No more scary AI bills: Cloudflare AI Gateway adds spend limits!

Hey everyone, it's Shiichan! Today's news goes straight to your wallet: those runaway AI bills that show up out of nowhere. Cloudflare just gave us a clean way to rein them in, and I'm excited to walk you through it.

Cloudflare Blog blog.cloudflare.com

What was announced?

Over on the Cloudflare Blog, AI Gateway just got spend limits. On top of that, Cloudflare announced a closed beta for identity-driven budgets that plug into Cloudflare Access and your existing identity provider.

The best part: spend limits are in open beta today for every AI Gateway user, on every plan.

The story so far

AI Gateway sits between your apps and providers like OpenAI, Anthropic, and Google. Route through it instead of calling providers directly, and you get unified billing, logging, response caching, rate limiting, and content guardrails all in one place.

But it couldn't answer the big questions: who is spending what, and how do you cap it? You could see account-wide totals, but not the breakdown. As the post puts it:

You couldn't see that Jane from engineering burned through $2,000 on Claude this month while the entire data science team only used $400.

Without a budget or routing rules, people naturally reach for the biggest model, even when a code review summary really doesn't need one.

What changes

Spend limits let you set budgets in dollars, not tokens. AI Gateway tracks cumulative spend across every request in real time, and it runs independently of rate limiting.

You can scope a limit by any mix of dimensions: model, provider, or admin-defined custom attributes like user, team, or application. Windows can be fixed (reset on the 1st, on Monday, or at midnight) or rolling, on a daily, weekly, or monthly cadence. On the analytics dashboard you can filter spend by model, provider, or any custom attribute.

What happens when a budget runs out? By default, AI Gateway blocks further requests. Or you can use Dynamic Routes to fall back to a cheaper model once the cap is hit, so a hard limit won't freeze your team's workflow. Alerts on limits are on the way.

Dive Deep

Here's the fun part: Cloudflare runs on this internally. Every employee uses AI daily, pushing millions of requests and billions of tokens a month through AI Gateway. When someone authenticates via Cloudflare Access, AI Gateway pulls their identity from the JWT and attaches it as metadata on the request.

That's the closed-beta identity-driven budgets. Paired with Access, AI Gateway can see not just which account, but which employee, which IdP group, and which service made each call.

• Per-user budgets: say $500/month for individual contributors and $2,000 for senior engineers. Hit the cap, and requests get downgraded to a cheaper model or blocked.
• Per-team model policies: your ML team gets Claude Opus, the design team gets image and video models, interns use open-source models on Workers AI. These map straight to the IdP groups you already manage.
• CI/CD and agents: Access service tokens give each agent a named identity. You can see a code review bot burn 5 million tokens in a week while a docs generator used 500,000, and put a budget on just the runaway one.

Under the hood, you create a Cloudflare Access application for your AI Gateway endpoint and set policies from your IdP groups. Developers and agents authenticate via OAuth using the usual CLI device-code flow, then AI Gateway validates the token and extracts the identity. No custom Worker, no JWT parsing, no honor-system metadata headers.

Looking ahead, Cloudflare is building task-based routing that analyzes each request and sends it to the model that gives the best result for the lowest cost. It's in active development.

Wrap-up

• AI Gateway now has spend limits: dollar budgets tracked in real time, in open beta today across all plans.
• Scope by model, provider, or custom attributes; fixed or rolling windows on daily, weekly, or monthly cycles.
• When the cap hits, block by default or fall back to a cheaper model via Dynamic Routes.
• Identity-driven budgets with Cloudflare Access are in closed beta, so you can attribute spend down to the person, team, or agent.
• Set it all up in the dashboard or API, and start with a high limit in monitoring mode to learn your usage first.

If you're a CIO or CFO sweating the AI line item, or on an IT, FinOps, or platform team wrangling AI usage, this one is for you. Your next invoice just got a lot less scary!