Cloudflare AI Gateway: Enterprise IT Requirements & Gaps
Cloudflare AI Gateway: what it covers for model traffic
Barndoor
October 23, 2026
| 13 min read |
For many teams, Cloudflare AI Gateway might be their first AI gateway. It takes one base-URL change, the core features are free, and it’s in the Cloudflare dashboard. It handles model traffic well. An enterprise AI gateway has a harder job: it has to answer who (a person or an agent) did what (a model call or a tool action), under which policy, in one place. Here’s a sourced map of what Cloudflare covers, what sits in other Cloudflare products, and what IT must add. Cloudflare facts are from its docs as of 21 October 2026.
What is Cloudflare AI Gateway?
Cloudflare AI Gateway is a proxy on Cloudflare’s network between your applications and AI model providers. It adds caching, rate limiting, routing and fallbacks, spend analytics and limits, and request logging, behind an OpenAI-compatible endpoint. For the general category, see what is an AI gateway. To use it, you set your SDK’s baseURL (for example, the OpenAI SDK) to the gateway, or call it through the Workers AI binding. Provider keys come with each request, sit in the gateway (BYOK), or are replaced by Unified Billing credits. Cloudflare is also merging Workers AI and AI Gateway into one binding and API.
Cloudflare AI Gateway features: what it covers
The Cloudflare AI Gateway features list is broad and aimed at Cloudflare AI Gateway LLM traffic: requests from an application to a model. Several features are marked Beta.
Caching, rate limiting and routing
Caching serves identical requests from cache, cutting latency and cost, with configurable TTL. Rate limiting caps requests with sliding or fixed windows. Dynamic Routing (Beta) splits traffic by user, region or A/B test and falls back to another provider or model when one fails. Auto Router (Beta) sends each request to “the most cost-effective model that can handle the task,” in Cloudflare’s words.
Cost visibility and spend limits
Spend limits (Beta) set dollar budgets scoped by model, provider or a custom metadata key such as user ID, team or application. Over budget, requests get a 429. Cloudflare’s docs say spend limits are “eventually consistent,” so “a burst of concurrent requests can briefly exceed the limit before enforcement catches up.” Custom costs cover negotiated rates. See also how to keep LLM spend predictable.
Guardrails, DLP and keys on model traffic
DLP (Beta) scans prompts and responses and flags or blocks matches. Without a Zero Trust subscription you get two predefined profiles (financial information and national identifier numbers); the full set needs Zero Trust DLP. Guardrails (Beta) check content with Llama Guard 3 8B on Workers AI and are billed as inference. Authenticated Gateway requires a Cloudflare API token on each request. BYOK keeps provider keys out of application code. For DLP in a gateway generally, see LLM gateway with data loss prevention.
Logs and user insights
Request logs record prompt, response, provider, tokens, cost, duration and custom metadata. For observability, User Insights shows spend metrics per identity and flags anomalies. GraphQL analytics and Logpush export are available. Accounts whose first gateway dates from 24 September 2026 or later use Workers Logs; older accounts use Legacy Logs (10 million logs per gateway on Workers Paid). On cost: the core features (analytics, caching, rate limiting) are free on all plans. Unified Billing adds a 5% fee on credits, and log storage, Logpush and Guardrails are billed separately.
Cloudflare AI Gateway architecture: where it sits and where identity comes from
The Cloudflare AI Gateway architecture: an app or agent calls the gateway, which checks a Cloudflare API token, an Access JWT, or nothing on an open gateway. It applies caching, limits, DLP and routing, then forwards the request to the provider. By default, identity is whatever custom metadata the client sends. Cloudflare’s User Insights page says: “Without an identity or custom metadata on your requests, all usage is grouped under a single anonymous identifier.”
For a verified user, put the gateway behind Cloudflare Access (custom domain required); AI Gateway then adds the Access sub as cf.user_id. Tools take a separate path: MCP traffic goes through MCP server portals in Cloudflare One, and DLP on portal traffic comes from Gateway HTTP policies. Model calls and tool calls run through three products, each with its own policies and logs.
