retry-After` was found for the gateway's own 429, and nothing separates a rate-limit 429 from a spend-limit 429 (11 of 15). No SLA naming AI Gateway was found. The Enterprise SLA lists service-specific SLAs for R2, Queues and Workers only (0). The core product carries no beta label, and Machine Payments is in beta (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 75, "points": 12.19, "reason": "Router, scored on the API lines. Cloudflare's public OpenAPI 3.0.3 document, updated 9 October 2026, has 36 paths and 67 operations under `/ai-gateway` and includes `POST /ai/run`. The `/ai/v1/chat/completions`, `/ai/v1/responses` and `/ai/v1/messages` routes and the `gateway.ai.cloudflare.com` endpoints are not in it (20 of 25). An AI Gateway `llms.txt` and a Markdown copy of every page (10). Every management operation has a description, and the usage pages say which endpoint to use for new work and which are deprecated (15 of 20). Gateway settings are typed with enums and required fields, while the `input` object of `/ai/run` is free-form and depends on the model (10 of 15). Curl, SDK and Worker examples on most pages. No table of gateway error codes was found. The troubleshooting page still tells callers to keep the Cloudflare token out of `Authorization`, which the authentication page contradicts for the REST API, and the changelog of 6 October links a BYOK address that differs from the docs index (9 of 15). A dated changelog with RSS. The API has no version of its own beyond `/client/v4`, and the move of new customers to Workers Logs on 24 September 2026 has no changelog entry (11 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "Router, read on the model lines (tool use, structured output, caching, context, batch, SDKs, errors). Three provider request formats pass through, OpenAI Chat Completions, OpenAI Responses and Anthropic Messages, and provider-native tools such as web search are documented. Tool behaviour depends on the routed model (15 of 20). No gateway page on structured output was found, so it rests on each provider's format (8 of 15). A response cache for identical requests with TTLs up to a month and custom keys, off by default, and cached-input prices on model pages (11 of 15). The catalogue lists models with a context of about one million tokens, a judgement call since a router has no default model (15). Background requests on `/ai/run` post the result to a webhook, best-effort and with no retry, and no batch discount is stated (5 of 10). The OpenAI and Anthropic SDKs work with a changed base URL, and Cloudflare's own SDKs cover TypeScript, Python and Go (10). Status codes are documented page by page (401 with 10000 or 2009, 400, 404, 429, 503) with `cf-aig-step` and routing headers on responses, and no consolidated error reference (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 75, "points": 13.13, "reason": "Router, read on the model lines. Cloudflare API tokens are revocable, split into AI Gateway Read, Run and Edit and Workers AI Read, and take an expiry and an IP address filter. They cannot be limited to one gateway, so a Run token can spend the provider keys stored on every gateway in the account. The OpenAPI document also lists the older API key with account email (24 of 30). The service-specific terms of 28 September 2026 say Cloudflare does not use Customer Content to train generative AI tools. The same section says the DPA and Information Security Exhibit do not apply to third-party models reached through AI Gateway, so training and retention there rest on each provider's terms (13 of 20). Prompts and responses are logged by default. Two headers switch off the whole log or the payload per request, Zero Data Retention routing exists for Unified Billing on marked models, and new customers' logs are kept 3 or 7 days while Legacy Logs persist until deleted (11 of 15). Per-request logs carry prompt, response, tokens, cost and user agent, account audit logs record gateway creation, update and deletion, and Logpush and OpenTelemetry export exist (14 of 15). security.txt names a HackerOne bounty programme and a disclosure policy, with no Expires field. The certifications page drew no list for our reader (13 of 20). Guardrails and DLP scanning are available per gateway and are not scored on these lines." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 52, "points": 6.5, "reason": "x402 is in beta on `POST /ai/run` since 30 September 2026 for four open models of 241 in the catalogue. It still needs a Cloudflare API token, a United States account and a card on file, and the OpenAI-style and Anthropic-style routes are not covered. We did not call it (12 of 40). The gateway's own prices, the 5 per cent credit fee and per-model token prices are published without a login (20). Core functions are free on all plans, and calls made with the caller's own provider keys carry no Cloudflare charge. We did not sign up to confirm that no card is asked for (20). A person creates the account and the first token in a browser, and the x402 route needs both (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 75, "points": 6.56, "reason": "Router, read on the model lines. The newest changelog entry is 6 October 2026 (30). No minimum notice for API changes was found. The Universal Endpoint and the compat route are marked deprecated with a promise to keep working and no end date, and the error-code change of 6 October 2026 took effect on the day it was announced (5 of 12). No gateway endpoint was shut down in the last 90 days that we found. Thirteen dataset, evaluation and spending-limit operations are marked deprecated in the OpenAPI document with no changelog entry (5 of 8). A dated changelog with RSS and eleven entries between 5 August and 6 October 2026. The Discord community was not sampled (11 of 15). Replies on the SDK repositories were not examined (3 of 10). `cloudflare` for TypeScript v7.3.0 was tagged on 2 October 2026, Python is at v5.9.0 and Go at v7.12.0, and `ai-gateway-provider` 4.0.1 dates from 11 September 2026 (14 of 15). The OpenAPI repository was updated on 9 October 2026 (7 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 73, "points": 6.39, "note": "editorial 51, provenance 95", "reason": "Closed service under the Self-Serve Subscription Agreement and service-specific terms with a section for Workers AI and AI Gateway. Each model page links the provider's terms, `ai-gateway-provider` is MIT and the OpenAPI repository is BSD-3-Clause (16 of 30). The service terms, the logging and Zero Data Retention pages, the DPA (version 6.4, 3 April 2026) and the privacy policy of 4 November 2025 were read. The privacy policy gives retention criteria, not periods. The terms take third-party models outside the DPA, while the sub-processor list names five model providers for AI Gateway, and the two are hard to square (17 of 30). No deprecation policy was found. Deprecated endpoints carry notices with no dates, and section 8 of the agreement lets Cloudflare modify or discontinue a service without notice (6 of 20). The sub-processor list, last updated 1 October 2025, names Google, Anthropic, OpenAI, xAI and Groq for AI Gateway with locations. The catalogue on 9 October 2026 also carries models from Alibaba, ByteDance, MiniMax and others that the list does not name (12 of 20)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Router, read on the model lines (tool use, structured output, caching, context, batch, SDKs, errors). Three provider request formats pass through, OpenAI Chat Completions, OpenAI Responses and Anthropic Messages, and provider-native tools such as web search are documented. Tool behaviour depends on the routed model (15 of 20). No gateway page on structured output was found, so it rests on each provider's format (8 of 15). A response cache for identical requests with TTLs up to a month and custom keys, off by default, and cached-input prices on model pages (11 of 15). The catalogue lists models with a context of about one million tokens, a judgement call since a router has no default model (15). Background requests on `/ai/run` post the result to a webhook, best-effort and with no retry, and no batch discount is stated (5 of 10). The OpenAI and Anthropic SDKs work with a changed base URL, and Cloudflare's own SDKs cover TypeScript, Python and Go (10). Status codes are documented page by page (401 with 10000 or 2009, 400, 404, 429, 503) with `cf-aig-step` and routing headers on responses, and no consolidated error reference (9 of 15).", "maintenance": "Router, read on the model lines. The newest changelog entry is 6 October 2026 (30). No minimum notice for API changes was found. The Universal Endpoint and the compat route are marked deprecated with a promise to keep working and no end date, and the error-code change of 6 October 2026 took effect on the day it was announced (5 of 12). No gateway endpoint was shut down in the last 90 days that we found. Thirteen dataset, evaluation and spending-limit operations are marked deprecated in the OpenAPI document with no changelog entry (5 of 8). A dated changelog with RSS and eleven entries between 5 August and 6 October 2026. The Discord community was not sampled (11 of 15). Replies on the SDK repositories were not examined (3 of 10). `cloudflare` for TypeScript v7.3.0 was tagged on 2 October 2026, Python is at v5.9.0 and Go at v7.12.0, and `ai-gateway-provider` 4.0.1 dates from 11 September 2026 (14 of 15). The OpenAPI repository was updated on 9 October 2026 (7 of 10).", "payments": "x402 is in beta on `POST /ai/run` since 30 September 2026 for four open models of 241 in the catalogue. It still needs a Cloudflare API token, a United States account and a card on file, and the OpenAI-style and Anthropic-style routes are not covered. We did not call it (12 of 40). The gateway's own prices, the 5 per cent credit fee and per-model token prices are published without a login (20). Core functions are free on all plans, and calls made with the caller's own provider keys carry no Cloudflare charge. We did not sign up to confirm that no card is asked for (20). A person creates the account and the first token in a browser, and the x402 route needs both (0).", "reliability": "Hosted reading. www.cloudflarestatus.com is a Statuspage with AI Gateway, Workers AI and API as separate components (20). The incidents feed held 50 incidents from 21 September to 8 October 2026, none naming AI Gateway. The API component, which carries the REST routes, had an 18-minute minor incident on 7 October and delayed permission changes for four and a half hours on 30 September. The history page loads by script, so the rest of the 90 days went unread (10 of 30). Unified Billing traffic is limited to 200 requests per 60 seconds per gateway, the Cloudflare API to 1,200 requests per five minutes per token, and BYOK traffic has no gateway limit (15). Over-limit and over-budget requests return 429, the Cloudflare API