Products · Developer platform
AI Gateway
Observe and control your AI applications
Pricing and limits
Pricing
As of Nov 3, 2026, from Cloudflare's docs, last updated there Nov 2, 2026. Licensed CC BY 4.0; navigation removed.
AI Gateway is available to use on all plans.
AI Gateway's core features available today are offered for free, and all it takes is a Cloudflare account and one line of code to get started. Core features include: dashboard analytics, caching, and rate limiting.
You can monitor your usage in the AI Gateway dashboard.
Logs
AI Gateway stores logs in either Workers Logs or Legacy Logs, depending on when your account created its first gateway.
Workers Logs
Accounts that created their first gateway on or after September 24, 2026 store logs in Workers Logs and follow Workers Logs pricing and retention.
Legacy Logs
Accounts that created a gateway before September 24, 2026 use Legacy Logs. Persistent log storage is available on all plans with these limits:
| Plan | Log storage limit |
|---|---|
| Workers Free | 100,000 logs total across all gateways |
| Workers Paid | 10,000,000 logs per gateway |
For storage behavior and deletion options, refer to Legacy Logs.
Data Loss Prevention (DLP)
DLP scanning in AI Gateway is free on all plans. Accounts without a Zero Trust subscription have access to two predefined DLP profiles: Financial Information and Social / Insurance / National Identifier Numbers.
DLP profiles are shared at the account level with Cloudflare One. If your account has a Zero Trust subscription that includes DLP, the full set of profiles — including all predefined profiles, custom profiles, integration profiles, DLP datasets, and OCR — is automatically available in AI Gateway.
Guardrails
Guardrails evaluates prompts and responses using @cf/meta/llama-guard-3-8b on Workers AI. Usage is billed as Workers AI token-based inference — cost scales with the length of the prompts and responses being evaluated.
Unified Billing
A 5% fee is applied to all credits purchased through Unified Billing. For example, a $100 credit purchase will result in a $105 charge. Inference pricing from providers is passed through with no markup — you pay the same per-token rates as you would directly with the provider.
Credits can only be purchased with a credit card. Other payment methods, such as PayPal, are not supported.
Logpush
Logpush is available to all AI Gateway customers. Exports of AI Gateway logs are billed according to Logpush pricing, based on the volume of logs exported and transformed.
Pricing notes
Prices subject to change. If you are an Enterprise customer, reach out to your account team to confirm pricing details.
Limits
As of Nov 3, 2026, from Cloudflare's docs, last updated there Oct 30, 2026. Licensed CC BY 4.0; navigation removed.
The following limits apply to gateway configurations, logs, and related features in Cloudflare's platform.
Gateway limits
| Feature | Limit |
|---|---|
| Cacheable request size | 25 MB per request |
| Cache TTL | 1 month |
| Custom metadata | 5 entries per request |
| Gateways free plan | 10 per account |
| Gateways paid plan | 20 per account |
| Gateway name length | 64 characters |
| Unified Billing request rate | 200 requests per 60 seconds per gateway 1 |
1 This rate limit applies to requests that use Cloudflare-managed credentials through Unified Billing. When the limit is exceeded, AI Gateway returns a 429 error. This limit does not apply to requests that use your own provider keys through bring your own keys (BYOK).
Log limits
New AI Gateway customers
Customers who create their first gateway on or after September 24, 2026 follow Workers Logs limits and Workers Logs pricing.
Existing AI Gateway customers
Customers who created a gateway before September 24, 2026 use Legacy Logs. The following limits apply:
| Feature | Limit |
|---|---|
| Log storage rate | 500 logs per second per gateway |
| Logs stored, paid plan | 10 million per gateway |
| Logs stored, free plan | 100,000 per account |
| Stored log size | 10 MB per log |
The free plan limit applies across all gateways. For behavior at these limits, refer to Legacy Logs storage.
