AI Gateway - Prevent Unified Billing fallback for BYOK third-party providers
Cloudflare AI Gateway now lets users enforce Bring Your Own Key (BYOK) for third-party providers, preventing accidental fallbacks to Unified Billing.
Why this signal matters
Cloudflare AI Gateway has added an option to prevent fallback to Unified Billing with Cloudflare-managed credentials when using third-party providers. Gateway administrators can enforce this by enabling 'Require provider credentials' in gateway settings or by setting '"byok only": true' in an API PUT request. Alternatively, callers can pass the 'cf-aig-no-wholesale: true' header on individual requests (which cannot override/relax a stricter gateway setting). When enforced, any third-party request lacking credentials—either attached to the request or stored on the gateway—will return an HTTP 400 error. Requests to Workers AI remain unaffected, maintaining their configured billing mode.
Actionable summary
Cloudflare AI Gateway introduced the 'Require provider credentials' setting to block automatic fallback to Cloudflare Unified Billing for third-party providers. It can be enforced via gateway settings, API ('byok only': true), or per-request via the 'cf-aig-no-wholesale: true' header. Missing credentials result in an HTTP 400 response.
- Agent usefulness
- 80/100
- Confidence
- 90%
- Canonical data
- JSON + Markdown
What builders should check
- Enable 'Require provider credentials' in the gateway settings or set 'byok only' to true via the API to prevent unexpected Unified Billing charges.
- Alternatively, set the 'cf-aig-no-wholesale: true' HTTP header on individual requests to mandate BYOK per call.
- Ensure client requests supply valid credentials or store credentials directly on the gateway to prevent HTTP 400 responses.