Cloudflare AI Gateway
Free on every Cloudflare plan, one line of code, and the spend controls actually work. It is also the thinnest gateway in this category: no MCP, no prompt management, exact-match caching only, Evaluations deprecated in July 2026, and no self-hosting at all. Take it if you are already on Cloudflare. It is not a reason to move to Cloudflare.
PRICING
| Core features (all plans) | $0 | Dashboard analytics with a GraphQL API, exact-match caching with TTL from 60 seconds to one month, rate limiting (fixed or sliding window), request retry up to 5 attempts with constant, linear or exponential backoff, model fallback and Dynamic Routing, BYOK encrypted key storage across 20+ providers, token-based gateway authentication, Cloudflare Access integration, spend limits, custom costs, custom metadata, User Insights anomaly detection, and free DLP scanning with two predefined profiles |
| Workers Free | $0 | 100,000 logs total across all gateways on the account. New logs stop saving once the cap is reached. At 1,000 requests a day that ceiling arrives in under four months, which makes this an evaluation tier rather than a production one |
| Workers Paid | $5/mo + usage | 10 million logs per gateway rather than 100,000 per account, plus Logpush at 10 million records/month then $0.05/million. This is the plan any real production deployment lands on, and it is a Workers plan rather than an AI Gateway plan |
| Unified Billing | 5% on credits purchased | Prepaid credits pay for third-party provider inference and Workers AI on one Cloudflare invoice with no per-token markup, no provider accounts and no provider keys. Credits also unlock frontier Workers AI models without a Workers Paid plan, at 50 requests per minute per model against 20 on standard billing. The 5% is charged on the top-up, so $100 of credit costs $105 |
| Guardrails | Workers AI token pricing | Billed as @cf/meta/llama-guard-3-8b inference on Workers AI, scaling with the length of every prompt and response scanned. The only safety feature here that has a variable cost, and the one most likely to surprise on a chatty workload |
Free is the honest headline and the log cap is the honest asterisk. The gateway itself costs nothing on any plan and the provider tokens carry no markup, so the sticker price genuinely is zero. What bites is that the free tier's 100,000 logs are account-wide, not per gateway, and once they are gone logging stops rather than rotating, so the thing you adopted for observability quietly goes blind. Budget for Workers Paid from day one on anything real. Two more numbers to put in the model: Guardrails is priced per token scanned, so turning safety on doubles the token surface of a chat workload, and Unified Billing's 5% credit fee is the price of not managing provider accounts, which is worth it below a certain volume and not above it. Cloudflare's own 08/2026 promotion pricing GPT-5.6 Sol at 50% off for credit users through 18/09/2026 shows where the incentive sits: credits, not BYOK. Euro figures converted from published USD at roughly 0.92.
checked 2026-09-02 · vendor pricing page
Element scores
Strengths
The adoption cost is close to zero and the free tier is not a trap. One line of code, no infrastructure, no Postgres, no Redis, no on-call, no procurement conversation, and analytics, caching, rate limiting, retries, fallback and BYOK all work on a free Cloudflare account. On the edge, that is measured in single-digit milliseconds of added latency across 300+ cities, which is the one structural advantage a self-hosted gateway cannot copy. The governance work shipped through 2026 is the part worth paying attention to, because it is the part LiteLLM gets wrong: spend limits landed on 05/06/2026 as real cost-based budgets that track cumulative dollar spend by model, provider or custom metadata and block when exceeded, on both credits and BYOK. Cloudflare Access integration on 05/08/2026 put the gateway endpoint behind an identity policy and stamped the verified user into request metadata, so spend limits and log filters work per authenticated user without the client passing an ID. User Insights, the same day, baselines each user's p95 session cost over 30 days and flags sessions that break both that baseline and an org threshold, which is a compromised-credential signal most observability products charge for and this one includes. DLP scanning is free on every plan with two predefined profiles and inherits the full Cloudflare One profile set, including custom profiles and OCR, if the account already has Zero Trust. Unified Billing removes an entire category of admin: one invoice, no provider accounts, no provider keys, no markup on tokens. And the 07/08/2026 merge of Workers AI and AI Gateway into one binding, one REST surface and one credit balance is the right architectural move for anyone already inside the platform.
Honest dings
It is a narrow product being marketed as a control plane. MCP traffic does not pass through it, which Cloudflare's own scope documentation states plainly: the gateway sits on the LLM-API path, not the agent-to-tool path, so tool descriptions, tool arguments and tool responses are invisible to it, and so are arbitrary outbound agent HTTP, non-AI WebSocket egress and DNS. In 2026 that is the gap that matters, because MCP governance is exactly what the competing gateways now lead with. Evaluations are deprecated and no longer supported for new accounts as of the 28/07/2026 docs revision, having never got past human feedback in open beta, so a capability teams once evaluated on has been withdrawn rather than finished. Caching is exact-match on a SHA-256 of the full request body, and Cloudflare's own docs say semantic caching is planned, which means paraphrased prompts miss and a FAQ-style workload gets a fraction of the saving a semantic cache would deliver; the cache is also explicitly volatile, so two simultaneous identical requests can both miss. There is no prompt management, no reasoning normalisation, no span-level tracing and no OpenTelemetry-native collection, and independent comparisons consistently place its observability behind Langfuse and Helicone. There is no self-hosting and no in-VPC option at all, which for a European organisation with data-residency obligations is not a feature comparison, it is a disqualification. And the free tier's 100,000-log account-wide cap stops saving rather than rotating, so the free plan is an evaluation tier wearing a production tier's clothes.