Logpush limits
These limits apply to all AI Gateway customers:
| Feature | Limit |
|---|---|
| Logpush jobs | 4 per account |
| Logpush log size | 1 MB per log |
DLP limits
DLP for AI Gateway uses shared Cloudflare One DLP profiles. The following limits apply to DLP profiles and detection entries at the account level:
| Feature | Limit |
|---|---|
| Custom entries | 25 |
| Exact Data Match cells per spreadsheet | 100,000 |
| Custom Wordlist keywords per spreadsheet | 200 |
| Custom Wordlist keywords per account | 1,000 |
| Dataset cells per account | 1,000,000 |
DLP profiles are shared with Cloudflare One and are not coupled to individual gateways. You can apply the same DLP profiles across multiple gateways without additional profile limits. There is no separate limit on the number of DLP policies per gateway.
Need a higher limit?
To request an increase to a limit, complete the Limit Increase Request Form ↗︎. If the limit can be increased, Cloudflare will contact you with next steps.
Timeline
October 2026
- createAI replaces workers-ai-provider and ai-gateway-provider
The Agents SDK has a new createAI function for the AI SDK and Pi AI. It unifies what workers-ai-provider and ai-gateway-provider did: Workers AI models, AI Gateway catalog models, dynamic routes, and vendor models, through the AI binding or an account id and API token. workers-ai-provider and ai-gateway-provider are now feature frozen and marked as deprecated. Please migrate at your convenience.…
- AI Gateway log IDs and request IDs now use UUIDv7
New AI Gateway log IDs and request IDs are lowercase UUIDv7, such as 019a7b3e-5f2c-7c41-9d3e-2b8f6a1c4e07. Previously, log IDs were 26-character ULIDs and request IDs were random UUIDs. For a request that AI Gateway answers in a single step, the cf-aig-request-id, cf-aig-log-id, and cf-aig-event-id response headers now carry the same value. For provider and Universal requests, if you set your own…
- Standardize provider credential error responses in AI Gateway
AI Gateway's REST API now returns consistent responses when an AI provider rejects credentials. The change applies to POST /ai/run ↗︎. Scenario Previous AI Gateway response New AI Gateway response ElevenLabs Provider-specific UserCredentialsError with HTTP 403 HTTP 401 with error code 2009 Google Vertex HTTP 500 for rejected credentials, with upstream retries HTTP 401 with error code 2009; the re…
- Introducing Web Search API
Web Search API is now available in beta. Web Search API lets your AI agents and applications search the Internet and ground their responses in live information, instead of guessing URLs or relying on a model's training cutoff. At launch, you can choose between three search providers: Ceramic.ai, Exa, and Linkup. All three support Zero Data Retention for requests made through Cloudflare, and all h…
September 2026
- Pay for AI inference with Machine Payments
AI Gateway now supports Machine Payments in beta. With Machine Payments, clients can use the x402 protocol to pay for eligible inference requests directly from a stablecoin wallet instead of maintaining a prepaid credit balance. Machine Payments is available for the /ai/run endpoint with select open models. To request x402 payment, authenticate with a Cloudflare API token and include the Cloudfla…
- Identify model overuse and potential savings with User Insights
AI Gateway User Insights now gives you more context about the traffic flowing through your gateway. It shows what users and agents are doing with AI, and where a selected model may be more capable than a task requires. On the analysis side, User Insights groups conversations by task, tracks conversation turns, and helps you compare model fit with cost and latency. The Potential Savings view highl…
- Prevent Unified Billing fallback for BYOK third-party providers
AI Gateway can now require credentials for third-party provider requests. Credentials must accompany the request or be stored on the gateway. This setting prevents fallback to Unified Billing with Cloudflare-managed credentials. Turn on Require provider credentials in your gateway settings. To use the API, set byok_only to true in the request body of a PUT request to update the gateway: { "byok_o…
- AI Gateway custom costs support cache tokens
AI Gateway custom costs now support cache-read and cache-write token rates. This lets custom cost metrics reflect negotiated cache pricing across providers. Add per_cache_read_token or per_cache_write_token to the cf-aig-custom-cost header: { "per_token_in": 0.000001, "per_token_out": 0.000002, "per_cache_read_token": 0.0000001, "per_cache_write_token": 0.0000005 } Cache-token pricing activates w…
