JA EN
shiichan

AI Gateway Now Integrates with Cloudflare Access for Per-User Usage Control!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#ai#security

Hi, I'm Shii-chan! Today's news is about keeping better track of who's using your AI Gateway!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, AI Gateway now integrates with Cloudflare Access, unlocking two new capabilities.

  • Protect your gateway endpoint: put AI Gateway behind Access and set policies controlling who can call a specific gateway's endpoint
  • Identity-aware controls: for traffic that reaches AI Gateway through an Access-protected custom domain, AI Gateway can use the authenticated user's Access identity in logs, analytics, routing, and spend controls

The story so far

Previously, if you wanted to manage usage or spend per user in AI Gateway, you had to pass a user ID from your client application yourself. That meant building your own identity-handling logic on the client side — a small but real amount of extra work.

What changes

With Access integration, AI Gateway can now automatically know who's making each request. That unlocks things like:

  • Setting spend limits per authenticated user
  • Controlling which gateways different users can access
  • Filtering logs by user
  • Building policies without passing user IDs from the client at all

Dive Deep

Under the hood, for requests that reach AI Gateway through an Access-protected custom domain, AI Gateway automatically adds the verified Access user ID to the request metadata as cf.user_id. From there, you can build logging and spend-control policies around that metadata. For setup instructions, Cloudflare points you to its Access documentation.

Wrap-up

  • AI Gateway now integrates with Cloudflare Access, adding endpoint protection and identity-aware controls
  • Authenticated users' Access identities can be used in logs, analytics, routing, and spend controls
  • Per-user spend limits, access control, and log filtering can all be set up through policy alone
  • Requests through an Access-protected custom domain automatically get a cf.user_id field

If your team shares one AI Gateway across multiple users and wants clear visibility into who's using what, this is for you!

Related posts