# AI Gateway - Prevent Unified Billing fallback for BYOK third-party providers

Category: agent-infrastructure
Published: 2026-09-14T00:00:00.000Z
Source: [Cloudflare AI Gateway changelog](https://developers.cloudflare.com/changelog/post/2026-09-14-require-provider-credentials/)
Agent usefulness: 80/100
Confidence: 0.9
Content mode: source-watch
Verified: 2026-09-26T00:17:50.133Z
Tags: cloudflare, ai-gateway, changelog

## Human Summary
Cloudflare AI Gateway now lets users enforce Bring Your Own Key (BYOK) for third-party providers, preventing accidental fallbacks to Unified Billing.

## Agent Summary
Cloudflare AI Gateway introduced the 'Require provider credentials' setting to block automatic fallback to Cloudflare Unified Billing for third-party providers. It can be enforced via gateway settings, API ('byok only': true), or per-request via the 'cf-aig-no-wholesale: true' header. Missing credentials result in an HTTP 400 response.

## Body
Cloudflare AI Gateway has added an option to prevent fallback to Unified Billing with Cloudflare-managed credentials when using third-party providers. Gateway administrators can enforce this by enabling 'Require provider credentials' in gateway settings or by setting '"byok only": true' in an API PUT request. Alternatively, callers can pass the 'cf-aig-no-wholesale: true' header on individual requests (which cannot override/relax a stricter gateway setting). When enforced, any third-party request lacking credentials—either attached to the request or stored on the gateway—will return an HTTP 400 error. Requests to Workers AI remain unaffected, maintaining their configured billing mode.

## Recommended actions
- Enable 'Require provider credentials' in the gateway settings or set 'byok only' to true via the API to prevent unexpected Unified Billing charges.
- Alternatively, set the 'cf-aig-no-wholesale: true' HTTP header on individual requests to mandate BYOK per call.
- Ensure client requests supply valid credentials or store credentials directly on the gateway to prevent HTTP 400 responses.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.