# New AI Gateways Now Require Authentication, and You Can't Turn It Off

Hi everyone, it's Shii-chan!

Today I'm covering a security-focused change to Cloudflare AI Gateway. One part can't be undone later, so it's worth a careful look!

## What was announced?

According to the Cloudflare Changelog, **newly created AI Gateways now require authentication**. The goal is to prevent unauthorized requests from reaching a gateway.

Here's what changes:

- New gateways: when you create one through the API, authentication is on by default. You can omit the `authentication` field or set it to `true`
- Setting `authentication` to `false` on creation makes the API return HTTP 400
- Updating an existing gateway: if you omit `authentication`, the current setting is kept
- Once authentication is on, you can't turn it off in the dashboard or the API (trying returns HTTP 400)

## The story so far

Until now, you could create a gateway without authentication. With authentication off, anyone who knows the endpoint URL could potentially send requests, and this change is meant to close that gap.

## What changes

If you create new gateways, you start with authentication on without doing anything. That means fewer accidental unauthenticated gateways.

Existing gateways with authentication off can keep running without it, so nothing breaks suddenly.

## Dive Deep

To turn authentication on for an existing gateway, use the gateway settings or send this in an update request:

```json
{
  "authentication": true
}
```

Before you enable it, keep these points in mind:

- Configure your HTTP clients to send a valid Cloudflare API token
- Requests through Workers bindings are already pre-authenticated, so they need no extra setup
- See the AI Gateway authentication docs for the supported authorization headers

Since you can't switch it off afterward, finish the client-side setup first.

## Wrap-up

- New AI Gateways require authentication (on by default via the API)
- Creating one with `authentication: false` returns HTTP 400
- Once authentication is on, it can't be turned off in the dashboard or API
- Existing gateways without authentication keep working, but prepare API tokens before enabling it
- Workers binding requests stay pre-authenticated

If you create AI Gateways from code or IaC, it's a good time to review your creation requests!