returns `retry-after` and `Ratelimit` headers for its own limit, and retries with backoff and model fallbacks can be set per request or per gateway. No `Retry-After` was found for the gateway's own 429, and nothing separates a rate-limit 429 from a spend-limit 429 (11 of 15). No SLA naming AI Gateway was found. The Enterprise SLA lists service-specific SLAs for R2, Queues and Workers only (0). The core product carries no beta label, and Machine Payments is in beta (10).", "schema": "Router, scored on the API lines. Cloudflare's public OpenAPI 3.0.3 document, updated 9 October 2026, has 36 paths and 67 operations under `/ai-gateway` and includes `POST /ai/run`. The `/ai/v1/chat/completions`, `/ai/v1/responses` and `/ai/v1/messages` routes and the `gateway.ai.cloudflare.com` endpoints are not in it (20 of 25). An AI Gateway `llms.txt` and a Markdown copy of every page (10). Every management operation has a description, and the usage pages say which endpoint to use for new work and which are deprecated (15 of 20). Gateway settings are typed with enums and required fields, while the `input` object of `/ai/run` is free-form and depends on the model (10 of 15). Curl, SDK and Worker examples on most pages. No table of gateway error codes was found. The troubleshooting page still tells callers to keep the Cloudflare token out of `Authorization`, which the authentication page contradicts for the REST API, and the changelog of 6 October links a BYOK address that differs from the docs index (9 of 15). A dated changelog with RSS. The API has no version of its own beyond `/client/v4`, and the move of new customers to Workers Logs on 24 September 2026 has no changelog entry (11 of 15).", "security": "Router, read on the model lines. Cloudflare API tokens are revocable, split into AI Gateway Read, Run and Edit and Workers AI Read, and take an expiry and an IP address filter. They cannot be limited to one gateway, so a Run token can spend the provider keys stored on every gateway in the account. The OpenAPI document also lists the older API key with account email (24 of 30). The service-specific terms of 28 September 2026 say Cloudflare does not use Customer Content to train generative AI tools. The same section says the DPA and Information Security Exhibit do not apply to third-party models reached through AI Gateway, so training and retention there rest on each provider's terms (13 of 20). Prompts and responses are logged by default. Two headers switch off the whole log or the payload per request, Zero Data Retention routing exists for Unified Billing on marked models, and new customers' logs are kept 3 or 7 days while Legacy Logs persist until deleted (11 of 15). Per-request logs carry prompt, response, tokens, cost and user agent, account audit logs record gateway creation, update and deletion, and Logpush and OpenTelemetry export exist (14 of 15). security.txt names a HackerOne bounty programme and a disclosure policy, with no Expires field. The certifications page drew no list for our reader (13 of 20). Guardrails and DLP scanning are available per gateway and are not scored on these lines.", "transparency": "Closed service under the Self-Serve Subscription Agreement and service-specific terms with a section for Workers AI and AI Gateway. Each model page links the provider's terms, `ai-gateway-provider` is MIT and the OpenAPI repository is BSD-3-Clause (16 of 30). The service terms, the logging and Zero Data Retention pages, the DPA (version 6.4, 3 April 2026) and the privacy policy of 4 November 2025 were read. The privacy policy gives retention criteria, not periods. The terms take third-party models outside the DPA, while the sub-processor list names five model providers for AI Gateway, and the two are hard to square (17 of 30). No deprecation policy was found. Deprecated endpoints carry notices with no dates, and section 8 of the agreement lets Cloudflare modify or discontinue a service without notice (6 of 20). The sub-processor list, last updated 1 October 2025, names Google, Anthropic, OpenAI, xAI and Groq for AI Gateway with locations. The catalogue on 9 October 2026 also carries models from Alibaba, ByteDance, MiniMax and others that the list does not name (12 of 20)." }, "sources": [ { "what": "AI Gateway overview", "url": "https://developers.cloudflare.com/ai-gateway/", "seen": "2026-10-09" }, { "what": "AI Gateway llms.txt", "url": "https://developers.cloudflare.com/ai-gateway/llms.txt", "seen": "2026-10-09" }, { "what": "getting started", "url": "https://developers.cloudflare.com/ai-gateway/get-started/", "seen": "2026-10-09" }, { "what": "REST API", "url": "https://developers.cloudflare.com/ai-gateway/usage/rest-api/", "seen": "2026-10-09" }, { "what": "Unified API (OpenAI compat), deprecation notice", "url": "https://developers.cloudflare.com/ai-gateway/usage/chat-completion/", "seen": "2026-10-09" }, { "what": "Universal Endpoint, deprecation notice", "url": "https://developers.cloudflare.com/ai-gateway/usage/universal/", "seen": "2026-10-09" }, { "what": "pricing", "url": "https://developers.cloudflare.com/ai-gateway/reference/pricing/", "seen": "2026-10-09" }, { "what": "limits", "url": "https://developers.cloudflare.com/ai-gateway/reference/limits/", "seen": "2026-10-09" }, { "what": "changelog", "url": "https://developers.cloudflare.com/ai-gateway/changelog/", "seen": "2026-10-09" }, { "what": "Unified Billing", "url": "https://developers.cloudflare.com/ai-gateway/features/unified-billing/", "seen": "2026-10-09" }, { "what": "Machine Payments (x402)", "url": "https://developers.cloudflare.com/ai-gateway/features/machine-payments/", "seen": "2026-10-09" }, { "what": "authenticated gateway", "url": "https://developers.cloudflare.com/ai-gateway/configuration/authentication/", "seen": "2026-10-09" }, { "what": "BYOK", "url": "https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/", "seen": "2026-10-09" }, { "what": "manage gateways", "url": "https://developers.cloudflare.com/ai-gateway/configuration/manage-gateway/", "seen": "2026-10-09" }, { "what": "request handling", "url": "https://developers.cloudflare.com/ai-gateway/configuration/request-handling/", "seen": "2026-10-09" }, { "what": "fallbacks", "url": "https://developers.cloudflare.com/ai-gateway/configuration/fallbacks/", "seen": "2026-10-09" }, { "what": "rate limiting", "url": "https://developers.cloudflare.com/ai-gateway/features/rate-limiting/", "seen": "2026-10-09" }, { "what": "spend limits", "url": "https://developers.cloudflare.com/ai-gateway/features/spend-limits/", "seen": "2026-10-09" }, { "what": "dynamic routing", "url": "https://developers.cloudflare.com/ai-gateway/features/dynamic-routing/", "seen": "2026-10-09" }, { "what": "Auto Router", "url": "https://developers.cloudflare.com/ai-gateway/features/auto-router/", "seen": "2026-10-09" }, { "what": "caching", "url": "https://developers.cloudflare.com/ai-gateway/features/caching/", "seen": "2026-10-09" }, { "what": "guardrails", "url": "https://developers.cloudflare.com/ai-gateway/features/guardrails/", "seen": "2026-10-09" }, { "what": "logging", "url": "https://developers.cloudflare.com/ai-gateway/observability/logging/", "seen": "2026-10-09" }, { "what": "Legacy Logs", "url": "https://developers.cloudflare.com/ai-gateway/observability/logging/legacy-logs/", "seen": "2026-10-09" }, { "what": "analytics", "url": "https://developers.cloudflare.com/ai-gateway/observability/analytics/", "seen": "2026-10-09" }, { "what": "audit logs", "url": "https://developers.cloudflare.com/ai-gateway/reference/audit-logs/", "seen": "2026-10-09" }, { "what": "troubleshooting", "url": "https://developers.cloudflare.com/ai-gateway/reference/troubleshooting/", "seen": "2026-10-09" }, { "what": "model catalogue", "url": "https://developers.cloudflare.com/ai/models/", "seen": "2026-10-09" }, { "what": "Claude Sonnet 5 model page", "url": "https://developers.cloudflare.com/ai/models/anthropic/claude-sonnet-5/", "seen": "2026-10-09" }, { "what": "GPT-4.1 mini model page", "url": "https://developers.cloudflare.com/ai/models/openai/gpt-4.1-mini/", "seen": "2026-10-09" }, { "what": "Workers Logs pricing and limits", "url": "https://developers.cloudflare.com/workers/observability/logs/workers-logs/", "seen": "2026-10-09" }, { "what": "API token creation", "url": "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/", "seen": "2026-10-09" }, { "what": "Cloudflare API rate limits", "url": "https://developers.cloudflare.com/fundamentals/api/reference/limits/", "seen": "2026-10-09" }, { "what": "Cloudflare OpenAPI document, read from a shallow clone", "url": "https://github.com/cloudflare/api-schemas", "seen": "2026-10-09" }, { "what": "status components feed", "url": "https://www.cloudflarestatus.com/api/v2/components.json", "seen": "2026-10-09" }, { "what": "status incidents feed", "url": "https://www.cloudflarestatus.com/api/v2/incidents.json", "seen": "2026-10-09" }, { "what": "Self-Serve Subscription Agreement", "url": "https://www.cloudflare.com/terms/", "seen": "2026-10-09" }, { "what": "service-specific terms, Workers AI and AI Gateway", "url": "https://www.cloudflare.com/service-specific-terms-developer-platform/", "seen": "2026-10-09" }, { "what": "privacy policy", "url": "https://www.cloudflare.com/privacypolicy/", "seen": "2026-10-09" }, { "what": "customer DPA", "url": "https://www.cloudflare.com/cloudflare-customer-dpa/", "seen": "2026-10-09" }, { "what": "sub-processor list for Cloudflare services", "url": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/", "seen": "2026-10-09" }, { "what": "Enterprise support and SLA", "url": "https://www.cloudflare.com/enterprise-support-sla/", "seen": "2026-10-09" }, { "what": "disclosure page", "url": "https://www.cloudflare.com/disclosure/", "seen": "2026-10-09" }, { "what": "compliance resources page", "url": "https://www.cloudflare.com/trust-hub/compliance-resources/", "seen": "2026-10-09" }, { "what": "security.txt", "url": "https://www.cloudflare.com/.well-known/security.txt", "seen": "2026-10-09" }, { "what": "TypeScript SDK tags", "url": "https://github.com/cloudflare/cloudflare-typescript", "seen": "2026-10-09" }, { "what": "Python SDK tags", "url": "https://github.com/cloudflare/cloudflare-python", "seen": "2026-10-09" }, { "what": "Go SDK tags", "url": "https://github.com/cloudflare/cloudflare-go", "seen": "2026-10-09" }, { "what": "ai-gateway-provider source and tags", "url": "https://github.com/cloudflare/ai", "seen": "2026-10-09" }, { "what": "ai-gateway-provider on npm", "url": "https://registry.npmjs.org/ai-gateway-provider/latest", "seen": "2026-10-09" }, { "what": "ai-gateway-provider weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/ai-gateway-provider", "seen": "2026-10-09" }, { "what": "RDAP for cloudflare.com", "url": "https://rdap.verisign.com/com/v1/domain/cloudflare.com", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: AI Gateway incident history before 21 September 