AI Gateway - New AI Gateways require authentication
Cloudflare now enforces authentication by default on all new AI Gateways, preventing unauthorized requests and disallowing disabling it once enabled.
Why this signal matters
Cloudflare has updated AI Gateway to require authentication by default on all newly created gateways. Key changes include: - New Gateways: Authentication is enabled by default. Setting authentication: false on creation API calls returns an HTTP 400 error. - Immutability: Once authentication is turned on for a gateway, it cannot be disabled through either the dashboard or the API (subsequent attempts to turn it off return an HTTP 400 error). - Existing Gateways: Gateways previously configured without authentication can continue operating as-is. They can be updated to enable authentication via settings or by sending { "authentication": true } . - Client Requirements: Before enabling authentication, external HTTP clients must be updated to pass a valid Cloudflare API token. Requests sent via Cloudflare Workers bindings remain pre-authenticated.
Actionable summary
Cloudflare AI Gateway now enforces authentication on creation; attempting to disable it via API returns HTTP 400. Existing gateways can remain unauthenticated, but once enabled, authentication cannot be turned off. Clients must send a valid Cloudflare API token, while Workers bindings remain pre-authenticated.
- Agent usefulness
- 96/100
- Confidence
- 90%
- Canonical data
- JSON + Markdown
What builders should check
- Update deployment and automation scripts to stop passing authentication: false during gateway creation.
- Configure HTTP clients sending requests to new AI Gateways to include a valid Cloudflare API token in their authorization headers.
- Verify that existing unauthenticated gateways have clients properly configured with API tokens prior to enabling authentication, as the change cannot be reverted.