- AI Gateway consolidates monthly usage invoice line items and standardizes model names
AI Gateway monthly usage invoices, issued at the beginning of each month for the previous month's usage, now show a single total cost for each model. These invoices no longer break out input and output token quantities and unit prices into separate line items. This change does not apply to invoices for AI Gateway credit purchases. For example, an invoice that previously included these separate li…
August 2026
- Get 50% off GPT-5.6 Sol through AI Gateway
GPT-5.6 Sol is available through AI Gateway, and for a limited time you can use it at 50% off. If you are already using AI Gateway, point to the openai/gpt-5.6-sol model and the discounted pricing applies automatically — no promo code needed. The promotion is available for Unified Billing users only (not Bring Your Own Keys). Load credits onto AI Gateway and start sending requests to openai/gpt-5…
- Workers AI and AI Gateway unify model access and billing
Workers AI and AI Gateway now provide a unified path for accessing models and managing inference traffic. Use the same AI binding and REST API to call models hosted on Workers AI or by supported third-party providers, with AI Gateway providing observability, logging, caching, security, and billing controls. Unified entrypoints and observability The AI binding supports both Workers AI and third-pa…
- Track AI spend and catch anomalous usage with User Insights
AI Gateway now includes User Insights, a dashboard that gives you two things at once: clear visibility into how much your organization spends on AI, and a security signal that surfaces users whose usage suddenly looks abnormal. It works on the traffic already flowing through your gateway, so there is no additional setup. On the spend side, User Insights shows organization-wide totals for cost, re…
- Identity-aware controls are now available in AI Gateway
AI Gateway now integrates with Cloudflare Access, giving you two new capabilities: Protect your gateway endpoint. Put your AI Gateway behind Access so you can set policies that control who is allowed to call a specific gateway's endpoint. Identity-aware controls. When traffic reaches AI Gateway through an Access-protected custom domain, AI Gateway can use the authenticated user's Access identity…
June 2026
- View the user agent of requests in AI Gateway logs
AI Gateway logs now capture the user agent of the client that made each request, making it easier to identify which SDK, library, or application sent the traffic flowing through your gateway. For example, you can tell apart requests coming from openai-python versus a custom application or a Cloudflare Worker. The user agent appears alongside the other details in each log entry, and you can filter…
- Control AI costs with spend limits
AI Gateway now supports spend limits — cost-based budgets that track cumulative dollar spend and block requests when the budget is exceeded. Unlike rate limiting, which caps the number of requests, spend limits track actual cost based on token usage and model pricing. You can scope limits by model, provider, or custom metadata dimensions. For example, give each user a $200/day budget, cap total g…
May 2026
- Call any AI model through AI Gateway's new REST API
AI Gateway now uses the AI REST API on api.cloudflare.com. You can call any model — whether from OpenAI, Anthropic, Google, or hosted on Workers AI — through one unified API, using the same endpoints and authentication regardless of provider. Four endpoints are available: POST /ai/run — universal endpoint for all models and modalities POST /ai/v1/chat/completions — OpenAI SDK compatible POST /ai/…
April 2026
- Automatically retry on upstream provider failures on AI Gateway
AI Gateway now supports automatic retries at the gateway level. When an upstream provider returns an error, your gateway retries the request based on the retry policy you configure, without requiring any client-side changes. You can configure the retry count (up to 5 attempts), the delay between retries (from 100ms to 5 seconds), and the backoff strategy (Constant, Linear, or Exponential). These…
March 2026
- Log AI Gateway request metadata without storing payloads
AI Gateway now supports the cf-aig-collect-log-payload header, which controls whether request and response bodies are stored in logs. By default, this header is set to true and payloads are stored alongside metadata. Set this header to false to skip payload storage while still logging metadata such as token counts, model, provider, status code, cost, and duration. This is useful when you need usa…