Sources (20) — every claim traceable
Every audit lists the research it rests on — transparency and traceability are the product. Tools evolve: each audit is a snapshot of its audit date, and re-audits supersede older versions (kept below for reference).
- developers.cloudflare.com/ai-gateway/reference/pric… — Official pricing page, last updated 19/05/2026, verified 02/09/2026. Primary source for every cost figure in this audit: core features free on all plans, persistent log limits of 100,000 total per account on Workers Free and 10 million per gateway on Workers Paid, DLP free on all plans with two predefined profiles and the full Cloudflare One set inherited with a Zero Trust subscription, Guardrails billed as @cf/meta/llama-guard-3-8b Workers AI inference, Unified Billing's 5% credit fee with no per-token markup, Logpush on Workers Paid at 10 million records/month then $0.05/million (accessed 2026-09-02)
- developers.cloudflare.com/ai-gateway/changelog — Official changelog and the spine of the capability timeline used here, verified 02/09/2026: invoice consolidation and model-name standardisation (01/09/2026), GPT-5.6 Sol at 50% off for credit users through 18/09/2026 (19/08/2026), Workers AI and AI Gateway unification of bindings, REST surface and credit balance with 50 rpm frontier limits (07/08/2026), User Insights p95 anomaly detection (05/08/2026), Cloudflare Access identity-aware controls and cf.user_id (05/08/2026), user-agent logging (12/06/2026), spend limits (05/06/2026), the four-endpoint AI REST API (21/05/2026), gateway-level retries up to 5 attempts with configurable backoff (02/04/2026), cf-aig-collect-log-payload (17/03/2026) (accessed 2026-09-02)
- developers.cloudflare.com/ai-gateway/features — Official feature index, last updated 05/06/2026. Full capability inventory behind the Guardrails, Tracing and Small-models scores: caching, spend limits, rate limiting, Dynamic Routing, Guardrails, DLP, authentication, BYOK across 20+ providers, analytics with GraphQL API, logging, custom metadata and custom costs, plus the vendor's own feature-by-use-case mapping (accessed 2026-09-02)
- developers.cloudflare.com/ai-gateway/features/cachi… — Official caching documentation, last updated 27/08/2026, and the evidence for the exact-match limitation stated in Cloudflare's own words: caching supported only for text and image responses and only for identical requests, with semantic search for caching named as a future plan. Also the cache-key construction (SHA-256 of provider, endpoint, model, auth header and full request body), TTL bounds of 60 seconds to one month, the cf-aig-skip-cache / cf-aig-cache-ttl / cf-aig-cache-key headers, and the explicit warning that the cache is volatile so two simultaneous identical requests can both miss (accessed 2026-09-02)
- developers.cloudflare.com/ai-gateway/evaluations — Official Evaluations page, last updated 28/07/2026, carrying the deprecation banner that drives the 1.5 score: Evaluations are deprecated and no longer supported for new accounts. Confirms the feature never advanced past human feedback in open beta on log-derived datasets, with further evaluators promised and never delivered (accessed 2026-09-02)
- developers.cloudflare.com/ai-gateway/features/guard… — Official Guardrails documentation, last updated 05/06/2026: the gateway proxies and inspects both user prompts and model responses in real time, with per-category selection and a flag-or-block action, applied uniformly across OpenAI, Anthropic, DeepSeek and the rest. Basis for the highest score in this audit (accessed 2026-09-02)
- developers.cloudflare.com/ai-gateway/observability/… — Official logging documentation, last updated 15/06/2026: what each log record contains (prompt, response, provider, timestamp, status, tokens, cost, duration, user agent, and for DLP matches the action plus matched policy, profile and detection entries), the per-request cf-aig-collect-log and cf-aig-collect-log-payload overrides, and the load-bearing detail that when a gateway's storage limit is reached new logs stop being saved until old ones are deleted (accessed 2026-09-02)
- developers.cloudflare.com/ai-gateway/usage/providers — Official provider list verified 02/09/2026, used to check the breadth claim rather than accept the marketing number: 23 providers, being Workers AI, Amazon Bedrock, Anthropic, Azure OpenAI, Baseten, Cartesia, Cerebras, Cohere, Deepgram, DeepSeek, ElevenLabs, Fal AI, Google AI Studio, Google Vertex AI, Groq, HuggingFace, Ideogram, Mistral AI, OpenAI, OpenRouter, Parallel, Perplexity, Replicate and xAI. Basis for both the LLM and Multimodal scores (accessed 2026-09-02)
- cloudflare.com/products/ai-gateway — Official product page verified 02/09/2026, source of the vendor's own positioning line ('an intelligent control plane for your AI applications') and its four marketed pillars: Dynamic Routing by latency, cost or availability adjustable without redeploys, caching, built-in observability, security controls and Unified Billing (accessed 2026-09-02)
- blog.cloudflare.com/ai-gateway-aug-2025-refresh — Cloudflare's own launch post for the feature set this audit scores, giving the vendor's stated intent behind Unified Billing, secure key storage, Dynamic Routes and DLP, including the if/else and percentage-split routing UI and the requirement that Unified Billing users be on Workers Paid to add credits (accessed 2026-09-02)