2026, since the status history page loads by script and the feed starts there", "unchecked: Cloudflare's certifications. The compliance resources page showed our reader a heading and a link to the dashboard, with no list", "unchecked: whether Free plan signup asks for a card. The pricing page says core functions are free on all plans, and we did not create an account", "unchecked: whether the x402 route answers 402 as documented. We sent no request to api.cloudflare.com or gateway.ai.cloudflare.com", "unchecked: the provider pages, WebSockets API, Worker binding, custom providers, Cloudflare Access, evaluations and OpenTelemetry pages, which were not read", "unchecked: replies to issues on the SDK repositories and in the Discord community", "Section 2.2(e) of the Self-Serve Subscription Agreement bars introducing automated agents or scripts into the Services to generate automated requests or mine data. How Cloudflare reads that for agent callers of a gateway is not stated, and it matters before any probe is run", "Section 2.2.2 of the same agreement permits benchmark tests, asks that published results include what is needed to replicate them, and gives Cloudflare a reciprocal right", "The x402 price per request, network and asset are not on the Machine Payments page. They arrive in the `PAYMENT-REQUIRED` header", "Whether the Enterprise SLA's uptime promise covers AI Gateway. Its text speaks of serving Customer Content and names no AI product", "How the sub-processor list (five model providers for AI Gateway, last updated 1 October 2025) fits with the service terms, which take third-party models outside the DPA, and with a catalogue of 24 author paths", "The first release date of AI Gateway was not established. The status component dates from 31 May 2024 and the changelog page starts on 2 January 2025", "security.txt has no Expires field. It is recorded as valid because the provenance field has no value for an incomplete file", "Three Markdown addresses on www.cloudflare.com (the terms, privacy policy and service terms with `.md` appended, as its robots.txt describes) answered 404, so the HTML pages were read", "The lead was right about both hosts. Since 21 May 2026 Cloudflare recommends the REST API on `api.cloudflare.com` and marks the Universal Endpoint and the compat route on `gateway.ai.cloudflare.com` as deprecated for new integrations", "Workers AI is listed separately as `cloudflare-workers-ai`. It shares the `/ai/run` route, the API token and the terms with this listing, and its x402 entry rests on the same Machine Payments page" ] }, "negative": -3, "negativeNotes": [ "6 October 2026. Rejected-credential responses on `POST /ai/run` changed status (ElevenLabs 403, Vertex 500 and other providers' 402 became 401 with code 2009, and Unified Billing rejections became 503) on the day of the changelog entry, with no advance notice found. Three points (https://developers.cloudflare.com/ai-gateway/changelog/)." ], "verdict": "The gateway layer is free, per-model prices are public with no markup, and logs, spend limits and fallbacks are set per gateway. API tokens cannot be limited to one gateway, the service terms take third-party models outside Cloudflare's DPA, no SLA names the product, and error codes changed on 6 October 2026 with same-day notice.", "bestFor": "Teams that already hold a Cloudflare account and want one token, one bill, logs, budgets and fallbacks in front of several model providers, or that want to keep their own provider keys behind a proxy with spend limits.", "strengths": [ "Core gateway functions (analytics, caching, rate limiting) are free on all plans, and provider prices pass through with no markup", "One Cloudflare API token reaches 241 catalogue models through OpenAI Chat Completions, OpenAI Responses, Anthropic Messages or the native `/ai/run` route", "Spend limits block requests with a 429 once a budget is reached, scoped by model, provider or request metadata, with up to 20 rules a gateway", "Logging is switched per gateway and per request, and `cf-aig-collect-log-payload: false` keeps token and cost metadata without storing prompts", "x402 payment (Machine Payments, beta since 30 September 2026) works on `POST /ai/run` for four open models" ], "weaknesses": [ "API tokens are account-scoped. Any token with AI Gateway Run can send requests through every gateway in the account and spend its stored provider keys", "The service-specific terms say the DPA and Information Security Exhibit do not apply to third-party models reached through AI Gateway", "No SLA naming AI Gateway was found. The Enterprise SLA lists service-specific SLAs for R2, Queues and Workers only", "On 6 October 2026 rejected-credential responses on `/ai/run` changed to 401 with code 2009, or 503 under Unified Billing, announced the same day", "Unified Billing traffic is capped at 200 requests per 60 seconds per gateway, and a 5 per cent fee applies to credit purchases", "Section 2.2(e) of the Self-Serve Subscription Agreement bars automated agents that generate automated requests into the Services, which matters before any probe is run" ], "agentNotes": [ "Use the REST API at `api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1` with a token holding Workers AI Read. A token with only an AI Gateway permission returns 401 with code 10000", "Send `cf-aig-gateway-id` on every Workers AI (`@cf/`) call and on dynamic routes. Without it a dynamic route resolves against the default gateway and returns 404", "Set `cf-aig-collect-log: false` or `cf-aig-collect-log-payload: false` on sensitive requests. Logging of prompts and responses is on by default", "Treat a 429 as a rate limit or a spent budget and a 401 with code 2009 as a rejected provider key. Do not retry a 2009", "Set `byok_only` on the gateway or send `cf-aig-no-wholesale: true` to stop a request without a provider key falling through to paid Unified Billing credits" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.8 } ], "editorialScores": { "ergonomics": 73, "maintenance": 75, "payments": 52, "reliability": 66, "schema": 75, "security": 75, "transparency": 51 }, "provenanceScore": 95 }, "connect": { "http": "curl -X POST \"https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/v1/chat/completions\" \\\n --header \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n \"model\": \"openai/gpt-4.1-mini\",\n \"messages\": [{\"role\": \"user\", \"content\": \"What is Cloudflare?\"}]\n }'", "x402": "curl -iX POST \"https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/run\" \\\n --header \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n --header \"Payment-Method: x402\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"model\":\"z-ai/glm-4.7-flash\",\"input\":{\"messages\":[{\"role\":\"user\",\"content\":\"What is Cloudflare?\"}]}}'" }, "letme": { "capability": "https://letme.dev/inference.llm", "tool": "https://letme.dev/cloudflare-ai-gateway" }, "sameCompany": [ "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "notable": [ "The model catalogue showed 241 models on 9 October 2026, third-party and Workers AI together, from 24 author paths including OpenAI, Google, Anthropic, xAI and Alibaba (https://developers.cloudflare.com/ai/models/)", "Since 21 May 2026 the recommended surface is the REST API on `api.cloudflare.com`. The Universal Endpoint and the `/compat/chat/completions` route on `gateway.ai.cloudflare.com` are marked deprecated for new integrations and keep working, with no end date given (https://developers.cloudflare.com/ai-gateway/usage/rest-api/)", "Machine Payments, in beta since 30 September 2026, takes x402 payment on `POST /ai/run` for `z-ai/glm-4.7-flash`, `google/gemma-4-26b-a4b-it`, `openai/gpt-oss-20b` and `alibaba/qwen3.8-27b`, with a Cloudflare API token, a United States account and a card on file (https://developers.cloudflare.com/ai-gateway/features/machine-payments/)", "A 5 per cent fee applies to Unified Billing credit purchases, and the pricing page says provider inference prices are passed through with no markup (https://developers.cloudflare.com/ai-gateway/reference/pricing/)", "The authentication page says AI Gateway Read, Run and Edit permissions cannot be restricted to a single gateway, and advises separate accounts or a Worker binding for isolation (https://developers.cloudflare.com/ai-gateway/configuration/authentication/)", "Customers whose first gateway dates from 24 September 2026 or later have logs on Workers Logs, kept 3 days on Workers Free and 7 days on Workers Paid. Earlier customers keep Legacy Logs, which persist until deleted (https://developers.cloudflare.com/ai-gateway/observability/logging/legacy-logs/)", "The service-specific terms of 28 September 2026 say the Cloudflare Data Processing Addendum and Information Security Exhibit do not apply to third-party products accessed via AI Gateway (https://www.cloudflare.com/service-specific-terms-developer-platform/)", "Each docs page opens with a block addressed to agents that says to fetch the `llms.txt` index before exploring further. It is recorded as a fact with no deduction" ], "area": "models", "details": [ { "label": "Endpoints", "value": "`POST /ai/run` (all models and modalities, model in the body), `/ai/v1/chat/completions` (OpenAI), `/ai/v1/responses` (OpenAI Responses) and `/ai/v1/messages` (Anthropic), all under https://api.cloudflare.com/client/v4/accounts/{account_id}. Provider-native endpoints at https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/{provider} keep each provider's own schema" }, { "label": "Management API", "value": "36 paths and 67 operations under `/accounts/{account_id}/ai-gateway` in Cloudflare's OpenAPI 3.0.3 document, covering gateways, logs, dynamic routes, provider keys, custom providers, custom domains and billing (credit balance, top-up, usage history). 