What enterprise IT still has to add
Each requirement: what IT needs, what Cloudflare documents, and the gap.
A verified user on every request, not a metadata tag
Without Access, a request is attributed to whatever the client puts in metadata, or to the anonymous bucket. Behind Access it comes from your identity provider, at the cost of Zero Trust and a custom domain per gateway. Your IdP stays the source of truth ( your identity provider still matters for AI governance). The gap: a verified user on every model and tool request, by default.
Agents as callers in their own right
In AI Gateway, agent_id is a metadata key that the client sets. Service-token requests don’t get cf.user_id, and on MCP portals a service-token session uses the admin credential upstream. IT needs a record per agent, with its own access, budget and keys, that a developer can’t change by editing a header. See agents are not users.
Governing tool calls
AI Gateway sees prompts and completions. Tool calls go over MCP, and Cloudflare handles those in MCP server portals. A portal puts remote MCP servers behind one endpoint with Access login, and admins choose the tools each portal exposes (new tools are on by default unless default_disabled is set). Portals take only remote HTTP servers, up to 80 each; stdio-only servers must be self-hosted behind HTTP. IT needs least privilege per user, agent, server, tool and action, in the same policy as model access. See MCP gateway.
A check before an agent writes
Reading a ticket and closing it are different risks. For servers authorized through a portal, Cloudflare’s docs say temporary authentication isn’t applied: “approvers will not receive approval requests.” We found no documented per-action approval in the AI Gateway or MCP portal docs (checked 21 October 2026). IT needs a policy check before each write, and a person in the loop for risky ones.
One audit trail across models and tools
One agent task can leave records in four places:
- AI Gateway request logs
- AI Gateway audit logs, which cover configuration changes only (gateway created, updated or deleted)
- Access logs for MCP portals, whose documented fields are time, status, server, capability (the tool) and duration
- Gateway HTTP logs
SIEM export goes through Logpush, which for portal logs is Enterprise-only. IT needs one trail that shows who did what and under which policy, streamed to the SIEM.
| Requirement | Cloudflare AI Gateway | Elsewhere in Cloudflare | What an enterprise AI gateway needs |
|---|---|---|---|
| Model routing, caching, fallback | Yes: caching, rate limits, Dynamic Routing and Auto Router (Beta) | n/a | Routing and fallback across approved models |
| Spend tracking and hard limits | Analytics, spend limits by model, provider or metadata (eventually consistent) | n/a | Budgets per verified user, team and agent |
| Verified user identity | Custom metadata, or cf.user_id behind Access |
Access (Zero Trust, custom domain) | IdP identity on every request by default |
| Agent record | Client-set metadata key | Access service tokens | A record per agent with its own access, budget and keys |
| MCP tool allowlisting | Not in AI Gateway | MCP server portals: per-portal tools, remote HTTP only, 80 servers | Least privilege per user, agent, server, tool and action |
| Per-action policy / approval on writes | We found none documented | Portals: no temporary-auth approvals | Policy before every action, approval for risky writes |
| DLP on prompts and responses | Yes; two profiles without Zero Trust | Gateway HTTP DLP for portal traffic | One DLP policy across model and tool traffic |
| Audit trail and SIEM export | Request logs; audit logs cover config only; Logpush | Portal logs (Logpush Enterprise-only), Gateway HTTP logs | One trail of who, what and which policy, streamed to SIEM |
| Pricing model | Core free; 5% Unified Billing fee; logs and Guardrails extra | Zero Trust subscription for Access and full DLP | Predictable cost for governance across teams |
When Cloudflare AI Gateway is enough, and signs you’ve outgrown it
Cloudflare AI Gateway is often enough: you already run Cloudflare and Workers, traffic is app-to-model, the goals are cost, caching and reliability, and you have few agents with no tool writes. There it’s a sensible, low-cost choice. You’ve outgrown it when:
- employees and agents both need governed access
- agents call MCP tools that write to systems of record
- security wants one policy and one audit trail
- spend has to be attributed to a person or agent, not a header
That’s when teams look for a Cloudflare AI Gateway alternative. Start with our checklist for evaluating an AI gateway.