- pipelab.org/learn/cloudflare-ai-gateway — Independent boundary analysis (May 2026), and the clearest corroboration of the Protocols score. Documents what sits outside the gateway's scope with the reasoning: MCP tool descriptions, arguments and responses do not traverse it because it is not on the agent-to-MCP path, arbitrary outbound agent HTTP is invisible to it, non-AI-provider WebSocket egress is out of scope, and DNS-based exfiltration is below its layer. Frames these as design choices rather than bugs, which is the fair reading and the one adopted here (accessed 2026-09-02)
- api7.ai/portkey-vs-cloudflare-ai-gateway — Independent head-to-head comparison (30/06/2026) corroborating the four structural limits used in the dings: managed-only with no self-host or in-VPC option, semantic caching not available and noted as planned, MCP not in AI Gateway but in separate Cloudflare Agents and Cloudflare One products, and SCIM enterprise-only. Also confirms the 20+ provider count and the retry ceiling of five attempts (accessed 2026-09-02)
- recatools.com/ai-directory/cloudflare-ai-gateway — Independent review (19/05/2026) that is unusually honest about its own evidence base, noting there is no consumer-style review corpus for developer infrastructure. Corroborates the exact-match-only caching, the absence of MCP support as of mid-2026, proxy latency in the 10-50ms range, and the free-tier log cap becoming a real constraint at production volume. Its bottom line, that teams graduate to a dedicated gateway once semantic caching or MCP becomes a requirement, matches the conclusion reached here independently (accessed 2026-09-02)
- imrul.tech/posts/cloudflare-ai-gateway — Independent developer write-up (05/02/2026) and the source of the data-sovereignty framing: SaaS-only with no self-hosted option means all LLM traffic routes through Cloudflare's network, which the author names as the critical constraint for enterprises whose compliance posture requires traffic stay in-network. Note that its 'no guardrails, no virtual keys' claims were true at publication and have since been partly overtaken by the June and August 2026 releases, which is why this audit scores Guardrails 7.5 rather than following it (accessed 2026-09-02)
- vercel.com/i/vercel-ai-gateway-vs-cloudflare-ai-gat… — Independent (competitor-published, so weighed accordingly) comparison corroborating the 5% Unified Billing fee, the 100,000-log account-wide free cap and how fast a 1,000-request-a-day workload clears it, the manual ordered fallback array rather than automatic same-model failover, Guardrails and DLP still being beta, and Workers AI at $0.011 per 1,000 Neurons with 10,000 Neurons a day free (accessed 2026-09-02)
- braintrust.dev/articles/ai-gateway-comparison-2026 — Independent (competitor-published) 2026 gateway comparison, corroborating that core features are free on all Cloudflare plans and that the observability is usage-and-log-focused rather than evaluation-focused, so structured evaluation and CI gating need a separate tool. Directly supports the Evaluations and Tracing scores (accessed 2026-09-02)
- finance.yahoo.com/markets/stocks/articles/cloudflar… — Reporting of Cloudflare's official Q2 2026 results and earnings call, used for the platform-scale figures since no AI Gateway user count is published: revenue $696.1 million up 36% year on year, over 80,000 paying customers added in the quarter for 74% year-on-year growth, 4,698 customers above $100,000 annually, and the Workers developer platform passing 7.4 million developers with nearly 2 million added in the quarter (accessed 2026-09-02)
- qz.com/cloudflare-earnings-ai-demand-full-year-fore… — Second independent report of the same Q2 2026 results, corroborating the revenue and guidance figures and adding the context that matters for vendor risk: a GAAP net loss of $170 million including $150.7 million of restructuring charges, following the Q1 2026 reduction of roughly 1,100 employees or about 20% of the global workforce, framed by the founders as a realignment around AI-driven operations (accessed 2026-09-02)
- profitvisionlab.com/en/net-q2-2026-earnings-update — Third-party analysis of the Q2 2026 cycle, cited only as directional colour and explicitly not as an official statement. Reports Cloudflare's internal AI Gateway usage at over 20.18 million requests and 241.3 billion tokens per month with 3,683 employees using it, and the routing split of 91.16% to frontier providers against 8.84% to Workers AI, which is the figure behind the Small-models score's honesty note. Also corroborates the Workers AI and AI Gateway merge into one calling convention, one billing wallet and one dashboard across roughly 220 models (accessed 2026-09-02)
- developers.cloudflare.com/ai-gateway — Official product overview, last updated 20/04/2026: the one-line integration claim, availability on all plans, and the explicit separation of AI Gateway from the related products Workers AI and Vectorize, which is the documentary basis for marking Vector store N/A rather than scoring Cloudflare's vector database inside this audit (accessed 2026-09-02)