13 operations for datasets, evaluations and the older spending limit are marked deprecated" }, { "label": "Models on 9 October 2026", "value": "241 in the shared catalogue. Each model page gives the context window, request formats, price and whether Zero Data Retention applies. Claude Sonnet 5 is listed at $2.00 in and $10.00 out per 1M tokens, GPT-4.1 mini at $0.40 and $1.60" }, { "label": "Credentials for the upstream provider", "value": "Resolved in order. A provider key on the request, then a key stored on the gateway under the `default` alias (BYOK, held in Secrets Store), then Unified Billing with Cloudflare-managed credentials. `byok_only` or `cf-aig-no-wholesale: true` stops the last step and returns 400" }, { "label": "Rate limits", "value": "Unified Billing requests are limited to 200 per 60 seconds per gateway and return 429 past that. BYOK requests are not subject to that limit. The Cloudflare API allows 1,200 requests per five minutes per token. A gateway's own rate limit is set by its owner, fixed or sliding window" }, { "label": "Spend limits", "value": "Up to 20 rules a gateway, each a dollar budget over a fixed or sliding window, scoped by model, provider or metadata key. Over budget returns 429. Enforcement is eventually consistent, so a burst can pass the limit briefly" }, { "label": "Retries and fallbacks", "value": "`cf-aig-max-attempts` (up to 5), `cf-aig-retry-delay` (up to 60,000 ms) and `cf-aig-backoff` (constant, linear, exponential) per request, or a retry policy on the gateway. Dynamic routes add conditions, percentage splits, rate and budget nodes and model fallbacks, and accept the Chat Completions shape only" }, { "label": "Auto Router", "value": "`cloudflare/auto` in place of a model name picks a model by task and cost, for Chat Completions and Responses. Response headers `cf-aig-routed-model` and `cf-aig-routing-reason` name the choice" }, { "label": "Caching", "value": "Off by default. Identical text and image requests only, TTL up to one month, request size up to 25 MB, with `cf-aig-cache-ttl`, `cf-aig-cache-key` and `cf-aig-skip-cache` per request. Streaming responses are not cached by default" }, { "label": "Background requests", "value": "`options.background` with a `webhookUrl` on `/ai/run` returns at once and posts the result to the webhook. Delivery is best-effort and not retried" }, { "label": "Logs", "value": "On by default per gateway. A log holds prompt, response, provider, status, tokens, cost, duration and user agent. `cf-aig-collect-log` and `cf-aig-collect-log-payload` override per request. Logpush export needs Workers Paid, with 4 jobs an account" }, { "label": "Guardrails and DLP", "value": "Guardrails score prompts and responses with `@cf/meta/llama-guard-3-8b` and flag or block by category, billed as Workers AI inference. DLP scanning is free, with two predefined profiles for accounts without a Zero Trust subscription" }, { "label": "Zero Data Retention", "value": "Routes Unified Billing traffic to provider endpoints that do not retain prompts or responses, on models the catalogue marks for it. It does not apply to BYOK and does not switch off AI Gateway's own logs" }, { "label": "Trains on API data", "value": "The service-specific terms say Cloudflare does not use Customer Content to train generative AI tools unless otherwise agreed. Third-party model providers act under their own terms" }, { "label": "SDKs", "value": "The OpenAI and Anthropic SDKs with a changed base URL. Cloudflare's `cloudflare` SDKs, TypeScript v7.3.0 (tagged 2 October 2026), Python v5.9.0 and Go v7.12.0. `ai-gateway-provider` 4.0.1 (11 September 2026) for the Vercel AI SDK" }, { "label": "Limits", "value": "10 gateways an account on the free plan and 20 on paid, 5 custom metadata entries a request, 64 characters in a gateway name (https://developers.cloudflare.com/ai-gateway/reference/limits/)" }, { "label": "Status", "value": "www.cloudflarestatus.com on Statuspage, with AI Gateway, Workers AI and API as separate components, all operational on 9 October 2026" } ], "unitPrices": [ { "item": "Unified Billing credit purchase fee", "unit": "pct", "usd": 5, "note": "a $100 purchase is charged $105" }, { "item": "Logpush requests past 10 million a month", "unit": "1k-requests", "usd": 0.00005, "note": "listed as $0.05 per million, Workers Paid only" } ], "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": true, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://developers.cloudflare.com/ai-gateway/changelog/", "securityTxt": "valid", "checked": "2026-10-09", "notes": [ "Terms are the Self-Serve Subscription Agreement, last updated 12 September 2025, which names Cloudflare, Inc. at 101 Townsend St, San Francisco.", "The service-specific terms (https://www.cloudflare.com/service-specific-terms-developer-platform/), last updated 28 September 2026, have a section for Workers AI and AI Gateway that supplements the agreement.", "The privacy policy is effective from 4 November 2025. The customer DPA is version 6.4, effective 3 April 2026.", "www.cloudflare.com/.well-known/security.txt, read on 9 October 2026, names HackerOne and a disclosure policy and has no Expires field. It is recorded as valid, although RFC 9116 asks for that field.", "The inference endpoints are on api.cloudflare.com and gateway.ai.cloudflare.com.", "The status page lists AI Gateway as its own component, operational on 9 October 2026.", "RDAP for cloudflare.com gives a registration date of 2009-02-17." ], "score": 95, "checks": [ { "check": "Legal entity named", "value": "Cloudflare, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "cloudflare.com, registered 2009-02-17 (17 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.cloudflare.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "www.cloudflarestatus.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.cloudflare.com/terms/", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-09-12", "words": 7048, "points": 6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated September 12, 2025", "says": "Last updated 2025-09-12" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement will be governed by the laws of the State of California without regard to conflict of law principles.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…THROUGH THE SERVICES) OR OTHERWISE UNDER THIS AGREEMENT, WHETHER IN CONTRACT, TORT, OR OTHERWISE, IS LIMITED TO THE AMOUNTS YOU HAVE PAID TO CLOUDFLARE TO ACCESS AND USE THE SERVICE IN THE 12 MONTHS PRIOR TO THE CLAIM.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may discontinue, suspend, or remove Beta Services (including any of Customer Content stored as part of the Beta Services) or your access thereto at any time in our sole discretion and may never make them generally available." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Unless otherwise specified, any modifications to this Agreement will take effect at the start of Subscription Term following the notice.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Unless otherwise expressly permitted in writing by Cloudflare, you will not and you have no right to:" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Service Level Agreements" } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(e) introduce software or automated agents or scripts into the Services so as to produce multiple accounts, generate automated searches, requests or queries, or to strip or mine data from the Services;", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We also reserve the right to modify or discontinue the Service at any time (including, without limitation, by limiting or discontinuing certain features of the Service) without notice to you.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "THIS AGREEMENT CONTAINS PROVISIONS REQUIRING THAT YOU AGREE TO THE USE OF ARBITRATION TO RESOLVE ANY DISPUTES ARISING UNDER THIS AGREEMENT RATHER THAN A JURY TRIAL OR ANY OTHER COURT PROCEEDINGS, AND TO WAIVE YOUR PARTICIPATION IN CLASS ACTION OF ANY KIND AGAINST CLOUDFLARE." } ], "notes": [ { "date": "2026-10-08", "text": "A customer who lets a third party into the account with an API token or OAuth does so at its own risk, and that party may change or delete account data.", "quote": "You acknowledge that by permitting a third party to access your Cloudflare account, the third party may obtain, modify, or delete your account data and settings." }, { "date": "2026-10-08", "text": "Fees are non-refundable, and a customer who cancels is billed in full for the subscription term in which it cancels.", "quote": "YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM." }, { "date": "2026-10-08", "text": "Cloudflare accepts no liability for harm arising from free or trial versions of the Services.", "quote": "We will have no liability for any harm or damage arising out of or in connection with any Free Services." } ] }, { "kind": "privacy", "url": "https://www.cloudflare.com/privacypolicy/", "state": "read", "readAt": "2026-10-08", "words": 7595, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Customer Account Information: When you register for an account, we collect contact information." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of this policy or as long as needed to fulfill and comply with legal obligations.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Non-personally identifiable, aggregated data may be shared with third parties." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We will not sell or rent your personal information.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Where we rely on your consent to process your personal data, you have the right to withdraw or decline consent at any time." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us at privacyquestions@cloudflare.com.", "says": "privacyquestions@cloudflare.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "The Global CBPR System means the data privacy framework established by the Global CBPR Forum against which data controllers can voluntarily certify and undergo assessment by third-party accountability agents to enable accountable cross-border data flows among participating jurisdictions, and the Global PRP System mean…", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "Making Personal Information (such as online identifiers or browsing activity) available to these companies may be considered a “sale” or “sharing” of your Personal Information under the CCPA." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway.json", "live": { "slug": "cloudflare-ai-gateway", "probe": { "target": "https://api.cloudflare.com/client/v4/accounts/{account_id}/ai", "method": "get", "lastAt": "2026-10-10T02:07:05.368706589Z", "lastOk": true, "lastStatus": 404, "lastMs": 35, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 46, "p95ms24h": 109, "samples24h": 107, "samples30d": 107, "days": [ { "date": "2026-10-09", "probes": 85, "ok": 85 }, { "date": "2026-10-10", "probes": 22, "ok": 22 } ] }, "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-10-10T02:05:44.164927631Z" }, "versions": [ { "registry": "github", "name": "cloudflare/ai", "version": "ai-gateway-provider@4.0.1", "released": "2026-09-11", "seenAt": "2026-10-09T16:46:01.078937772Z" }, { "registry": "npm", "name": "ai-gateway-provider", "version": "4.0.1", "seenAt": "2026-10-09T16:45:58.587383795Z" }, { "registry": "npm", "name": "cloudflare", "version": "7.3.0", "seenAt": "2026-10-09T16:45:59.520764845Z" }, { "registry": "pypi", "name": "cloudflare", "version": "5.9.0", "released": "2026-10-03", "seenAt": "2026-10-09T16:46:00.865337498Z" } ], "githubStars": 1189, "npmWeekly": 250648, "pypiWeekly": 365643, "pages": [ { "url": "https://developers.cloudflare.com/ai-gateway/changelog/", "kind": "changelog", "status": 200, "checkedAt": "2026-10-09T18:35:34.168809494Z", "changedAt": "2026-10-07T18:04:13.791253735Z", "fingerprint": "aaad1064978c" }, { "url": "https://developers.cloudflare.com/ai-gateway/reference/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-09T18:35:36.234430797Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "57a018b683c5" }, { "url": "https://www.cloudflare.com/privacypolicy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-09T18:49:06.00094733Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e562d2a2da97" }, { "url": "https://www.cloudflare.com/terms/", "kind": "terms", "status": 200, "checkedAt": "2026-10-09T18:49:08.260967052Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d26dd2a74bde" } ], "updatedAt": "2026-10-10T02:07:05.368706589Z" } }, "verify": { "accepts": "a page on cloudflare.com or one of its subdomains, or the README of github.com/cloudflare/ai", "badgeUrl": "https://www.anchorterminal.com/badges/cloudflare-ai-gateway.svg", "body": { "slug": "cloudflare-ai-gateway", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/cloudflare-ai-gateway\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/cloudflare-ai-gateway.svg\" alt=\"Cloudflare AI Gateway on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Cloudflare AI Gateway on Anchor Terminal](https://www.anchorterminal.com/badges/cloudflare-ai-gateway.svg)](https://www.anchorterminal.com/tools/cloudflare-ai-gateway)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/cloudflare-ai-gateway\"\u003eCloudflare AI Gateway on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway", "json": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway.md", "slim": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway.min.md" }, "markdown": "## Overview\n\n**Grade B · 66.8/100 · rank #275 of 950 · #8 in Model APIs \u0026 inference · not agent-ready · confidence medium**\n\n\nMore from Cloudflare, Inc., listed separately because each is its own product: [Cloudflare Workers AI](https://www.anchorterminal.com/tools/cloudflare-workers-ai.md) (Model APIs \u0026 inference), [Cloudflare Sandbox SDK](https://www.anchorterminal.com/tools/cloudflare-sandbox-sdk.md) (Code execution sandboxes), [Cloudflare Web Search API](https://www.anchorterminal.com/tools/cloudflare-web-search.md) (Web search APIs), [Cloudflare MCP Servers](https://www.anchorterminal.com/tools/cloudflare-mcp.md) (Cloud \u0026 infrastructure), [Cloudflare Email Service](https://www.anchorterminal.com/tools/cloudflare-email-service.md) (Email delivery APIs), [Cloudflare R2](https://www.anchorterminal.com/tools/cloudflare-r2.md) (File storage \u0026 sharing), [Clef](https://www.anchorterminal.com/tools/cloudflare-clef.md) (Decision models).\n\n## Assessment\n\nThe gateway layer is free, per-model prices are public with no markup, and logs, spend limits and fallbacks are set per gateway. API tokens cannot be limited to one gateway, the service terms take third-party models outside Cloudflare's DPA, no SLA names the product, and error codes changed on 6 October 2026 with same-day notice.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Cloudflare, Inc. (https://www.cloudflare.com) |\n| Kind | Model router |\n| Category | Model APIs \u0026 inference (https://www.anchorterminal.com/categories/inference) |\n| Transport | HTTP |\n| Endpoint | `https://api.cloudflare.com/client/v4/accounts/{account_id}/ai` |\n| Auth | API key · A Cloudflare API token as a Bearer header, created by a person in the dashboard. The `/ai/*` inference routes need Workers AI Read, and the `/ai-gateway/*` management routes need AI Gateway Read or Edit. Provider-native endpoints on `gateway.ai.cloudflare.com` take the token in `cf-aig-authorization`. Tokens can carry an expiry and an IP address filter and cannot be limited to one gateway. Access is self-serve, with no review or sales step. |\n| Pricing | Freemium (5% fee) · Free on all plans for analytics, caching and rate limiting, with a Cloudflare account. Third-party models are paid from prepaid Unified Billing credits at provider prices plus a 5 per cent fee on each credit purchase, or with the caller's own provider keys at no Cloudflare charge. Logs for new customers follow Workers Logs pricing, 200,000 events a day free. An account on the Free plan starts without a contract (https://developers.cloudflare.com/ai-gateway/reference/pricing/, checked 2026-10-09). |\n| x402 | Payer tooling only · Machine Payments, in beta since 30 September 2026, takes x402 payment on `POST /ai/run` for four open models when the request carries `Payment-Method: x402`. It needs a Cloudflare API token, a United States account and a card on file. The OpenAI-style and Anthropic-style routes are not covered. We did not call it (https://developers.cloudflare.com/ai-gateway/features/machine-payments/, checked 2026-10-09). |\n| Licence | Proprietary service under Cloudflare's Self-Serve Subscription Agreement and its service-specific terms. Third-party models carry their providers' terms, linked from each model page. `ai-gateway-provider` is MIT and Cloudflare's OpenAPI repository is BSD-3-Clause |\n| Packages | npm: `ai-gateway-provider`; npm: `cloudflare`; pypi: `cloudflare` |\n| Source | https://github.com/cloudflare/ai |\n| Docs | https://developers.cloudflare.com/ai-gateway/ |\n| llms.txt | https://developers.cloudflare.com/ai-gateway/llms.txt |\n| Last release | 2026-10-06 |\n| npm downloads / week | 250,648 |\n| Endpoints | `POST /ai/run` (all models and modalities, model in the body), `/ai/v1/chat/completions` (OpenAI), `/ai/v1/responses` (OpenAI Responses) and `/ai/v1/messages` (Anthropic), all under https://api.cloudflare.com/client/v4/accounts/{account_id}. Provider-native endpoints at https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/{provider} keep each provider's own schema |\n| Management API | 36 paths and 67 operations under `/accounts/{account_id}/ai-gateway` in Cloudflare's OpenAPI 3.0.3 document, covering gateways, logs, dynamic routes, provider keys, custom providers, custom domains and billing (credit balance, top-up, usage history). 13 operations for datasets, evaluations and the older spending limit are marked deprecated |\n| Models on 9 October 2026 | 241 in the shared catalogue. Each model page gives the context window, request formats, price and whether Zero Data Retention applies. Claude Sonnet 5 is listed at $2.00 in and $10.00 out per 1M tokens, GPT-4.1 mini at $0.40 and $1.60 |\n| Credentials for the upstream provider | Resolved in order. A provider key on the request, then a key stored on the gateway under the `default` alias (BYOK, held in Secrets Store), then Unified Billing with Cloudflare-managed credentials. `byok_only` or `cf-aig-no-wholesale: true` stops the last step and returns 400 |\n| Rate limits | Unified Billing requests are limited to 200 per 60 seconds per gateway and return 429 past that. BYOK requests are not subject to that limit. The Cloudflare API allows 1,200 requests per five minutes per token. A gateway's own rate limit is set by its owner, fixed or sliding window |\n| Spend limits | Up to 20 rules a gateway, each a dollar budget over a fixed or sliding window, scoped by model, provider or metadata key. Over budget returns 429. Enforcement is eventually consistent, so a burst can pass the limit briefly |\n| Retries and fallbacks | `cf-aig-max-attempts` (up to 5), `cf-aig-retry-delay` (up to 60,000 ms) and `cf-aig-backoff` (constant, linear, exponential) per request, or a retry policy on the gateway. Dynamic routes add conditions, percentage splits, rate and budget nodes and model fallbacks, and accept the Chat Completions shape only |\n| Auto Router | `cloudflare/auto` in place of a model name picks a model by task and cost, for Chat Completions and Responses. Response headers `cf-aig-routed-model` and `cf-aig-routing-reason` name the choice |\n| Caching | Off by default. Identical text and image requests only, TTL up to one month, request size up to 25 MB, with `cf-aig-cache-ttl`, `cf-aig-cache-key` and `cf-aig-skip-cache` per request. Streaming responses are not cached by default |\n| Background requests | `options.background` with a `webhookUrl` on `/ai/run` returns at once and posts the result to the webhook. Delivery is best-effort and not retried |\n| Logs | On by default per gateway. A log holds prompt, response, provider, status, tokens, cost, duration and user agent. `cf-aig-collect-log` and `cf-aig-collect-log-payload` override per request. Logpush export needs Workers Paid, with 4 jobs an account |\n| Guardrails and DLP | Guardrails score prompts and responses with `@cf/meta/llama-guard-3-8b` and flag or block by category, billed as Workers AI inference. DLP scanning is free, with two predefined profiles for accounts without a Zero Trust subscription |\n| Zero Data Retention | Routes Unified Billing traffic to provider endpoints that do not retain prompts or responses, on models the catalogue marks for it. It does not apply to BYOK and does not switch off AI Gateway's own logs |\n| Trains on API data | The service-specific terms say Cloudflare does not use Customer Content to train generative AI tools unless otherwise agreed. Third-party model providers act under their own terms |\n| SDKs | The OpenAI and Anthropic SDKs with a changed base URL. Cloudflare's `cloudflare` SDKs, TypeScript v7.3.0 (tagged 2 October 2026), Python v5.9.0 and Go v7.12.0. `ai-gateway-provider` 4.0.1 (11 September 2026) for the Vercel AI SDK |\n| Limits | 10 gateways an account on the free plan and 20 on paid, 5 custom metadata entries a request, 64 characters in a gateway name (https://developers.cloudflare.com/ai-gateway/reference/limits/) |\n| Status | www.cloudflarestatus.com on Statuspage, with AI Gateway, Workers AI and API as separate components, all operational on 9 October 2026 |\n| Capabilities | inference.llm, inference.router, obs.gateway, guard.moderation, guard.pii |\n| Tags | hosted, router, free-tier, usage-based, x402, openapi, llms-txt, openai-compatible, typescript, python, go, status-page, bug-bounty |\n| JSON | https://www.anchorterminal.com/api/v1/tools/cloudflare-ai-gateway.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-09 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 66 | 13.2 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 75 | 12.2 |\n| Agent ergonomics | 13% | 16.2 | 73 | 11.9 |\n| Security \u0026 auth | 14% | 17.5 | 75 | 13.1 |\n| Payments \u0026 pricing | 10% | 12.5 | 52 | 6.