How the Barndoor AI Gateway governs models, agents and tools
- Barndoor is the AI Gateway for enterprises. The Barndoor LLM Gateway and Barndoor MCP Governance apply one policy to model calls and tool calls.
- Access control is least privilege, from user, role, group and MCP server down to the individual tool, model, data point and action.
- People are scoped from your existing IdP roles. Each agent gets its own record (an AgentProfile). Policy is enforced at runtime on every request, so unauthorized actions are stopped before they execute.
- Barndoor can also hold an agent’s write for human approval.
- Barndoor data protection redacts, tokenizes or blocks sensitive data inline.
- Security teams get a complete audit trail of every AI and agent action and the policy that governed it, streamed to the SIEM.
- Each agent has one view of its MCP connections, policies, activity and tokens.
- The LLM Gateway shows spend per user, team and agent by model, sets hard limits and budgets, and routes each request to the most cost-efficient model. Teams use a governed catalog with 100+ pre-built MCP servers plus custom ones.
- Provider keys stay in the Barndoor vault; developers and agents get virtual keys.
Start with one team: put its agents’ model and MCP tool calls behind the Barndoor AI Gateway, so one policy and one audit trail cover both. Get started with Barndoor.
FAQs about Cloudflare AI Gateway
What is Cloudflare AI Gateway?
Cloudflare AI Gateway is a proxy on Cloudflare’s network between your applications and AI model providers. It adds caching, rate limiting, routing and fallbacks, spend analytics and limits, DLP and logging. You connect by changing your SDK’s base URL to the gateway, which works with OpenAI-compatible clients, or by using the Workers AI binding.
Is Cloudflare AI Gateway free?
The core features (analytics, caching, rate limiting) are free on all plans. DLP is free with two predefined profiles; the full set needs Zero Trust DLP. Unified Billing adds a 5% fee on credits, and logs, Logpush and Guardrails are billed separately, per Cloudflare’s pricing page.
How does Cloudflare AI Gateway work?
Your app sends model requests to a gateway URL instead of the provider. The gateway authenticates the request if configured, checks the cache, applies rate and spend limits, DLP and guardrails, and routes to a provider with fallback. Each request is logged with tokens, cost and custom metadata.
Does Cloudflare AI Gateway support MCP?
Not inside AI Gateway. Cloudflare handles MCP in MCP server portals, part of Cloudflare One: remote HTTP servers only, up to 80 per portal, with Access login, a tool list per portal, and logs separate from AI Gateway.
Can Cloudflare AI Gateway track spend per user or per agent?
Yes, if each request says who it’s from. Spend limits and User Insights use custom metadata, such as a user or agent ID set by the client. Behind Cloudflare Access, a verified cf.user_id is added. Without either, usage falls under one anonymous identifier.
Is Cloudflare AI Gateway the same as Cloudflare API Gateway?
No. Cloudflare API Gateway is part of API Shield, which protects your own APIs with discovery, schema validation, JWT validation and mTLS. AI Gateway proxies your outbound calls to AI model providers.
What is the best Cloudflare AI Gateway alternative for enterprises?
It depends on the gap. For one policy across people, agents, models and MCP tools, look for a verified identity on every request, a record for each agent, least privilege down to the action, a check before writes, and one audit trail streamed to your SIEM. Our AI gateway evaluation checklist walks through the criteria.
What is an AI gateway?
An AI gateway sits between users, apps or agents and the models and tools they call, and applies access, cost, security and logging policy to that traffic. See what is an AI gateway.