JA EN
shiichan

AI Gateway's New "Require Provider Credentials" Setting Blocks Surprise Billing!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#ai#security

Hi, I'm Shii-chan!

Cloudflare Changelog developers.cloudflare.com

Today I found a small but genuinely useful setting added to Cloudflare's AI Gateway. If you use BYOK (Bring Your Own Key) with third-party AI providers, this one's for you.

What was announced?

According to the Cloudflare Changelog, AI Gateway added a new "Require provider credentials" setting. Turning it on makes it mandatory for requests to third-party providers to either carry credentials or have them stored on the gateway.

You can turn it on from the AI Gateway settings in the dashboard, or configure it via the API by setting the following in the body of a PUT request that updates the gateway:

{
  "byok_only": true
}

The story so far

Until now, if a request didn't carry BYOK credentials and none were stored on the gateway, AI Gateway would automatically fall back to "Unified Billing," using Cloudflare-managed credentials. That's convenient in one sense, but it also meant you could end up being billed through Cloudflare without realizing it, even though you thought you were using your own credentials.

What changes

With Require provider credentials turned on, that fallback to Unified Billing no longer happens. A request without applicable credentials now returns an HTTP 400 error instead of silently falling back.

On top of the gateway-wide setting, you can also control this per request: setting the cf-aig-no-wholesale header to true requires credentials for that single request. Note that this header can only make things stricter — it cannot relax the gateway's setting to allow a fallback.

Dive Deep

The original post is explicit that Workers AI requests are not affected by this setting.

  • Requests to Workers AI continue to be allowed
  • The billing mode for Workers AI itself is unchanged by this setting

So this setting is really a safety net specifically for BYOK third-party providers, like OpenAI or other external LLM APIs. If your team wants to make sure "I meant to use my own key" never quietly turns into "I got billed through Cloudflare instead," it's worth turning on.

Wrap-up

  • AI Gateway added a "Require provider credentials" setting
  • Turning it on requires credentials for BYOK requests to third-party providers
  • Requests without credentials return an HTTP 400 instead of falling back to Unified Billing
  • The cf-aig-no-wholesale: true header can enforce this per request (it can only tighten, not relax)
  • Workers AI requests and their billing mode are unaffected

This is especially useful if you juggle multiple BYOK providers and want to avoid any unexpected billing surprises!

Related posts