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 75 | 6.6 |\n| Transparency \u0026 trust (editorial 51, provenance 95) | 7% | 8.8 | 73 | 6.4 |\n| Negative events | up to −15 | up to −15 | 6 October 2026. Rejected-credential responses on `POST /ai/run` changed status (ElevenLabs 403, Vertex 500 and other providers' 402 became 401 with code 2009, and Unified Billing rejections became 503) on the day of the changelog entry, with no advance notice found. Three points (https://developers.cloudflare.com/ai-gateway/changelog/). | -3 |\n| **Total** | | | | **66.8 → B** |\n\n### Why each score\n\n- Reliability 66: Hosted reading. www.cloudflarestatus.com is a Statuspage with AI Gateway, Workers AI and API as separate components (20). The incidents feed held 50 incidents from 21 September to 8 October 2026, none naming AI Gateway. The API component, which carries the REST routes, had an 18-minute minor incident on 7 October and delayed permission changes for four and a half hours on 30 September. The history page loads by script, so the rest of the 90 days went unread (10 of 30). Unified Billing traffic is limited to 200 requests per 60 seconds per gateway, the Cloudflare API to 1,200 requests per five minutes per token, and BYOK traffic has no gateway limit (15). Over-limit and over-budget requests return 429, the Cloudflare API returns `retry-after` and `Ratelimit` headers for its own limit, and retries with backoff and model fallbacks can be set per request or per gateway. No `Retry-After` was found for the gateway's own 429, and nothing separates a rate-limit 429 from a spend-limit 429 (11 of 15). No SLA naming AI Gateway was found. The Enterprise SLA lists service-specific SLAs for R2, Queues and Workers only (0). The core product carries no beta label, and Machine Payments is in beta (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 75: Router, scored on the API lines. Cloudflare's public OpenAPI 3.0.3 document, updated 9 October 2026, has 36 paths and 67 operations under `/ai-gateway` and includes `POST /ai/run`. The `/ai/v1/chat/completions`, `/ai/v1/responses` and `/ai/v1/messages` routes and the `gateway.ai.cloudflare.com` endpoints are not in it (20 of 25). An AI Gateway `llms.txt` and a Markdown copy of every page (10). Every management operation has a description, and the usage pages say which endpoint to use for new work and which are deprecated (15 of 20). Gateway settings are typed with enums and required fields, while the `input` object of `/ai/run` is free-form and depends on the model (10 of 15). Curl, SDK and Worker examples on most pages. No table of gateway error codes was found. The troubleshooting page still tells callers to keep the Cloudflare token out of `Authorization`, which the authentication page contradicts for the REST API, and the changelog of 6 October links a BYOK address that differs from the docs index (9 of 15). A dated changelog with RSS. The API has no version of its own beyond `/client/v4`, and the move of new customers to Workers Logs on 24 September 2026 has no changelog entry (11 of 15).\n- Agent ergonomics 73: Router, read on the model lines (tool use, structured output, caching, context, batch, SDKs, errors). Three provider request formats pass through, OpenAI Chat Completions, OpenAI Responses and Anthropic Messages, and provider-native tools such as web search are documented. Tool behaviour depends on the routed model (15 of 20). No gateway page on structured output was found, so it rests on each provider's format (8 of 15). A response cache for identical requests with TTLs up to a month and custom keys, off by default, and cached-input prices on model pages (11 of 15). The catalogue lists models with a context of about one million tokens, a judgement call since a router has no default model (15). Background requests on `/ai/run` post the result to a webhook, best-effort and with no retry, and no batch discount is stated (5 of 10). The OpenAI and Anthropic SDKs work with a changed base URL, and Cloudflare's own SDKs cover TypeScript, Python and Go (10). Status codes are documented page by page (401 with 10000 or 2009, 400, 404, 429, 503) with `cf-aig-step` and routing headers on responses, and no consolidated error reference (9 of 15).\n- Security \u0026 auth 75: Router, read on the model lines. Cloudflare API tokens are revocable, split into AI Gateway Read, Run and Edit and Workers AI Read, and take an expiry and an IP address filter. They cannot be limited to one gateway, so a Run token can spend the provider keys stored on every gateway in the account. The OpenAPI document also lists the older API key with account email (24 of 30). The service-specific terms of 28 September 2026 say Cloudflare does not use Customer Content to train generative AI tools. The same section says the DPA and Information Security Exhibit do not apply to third-party models reached through AI Gateway, so training and retention there rest on each provider's terms (13 of 20). Prompts and responses are logged by default. Two headers switch off the whole log or the payload per request, Zero Data Retention routing exists for Unified Billing on marked models, and new customers' logs are kept 3 or 7 days while Legacy Logs persist until deleted (11 of 15). Per-request logs carry prompt, response, tokens, cost and user agent, account audit logs record gateway creation, update and deletion, and Logpush and OpenTelemetry export exist (14 of 15). security.txt names a HackerOne bounty programme and a disclosure policy, with no Expires field. The certifications page drew no list for our reader (13 of 20). Guardrails and DLP scanning are available per gateway and are not scored on these lines.\n- Payments \u0026 pricing 52: x402 is in beta on `POST /ai/run` since 30 September 2026 for four open models of 241 in the catalogue. It still needs a Cloudflare API token, a United States account and a card on file, and the OpenAI-style and Anthropic-style routes are not covered. We did not call it (12 of 40). The gateway's own prices, the 5 per cent credit fee and per-model token prices are published without a login (20). Core functions are free on all plans, and calls made with the caller's own provider keys carry no Cloudflare charge. We did not sign up to confirm that no card is asked for (20). A person creates the account and the first token in a browser, and the x402 route needs both (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 75: Router, read on the model lines. The newest changelog entry is 6 October 2026 (30). No minimum notice for API changes was found. The Universal Endpoint and the compat route are marked deprecated with a promise to keep working and no end date, and the error-code change of 6 October 2026 took effect on the day it was announced (5 of 12). No gateway endpoint was shut down in the last 90 days that we found. Thirteen dataset, evaluation and spending-limit operations are marked deprecated in the OpenAPI document with no changelog entry (5 of 8). A dated changelog with RSS and eleven entries between 5 August and 6 October 2026. The Discord community was not sampled (11 of 15). Replies on the SDK repositories were not examined (3 of 10). `cloudflare` for TypeScript v7.3.0 was tagged on 2 October 2026, Python is at v5.9.0 and Go at v7.12.0, and `ai-gateway-provider` 4.0.1 dates from 11 September 2026 (14 of 15). The OpenAPI repository was updated on 9 October 2026 (7 of 10).\n- Transparency \u0026 trust 73: Closed service under the Self-Serve Subscription Agreement and service-specific terms with a section for Workers AI and AI Gateway. Each model page links the provider's terms, `ai-gateway-provider` is MIT and the OpenAPI repository is BSD-3-Clause (16 of 30). The service terms, the logging and Zero Data Retention pages, the DPA (version 6.4, 3 April 2026) and the privacy policy of 4 November 2025 were read. The privacy policy gives retention criteria, not periods. The terms take third-party models outside the DPA, while the sub-processor list names five model providers for AI Gateway, and the two are hard to square (17 of 30). No deprecation policy was found. Deprecated endpoints carry notices with no dates, and section 8 of the agreement lets Cloudflare modify or discontinue a service without notice (6 of 20). The sub-processor list, last updated 1 October 2025, names Google, Anthropic, OpenAI, xAI and Groq for AI Gateway with locations. The catalogue on 9 October 2026 also carries models from Alibaba, ByteDance, MiniMax and others that the list does not name (12 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (26 items): https://www.anchorterminal.com/fixes/cloudflare-ai-gateway.md (JSON https://www.anchorterminal.com/fixes/cloudflare-ai-gateway.json)\n\n### What we couldn't check\n\n- unchecked: AI Gateway incident history before 21 September 2026, since the status history page loads by script and the feed starts there\n- unchecked: Cloudflare's certifications. The compliance resources page showed our reader a heading and a link to the dashboard, with no list\n- unchecked: whether Free plan signup asks for a card. The pricing page says core functions are free on all plans, and we did not create an account\n- unchecked: whether the x402 route answers 402 as documented. We sent no request to api.cloudflare.com or gateway.ai.cloudflare.com\n- unchecked: the provider pages, WebSockets API, Worker binding, custom providers, Cloudflare Access, evaluations and OpenTelemetry pages, which were not read\n- unchecked: replies to issues on the SDK repositories and in the Discord community\n- Section 2.2(e) of the Self-Serve Subscription Agreement bars introducing automated agents or scripts into the Services to generate automated requests or mine data. How Cloudflare reads that for agent callers of a gateway is not stated, and it matters before any probe is run\n- Section 2.2.2 of the same agreement permits benchmark tests, asks that published results include what is needed to replicate them, and gives Cloudflare a reciprocal right\n- The x402 price per request, network and asset are not on the Machine Payments page. They arrive in the `PAYMENT-REQUIRED` header\n- Whether the Enterprise SLA's uptime promise covers AI Gateway. Its text speaks of serving Customer Content and names no AI product\n- How the sub-processor list (five model providers for AI Gateway, last updated 1 October 2025) fits with the service terms, which take third-party models outside the DPA, and with a catalogue of 24 author paths\n- The first release date of AI Gateway was not established. The status component dates from 31 May 2024 and the changelog page starts on 2 January 2025\n- security.txt has no Expires field. It is recorded as valid because the provenance field has no value for an incomplete file\n- Three Markdown addresses on www.cloudflare.com (the terms, privacy policy and service terms with `.md` appended, as its robots.txt describes) answered 404, so the HTML pages were read\n- The lead was right about both hosts. Since 21 May 2026 Cloudflare recommends the REST API on `api.cloudflare.com` and marks the Universal Endpoint and the compat route on `gateway.ai.cloudflare.com` as deprecated for new integrations\n- Workers AI is listed separately as `cloudflare-workers-ai`. It shares the `/ai/run` route, the API token and the terms with this listing, and its x402 entry rests on the same Machine Payments page\n\n### Sources\n\n- AI Gateway overview: \u003chttps://developers.cloudflare.com/ai-gateway/\u003e (seen 2026-10-09)\n- AI Gateway llms.txt: \u003chttps://developers.cloudflare.com/ai-gateway/llms.txt\u003e (seen 2026-10-09)\n- getting started: \u003chttps://developers.cloudflare.com/ai-gateway/get-started/\u003e (seen 2026-10-09)\n- REST API: \u003chttps://developers.cloudflare.com/ai-gateway/usage/rest-api/\u003e (seen 2026-10-09)\n- Unified API (OpenAI compat), deprecation notice: \u003chttps://developers.cloudflare.com/ai-gateway/usage/chat-completion/\u003e (seen 2026-10-09)\n- Universal Endpoint, deprecation notice: \u003chttps://developers.cloudflare.com/ai-gateway/usage/universal/\u003e (seen 2026-10-09)\n- pricing: \u003chttps://developers.cloudflare.com/ai-gateway/reference/pricing/\u003e (seen 2026-10-09)\n- limits: \u003chttps://developers.cloudflare.com/ai-gateway/reference/limits/\u003e (seen 2026-10-09)\n- changelog: \u003chttps://developers.cloudflare.com/ai-gateway/changelog/\u003e (seen 2026-10-09)\n- Unified Billing: \u003chttps://developers.cloudflare.com/ai-gateway/features/unified-billing/\u003e (seen 2026-10-09)\n- Machine Payments (x402): \u003chttps://developers.cloudflare.com/ai-gateway/features/machine-payments/\u003e (seen 2026-10-09)\n- authenticated gateway: \u003chttps://developers.cloudflare.com/ai-gateway/configuration/authentication/\u003e (seen 2026-10-09)\n- BYOK: \u003chttps://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/\u003e (seen 2026-10-09)\n- manage gateways: \u003chttps://developers.cloudflare.com/ai-gateway/configuration/manage-gateway/\u003e (seen 2026-10-09)\n- request handling: \u003chttps://developers.cloudflare.com/ai-gateway/configuration/request-handling/\u003e (seen 2026-10-09)\n- fallbacks: \u003chttps://developers.cloudflare.com/ai-gateway/configuration/fallbacks/\u003e (seen 2026-10-09)\n- rate limiting: \u003chttps://developers.cloudflare.com/ai-gateway/features/rate-limiting/\u003e (seen 2026-10-09)\n- spend limits: \u003chttps://developers.cloudflare.com/ai-gateway/features/spend-limits/\u003e (seen 2026-10-09)\n- dynamic routing: \u003chttps://developers.cloudflare.com/ai-gateway/features/dynamic-routing/\u003e (seen 2026-10-09)\n- Auto Router: \u003chttps://developers.cloudflare.com/ai-gateway/features/auto-router/\u003e (seen 2026-10-09)\n- caching: \u003chttps://developers.cloudflare.com/ai-gateway/features/caching/\u003e (seen 2026-10-09)\n- guardrails: \u003chttps://developers.cloudflare.com/ai-gateway/features/guardrails/\u003e (seen 2026-10-09)\n- logging: \u003chttps://developers.cloudflare.com/ai-gateway/observability/logging/\u003e (seen 2026-10-09)\n- Legacy Logs: \u003chttps://developers.cloudflare.com/ai-gateway/observability/logging/legacy-logs/\u003e (seen 2026-10-09)\n- analytics: \u003chttps://developers.cloudflare.com/ai-gateway/observability/analytics/\u003e (seen 2026-10-09)\n- audit logs: \u003chttps://developers.cloudflare.com/ai-gateway/reference/audit-logs/\u003e (seen 2026-10-09)\n- troubleshooting: \u003chttps://developers.cloudflare.com/ai-gateway/reference/troubleshooting/\u003e (seen 2026-10-09)\n- model catalogue: \u003chttps://developers.cloudflare.com/ai/models/\u003e (seen 2026-10-09)\n- Claude Sonnet 5 model page: \u003chttps://developers.cloudflare.com/ai/models/anthropic/claude-sonnet-5/\u003e (seen 2026-10-09)\n- GPT-4.1 mini model page: \u003chttps://developers.cloudflare.com/ai/models/openai/gpt-4.1-mini/\u003e (seen 2026-10-09)\n- Workers Logs pricing and limits: \u003chttps://developers.cloudflare.com/workers/observability/logs/workers-logs/\u003e (seen 2026-10-09)\n- API token creation: \u003chttps://developers.cloudflare.com/fundamentals/api/get-started/create-token/\u003e (seen 2026-10-09)\n- Cloudflare API rate limits: \u003chttps://developers.cloudflare.com/fundamentals/api/reference/limits/\u003e (seen 2026-10-09)\n- Cloudflare OpenAPI document, read from a shallow clone: \u003chttps://github.com/cloudflare/api-schemas\u003e (seen 2026-10-09)\n- status components feed: \u003chttps://www.cloudflarestatus.com/api/v2/components.json\u003e (seen 2026-10-09)\n- status incidents feed: \u003chttps://www.cloudflarestatus.com/api/v2/incidents.json\u003e (seen 2026-10-09)\n- Self-Serve Subscription Agreement: \u003chttps://www.cloudflare.com/terms/\u003e (seen 2026-10-09)\n- service-specific terms, Workers AI and AI Gateway: \u003chttps://www.cloudflare.com/service-specific-terms-developer-platform/\u003e (seen 2026-10-09)\n- privacy policy: \u003chttps://www.cloudflare.com/privacypolicy/\u003e (seen 2026-10-09)\n- customer DPA: \u003chttps://www.cloudflare.com/cloudflare-customer-dpa/\u003e (seen 2026-10-09)\n- sub-processor list for Cloudflare services: \u003chttps://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/\u003e (seen 2026-10-09)\n- Enterprise support and SLA: \u003chttps://www.cloudflare.com/enterprise-support-sla/\u003e (seen 2026-10-09)\n- disclosure page: \u003chttps://www.cloudflare.com/disclosure/\u003e (seen 2026-10-09)\n- compliance resources page: \u003chttps://www.cloudflare.com/trust-hub/compliance-resources/\u003e (seen 2026-10-09)\n- security.txt: \u003chttps://www.cloudflare.com/.well-known/security.txt\u003e (seen 2026-10-09)\n- TypeScript SDK tags: \u003chttps://github.com/cloudflare/cloudflare-typescript\u003e (seen 2026-10-09)\n- Python SDK tags: \u003chttps://github.com/cloudflare/cloudflare-python\u003e (seen 2026-10-09)\n- Go SDK tags: \u003chttps://github.com/cloudflare/cloudflare-go\u003e (seen 2026-10-09)\n- ai-gateway-provider source and tags: \u003chttps://github.com/cloudflare/ai\u003e (seen 2026-10-09)\n- ai-gateway-provider on npm: \u003chttps://registry.npmjs.org/ai-gateway-provider/latest\u003e (seen 2026-10-09)\n- ai-gateway-provider weekly downloads: \u003chttps://api.npmjs.org/downloads/point/last-week/ai-gateway-provider\u003e (seen 2026-10-09)\n- RDAP for cloudflare.com: \u003chttps://rdap.verisign.com/com/v1/domain/cloudflare.com\u003e (seen 2026-10-09)\n\n## Who's behind it (provenance 95/100, checked 2026-10-09)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Cloudflare, Inc. | 20/20 |\n| Domain age | cloudflare.com, registered 2009-02-17 (17 years) | 15/15 |\n| Endpoint on the vendor's domain | api.cloudflare.com | 15/15 |\n| Terms of service | read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points | 6/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | www.cloudflarestatus.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nTerms are the Self-Serve Subscription Agreement, last updated 12 September 2025, which names Cloudflare, Inc. at 101 Townsend St, San Francisco.\n\nThe service-specific terms (https://www.cloudflare.com/service-specific-terms-developer-platform/), last updated 28 September 2026, have a section for Workers AI and AI Gateway that supplements the agreement.\n\nThe privacy policy is effective from 4 November 2025. The customer DPA is version 6.4, effective 3 April 2026.\n\nwww.cloudflare.com/.well-known/security.txt, read on 9 October 2026, names HackerOne and a disclosure policy and has no Expires field. It is recorded as valid, although RFC 9116 asks for that field.\n\nThe inference endpoints are on api.cloudflare.com and gateway.ai.cloudflare.com.\n\nThe status page lists AI Gateway as its own component, operational on 9 October 2026.\n\nRDAP for cloudflare.com gives a registration date of 2009-02-17.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.cloudflare.com/terms/), read 2026-10-08, dated 2025-09-12, states 7 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"(e) introduce software or automated agents or scripts into the Services so as to produce multiple accounts, generate automated searches, requests or queries, or to strip or mine data from the Services;\"\n- To know. Says the terms or the service can change without notice (costs points). \"We also reserve the right to modify or discontinue the Service at any time (including, without limitation, by limiting or discontinuing certain features of the Service) without notice to you.\"\n- To know. Says access can be ended without notice or for any reason. \"We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all.\"\n- To know. Requires arbitration or waives class actions. \"THIS AGREEMENT CONTAINS PROVISIONS REQUIRING THAT YOU AGREE TO THE USE OF ARBITRATION TO RESOLVE ANY DISPUTES ARISING UNDER THIS AGREEMENT RATHER THAN A JURY TRIAL OR ANY OTHER COURT PROCEEDINGS, AND TO WAIVE YOUR PARTICIPATION IN CLASS ACTION OF ANY KIND AGAINST CLOUDFLARE.\"\n- Gives the date it was last updated. Last updated 2025-09-12.\n- Names the governing law or courts. The law of the State of California.\n- States a limit on its liability. Capped at the fees paid in the 12 months before the claim.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Also in the text (2026-10-08). A customer who lets a third party into the account with an API token or OAuth does so at its own risk, and that party may change or delete account data. \"You acknowledge that by permitting a third party to access your Cloudflare account, the third party may obtain, modify, or delete your account data and settings.\"\n- Also in the text (2026-10-08). Fees are non-refundable, and a customer who cancels is billed in full for the subscription term in which it cancels. \"YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM.\"\n- Also in the text (2026-10-08). Cloudflare accepts no liability for harm arising from free or trial versions of the Services. \"We will have no liability for any harm or damage arising out of or in connection with any Free Services.\"\n\n**Privacy policy** (https://www.cloudflare.com/privacypolicy/), read 2026-10-08, gives no date, states 7 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"Making Personal Information (such as online identifiers or browsing activity) available to these companies may be considered a “sale” or “sharing” of your Personal Information under the CCPA.\"\n- Not found in the text. Gives the date it was last updated.\n- Says how long data is kept. For as long as needed, with no period named.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. privacyquestions@cloudflare.com.\n- Says where data is transferred or stored. Relies on the Data Privacy Framework.\n\n## Live (updated 2026-10-10 02:07 UTC)\n\n- Right now: up, HTTP 404, 35 ms, checked 2026-10-10 02:07 UTC (get on `https://api.cloudflare.com/client/v4/accounts/{account_id}/ai`)\n- Uptime 24h 100.0% (107 probes) · 30 days 100.0% (107 probes) · p50 46 ms · p95 109 ms\n- Vendor status page: major, Partial System Outage\n- github `cloudflare/ai` ai-gateway-provider@4.0.1, released 2026-09-11\n- npm `ai-gateway-provider` 4.0.1\n- npm `cloudflare` 7.3.0\n- pypi `cloudflare` 5.9.0, released 2026-10-03\n- Watching changelog \u003chttps://developers.cloudflare.com/ai-gateway/changelog/\u003e, last changed 2026-10-07 18:04 UTC\n- Watching pricing \u003chttps://developers.cloudflare.com/ai-gateway/reference/pricing/\u003e\n- Watching privacy \u003chttps://www.cloudflare.com/privacypolicy/\u003e\n- Watching terms \u003chttps://www.cloudflare.com/terms/\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/cloudflare-ai-gateway.