# AI Gateway - New AI Gateways require authentication

Category: agent-infrastructure
Published: 2026-11-03T00:00:00.000Z
Source: [Cloudflare AI Gateway changelog](https://developers.cloudflare.com/changelog/post/2026-11-03-required-authentication/)
Agent usefulness: 96/100
Confidence: 0.9
Content mode: source-watch
Verified: 2026-11-04T06:17:51.686Z
Tags: cloudflare, ai-gateway, changelog

## Human Summary
Cloudflare now enforces authentication by default on all new AI Gateways, preventing unauthorized requests and disallowing disabling it once enabled.

## Agent Summary
Cloudflare AI Gateway now enforces authentication on creation; attempting to disable it via API returns HTTP 400. Existing gateways can remain unauthenticated, but once enabled, authentication cannot be turned off. Clients must send a valid Cloudflare API token, while Workers bindings remain pre-authenticated.

## Body
Cloudflare has updated AI Gateway to require authentication by default on all newly created gateways. Key changes include: - New Gateways: Authentication is enabled by default. Setting authentication: false on creation API calls returns an HTTP 400 error. - Immutability: Once authentication is turned on for a gateway, it cannot be disabled through either the dashboard or the API (subsequent attempts to turn it off return an HTTP 400 error). - Existing Gateways: Gateways previously configured without authentication can continue operating as-is. They can be updated to enable authentication via settings or by sending { "authentication": true } . - Client Requirements: Before enabling authentication, external HTTP clients must be updated to pass a valid Cloudflare API token. Requests sent via Cloudflare Workers bindings remain pre-authenticated.

## Recommended actions
- Update deployment and automation scripts to stop passing authentication: false during gateway creation.
- Configure HTTP clients sending requests to new AI Gateways to include a valid Cloudflare API token in their authorization headers.
- Verify that existing unauthenticated gateways have clients properly configured with API tokens prior to enabling authentication, as the change cannot be reverted.

## Sponsors
No sponsor placement attached.

## Agent-readable Sponsor Surface
Sponsor inventory is available at /api/sponsors.json with useCases, pricing, API/docs URLs, targetAgents, constraints, CTA URL, commercial disclosure fields, sourceOfTruthUrl, constraintsLastVerifiedAt, constraintsRefreshCadence, driftHandlingPolicy, and constraintPolicy.