- Get started with AI Gateway automatically
You can now start using AI Gateway with a single API call — no setup required. Use default as your gateway ID, and AI Gateway creates one for you automatically on the first request. To try it out, create an API token with AI Gateway - Read, AI Gateway - Edit, and Workers AI - Read permissions, then run: curl -X POST https://gateway.ai.cloudflare.com/v1/$CLOUDFLARE_ACCOUNT_ID/default/compat/chat/c…
February 2026
- AI dashboard experience improvements
Workers AI and AI Gateway have received a series of dashboard improvements to help you get started faster and manage your AI workloads more easily. Navigation and discoverability AI now has its own top-level section in the Cloudflare dashboard sidebar, so you can find AI features without digging through menus. The new top-level AI section in the dashboard sidebar. Onboarding and getting started G…
August 2025
- Manage and deploy your AI provider keys through Bring Your Own Key (BYOK) with AI Gateway, now powered by Cloudflare Secrets Store
Cloudflare Secrets Store is now integrated with AI Gateway, allowing you to store, manage, and deploy your AI provider keys in a secure and seamless configuration through Bring Your Own Key ↗︎. Instead of passing your AI provider keys directly in every request header, you can centrally manage each key with Secrets Store and deploy in your gateway configuration using only a reference, rather than…
June 2025
- AI Gateway adds OpenAI compatible endpoint
Users can now use an OpenAI Compatible endpoint in AI Gateway to easily switch between providers, while keeping the exact same request and response formats. We're launching now with the chat completions endpoint, with the embeddings endpoint coming up next. To get started, use the OpenAI compatible chat completions endpoint URL with your own account id and gateway id and switch between providers…
March 2025
- AI Gateway launches Realtime WebSockets API
We are excited to announce that AI Gateway now supports real-time AI interactions with the new Realtime WebSockets API. This new capability allows developers to establish persistent, low-latency connections between their applications and AI models, enabling natural, real-time conversational AI experiences, including speech-to-speech interactions. The Realtime WebSockets API works with the OpenAI…
February 2025
- Introducing Guardrails in AI Gateway
AI Gateway now includes Guardrails, to help you monitor your AI apps for harmful or inappropriate content and deploy safely. Within the AI Gateway settings, you can configure: Guardrails: Enable or disable content moderation as needed. Evaluation scope: Select whether to moderate user prompts, model responses, or both. Hazard categories: Specify which categories to monitor and determine whether d…
- Request timeouts and retries with AI Gateway
AI Gateway adds additional ways to handle requests - Request Timeouts and Request Retries, making it easier to keep your applications responsive and reliable. Timeouts and retries can be used on both the Universal Endpoint or directly to a supported provider. Request timeouts A request timeout allows you to trigger fallbacks or a retry if a provider takes too long to respond. To set a request tim…
- AI Gateway adds Cerebras, ElevenLabs, and Cartesia as new providers
AI Gateway has added three new providers: Cartesia, Cerebras, and ElevenLabs, giving you more even more options for providers you can use through AI Gateway. Here's a brief overview of each: Cartesia provides text-to-speech models that produce natural-sounding speech with low latency. Cerebras delivers low-latency AI inference to Meta's Llama 3.1 8B and Llama 3.3 70B models. ElevenLabs offers tex…
January 2025
- AI Gateway Introduces New Worker Binding Methods
We have released new Workers bindings API methods, allowing you to connect Workers applications to AI Gateway directly. These methods simplify how Workers calls AI services behind your AI Gateway configurations, removing the need to use the REST API and manually authenticate. To add an AI binding to your Worker, include the following in your Wrangler configuration file: With the new AI Gateway bi…
- AI Gateway adds DeepSeek as a Provider
AI Gateway now supports DeepSeek, including their cutting-edge DeepSeek-V3 model. With this addition, you have even more flexibility to manage and optimize your AI workloads using AI Gateway. Whether you're leveraging DeepSeek or other providers, like OpenAI, Anthropic, or Workers AI, AI Gateway empowers you to: Monitor: Gain actionable insights with analytics and logs. Control: Implement caching…