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Unified Billing credit purchase fee | 5% | percentage fee | a $100 purchase is charged $105 |\n| Logpush requests past 10 million a month | $0.0001 | per 1,000 requests | listed as $0.05 per million, Workers Paid only |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Core gateway functions (analytics, caching, rate limiting) are free on all plans, and provider prices pass through with no markup\n- One Cloudflare API token reaches 241 catalogue models through OpenAI Chat Completions, OpenAI Responses, Anthropic Messages or the native `/ai/run` route\n- Spend limits block requests with a 429 once a budget is reached, scoped by model, provider or request metadata, with up to 20 rules a gateway\n- Logging is switched per gateway and per request, and `cf-aig-collect-log-payload: false` keeps token and cost metadata without storing prompts\n- x402 payment (Machine Payments, beta since 30 September 2026) works on `POST /ai/run` for four open models\n\n## Weaknesses\n\n- API tokens are account-scoped. Any token with AI Gateway Run can send requests through every gateway in the account and spend its stored provider keys\n- The service-specific terms say the DPA and Information Security Exhibit do not apply to third-party models reached through AI Gateway\n- No SLA naming AI Gateway was found. The Enterprise SLA lists service-specific SLAs for R2, Queues and Workers only\n- On 6 October 2026 rejected-credential responses on `/ai/run` changed to 401 with code 2009, or 503 under Unified Billing, announced the same day\n- Unified Billing traffic is capped at 200 requests per 60 seconds per gateway, and a 5 per cent fee applies to credit purchases\n- Section 2.2(e) of the Self-Serve Subscription Agreement bars automated agents that generate automated requests into the Services, which matters before any probe is run\n\n## Before you call it (notes for agents)\n\n1. Use the REST API at `api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1` with a token holding Workers AI Read. A token with only an AI Gateway permission returns 401 with code 10000\n2. Send `cf-aig-gateway-id` on every Workers AI (`@cf/`) call and on dynamic routes. Without it a dynamic route resolves against the default gateway and returns 404\n3. Set `cf-aig-collect-log: false` or `cf-aig-collect-log-payload: false` on sensitive requests. Logging of prompts and responses is on by default\n4. Treat a 429 as a rate limit or a spent budget and a 401 with code 2009 as a rejected provider key. Do not retry a 2009\n5. Set `byok_only` on the gateway or send `cf-aig-no-wholesale: true` to stop a request without a provider key falling through to paid Unified Billing credits\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -X POST \"https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/v1/chat/completions\" \\\n --header \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n \"model\": \"openai/gpt-4.1-mini\",\n \"messages\": [{\"role\": \"user\", \"content\": \"What is Cloudflare?\"}]\n }'\n```\n\nPay per call with x402:\n\n```bash\ncurl -iX POST \"https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/run\" \\\n --header \"Authorization: Bearer $CLOUDFLARE_API_TOKEN\" \\\n --header \"Payment-Method: x402\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"model\":\"z-ai/glm-4.7-flash\",\"input\":{\"messages\":[{\"role\":\"user\",\"content\":\"What is Cloudflare?\"}]}}'\n```\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Google Cloud Model Armor | BB | 77.9 | 17 | guard.pii, guard.moderation | no | https://www.anchorterminal.com/tools/google-model-armor.md |\n| Amazon Bedrock Guardrails | BB | 74.8 | 63 | guard.pii, guard.moderation | no | https://www.anchorterminal.com/tools/amazon-bedrock-guardrails.md |\n| OpenAI Guardrails | B | 69.5 | 184 | guard.pii, guard.moderation | no | https://www.anchorterminal.com/tools/openai-guardrails.md |\n| OpenRouter | B | 68.5 | 211 | inference.llm, inference.router | no | https://www.anchorterminal.com/tools/openrouter.md |\n| NVIDIA NeMo Guardrails | B | 68.4 | 214 | guard.pii, guard.moderation | no | https://www.anchorterminal.com/tools/nemo-guardrails.md |\n| Vela 2.0 | B | 66.5 | 290 | guard.pii, guard.moderation | no | https://www.anchorterminal.com/tools/vela.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The model catalogue showed 241 models on 9 October 2026, third-party and Workers AI together, from 24 author paths including OpenAI, Google, Anthropic, xAI and Alibaba (source: \u003chttps://developers.cloudflare.com/ai/models/\u003e)\n- Since 21 May 2026 the recommended surface is the REST API on `api.cloudflare.com`. The Universal Endpoint and the `/compat/chat/completions` route on `gateway.ai.cloudflare.com` are marked deprecated for new integrations and keep working, with no end date given (source: \u003chttps://developers.cloudflare.com/ai-gateway/usage/rest-api/\u003e)\n- Machine Payments, in beta since 30 September 2026, takes x402 payment on `POST /ai/run` for `z-ai/glm-4.7-flash`, `google/gemma-4-26b-a4b-it`, `openai/gpt-oss-20b` and `alibaba/qwen3.8-27b`, with a Cloudflare API token, a United States account and a card on file (source: \u003chttps://developers.cloudflare.com/ai-gateway/features/machine-payments/\u003e)\n- A 5 per cent fee applies to Unified Billing credit purchases, and the pricing page says provider inference prices are passed through with no markup (source: \u003chttps://developers.cloudflare.com/ai-gateway/reference/pricing/\u003e)\n- The authentication page says AI Gateway Read, Run and Edit permissions cannot be restricted to a single gateway, and advises separate accounts or a Worker binding for isolation (source: \u003chttps://developers.cloudflare.com/ai-gateway/configuration/authentication/\u003e)\n- Customers whose first gateway dates from 24 September 2026 or later have logs on Workers Logs, kept 3 days on Workers Free and 7 days on Workers Paid. Earlier customers keep Legacy Logs, which persist until deleted (source: \u003chttps://developers.cloudflare.com/ai-gateway/observability/logging/legacy-logs/\u003e)\n- The service-specific terms of 28 September 2026 say the Cloudflare Data Processing Addendum and Information Security Exhibit do not apply to third-party products accessed via AI Gateway (source: \u003chttps://www.cloudflare.com/service-specific-terms-developer-platform/\u003e)\n- Each docs page opens with a block addressed to agents that says to fetch the `llms.txt` index before exploring further. It is recorded as a fact with no deduction\n\n- #8 of 17 in Best model APIs and inference for AI agents: https://www.anchorterminal.com/best/inference/index.md\n- All 136 models comparisons: https://www.anchorterminal.com/compare/inference/index.md\n\n## Compare\n\n- [Claude API vs Cloudflare AI Gateway](https://www.anchorterminal.com/compare/anthropic-api-vs-cloudflare-ai-gateway.md): BB 77.3 vs B 66.8\n- [BlockRun.AI vs Cloudflare AI Gateway](https://www.anchorterminal.com/compare/blockrun-ai-vs-cloudflare-ai-gateway.md): BB 72.4 vs B 66.8\n- [Cloudflare AI Gateway vs Cloudflare Workers AI](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-cloudflare-workers-ai.md): B 66.8 vs B 68.3\n- [Cloudflare AI Gateway vs Cohere Chat API (Command models)](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-cohere-chat.md): B 66.8 vs B 64.7\n- [Cloudflare AI Gateway vs DeepInfra](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-deepinfra.md): B 66.8 vs B 63\n- [Cloudflare AI Gateway vs DeepSeek API](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-deepseek-api.md): B 66.8 vs D 46.8\n- [Cloudflare AI Gateway vs Gemini Developer API](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-gemini-api.md): B 66.8 vs B 65.5\n- [Cloudflare AI Gateway vs GroqCloud](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-groq.md): B 66.8 vs BB 75.6\n- [Cloudflare AI Gateway vs Mistral AI API](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-mistral-api.md): B 66.8 vs BB 71.2\n- [Cloudflare AI Gateway vs Novita AI](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-novita-ai.md): B 66.8 vs D 53.5\n- [Cloudflare AI Gateway vs OpenAI API](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-openai-api.md): B 66.8 vs A 83.3\n- [Cloudflare AI Gateway vs OpenRouter](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-openrouter.md): B 66.8 vs B 68.5\n- [Cloudflare AI Gateway vs Prism Inference](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-prism-inference.md): B 66.8 vs C 60.1\n- [Cloudflare AI Gateway vs SambaCloud](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-sambanova.md): B 66.8 vs B 66.4\n- [Cloudflare AI Gateway vs SiliconFlow](https://www.anchorterminal.com/compare/cloudflare-ai-gateway-vs-siliconflow.md): B 66.8 vs D 46.7\n- [Antseed vs Cloudflare AI Gateway](https://www.anchorterminal.com/compare/antseed-vs-cloudflare-ai-gateway.md): C 55.1 vs B 66.8\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on cloudflare.com or one of its subdomains, or the README of github.com/cloudflare/ai. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"cloudflare-ai-gateway\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/cloudflare-ai-gateway\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/cloudflare-ai-gateway.svg\" alt=\"Cloudflare AI Gateway on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Cloudflare AI Gateway on Anchor Terminal](https://www.anchorterminal.com/badges/cloudflare-ai-gateway.svg)](https://www.anchorterminal.com/tools/cloudflare-ai-gateway)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/cloudflare-ai-gateway\"\u003eCloudflare AI Gateway on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Cloudflare AI Gateway is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/cloudflare-ai-gateway-dark.png\n- Light: https://www.anchorterminal.com/assets/share/cloudflare-ai-gateway-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-10", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Model APIs \u0026 inference", "url": "https://www.anchorterminal.com/categories/inference" }, { "name": "Cloudflare AI Gateway", "url": "" } ], "description": "AI Gateway is Cloudflare's proxy and router for model providers. Agents call OpenAI-style, Anthropic-style or native endpoints on the Cloudflare API, with logging, caching, rate and spend limits, retries, fallbacks and one prepaid credit balance.", "facts": [ "rank #275 of 950", "API key auth", "0 desk reviews" ], "h1": "Cloudflare AI Gateway", "image": "https://www.anchorterminal.com/assets/og/tools-cloudflare-ai-gateway.png", "path": "/tools/cloudflare-ai-gateway", "published": "2026-10-01", "section": "tools", "title": "Cloudflare AI Gateway review (2026): pricing, alternatives and grade B", "toc": null, "updated": "2026-10-10", "url": "https://www.anchorterminal.com/tools/cloudflare-ai-gateway" }, "tokens": { "markdown": 11200, "slim": 2480 }, "version": 1 }