How is AI Gateway different from a regular API gateway?

AI Gateway understands the specifics of traffic to language models: it counts tokens and cost per model, builds its cache from the prompt content rather than just the URL, and offers AI-specific mechanisms such as DLP that detects sensitive data in prompts and responses, or configurable fallback between models from different providers.

Does deploying AI Gateway require rebuilding the application?

No. In most cases it is enough to change the address the application sends requests to, to the AI Gateway endpoint, keeping the existing request format. Integrations through Workers Bindings or popular SDKs usually require one or two lines of configuration changes.

Do Guardrails and DLP replace a corporate AI security policy?

No. Guardrails and DLP are mechanisms that let you enforce an AI security policy - they do not define one. Guardrails categories and DLP profiles have to be configured for the risks specific to your organization and industry, in line with applicable regulations.

How much does AI Gateway cost?

The core features - analytics, caching, rate limiting and logs - are free on all Cloudflare plans. The free plan allows up to 10 gateways and 100 thousand stored logs per account, the paid plan up to 20 gateways and 10 million logs per gateway. Guardrails generates billable Workers AI usage, and Unified Billing adds a 5% fee on purchased credits, with no markup on token prices.

What happens when a model provider has an outage?

AI Gateway lets you configure automatic retries and failover to a backup model with the same or another provider. Combined with dynamic routing you can also define more complex switching rules, for example based on a budget limit or conditions stored in request metadata.

Cloudflare AI Gateway: logs, DLP and AI cost control

Applications, agents and automations increasingly connect to AI model provider APIs straight from code, without any central oversight from the security team. Cloudflare AI Gateway solves exactly this problem: it sits between the application and the model provider, so all of this traffic can be logged, scanned for sensitive data and kept under cost control. In this article we show how AI Gateway works: how it logs traffic, how it scans it with DLP and Guardrails, how it helps control costs, and what it does not do.

AI traffic is growing faster than the oversight of it

According to the Netskope Cloud and Threat Report 2026, based on data from October 2024 to October 2025, the number of employees using GenAI applications tripled within a year, and the number of prompts sent to them grew sixfold. Over the same period, the number of incidents involving sensitive data sent to AI applications doubled, to an average of 223 events per month per organization. The data that leaks most often is source code, regulated data and intellectual property.

A significant share of this traffic no longer goes through the browser, but through internal applications, agents and automations that call model provider APIs straight from code, without any central oversight. According to the Salt Security - 1H 2026 State of AI and API Security Report, almost half of organizations (48.9%) have no visibility into the machine-to-machine traffic generated by their own AI agents, and 47% of surveyed organizations saw their API call volume grow by 51-100% over the past year. This is exactly the traffic Cloudflare AI Gateway deals with, and it is what the rest of this article is about.

What Cloudflare AI Gateway is and how it works

Cloudflare AI Gateway is a service available on all Cloudflare plans that sits between an application and an AI model provider. Instead of connecting directly to the OpenAI, Anthropic or Google API, the application sends its requests through the gateway. The gateway provides traffic analytics and logging as well as caching and request limits. On top of that, it lets you configure request retries and failover to a backup model when a provider returns an error.

Getting started comes down to a single change in code: instead of the provider's address, the application points to the AI Gateway endpoint. Cloudflare provides a REST API that supports any model, including third-party hosted ones, through the same interface. There is no need to install provider-specific SDKs. Authentication uses a Cloudflare API token, and billing - depending on the chosen billing model - goes either through the Cloudflare account or directly with the provider. For the simplest deployments Cloudflare also provides a default gateway with the identifier "default", created automatically on the first request, with no prior configuration.

The gateway natively supports more than twenty model providers, including Workers AI, Amazon Bedrock, Anthropic, Azure OpenAI, Google Vertex AI, Google AI Studio, Mistral, Groq, DeepSeek and OpenAI. A company using several models at once sees all of its traffic in one place instead of scattering it across separate integrations and accounts.

Data security: Guardrails and DLP

Two features are responsible for the security of content passing through the gateway. Guardrails (beta) evaluates both user prompts and model responses in real time for harmful content, such as violence, hate speech or sexual content. You configure the categories to monitor yourself, and detected content can be flagged for review or blocked before it reaches the model or the user.

The second mechanism, Data Loss Prevention (beta), uses the same detection engines as the broader Cloudflare DLP product and scans the content of prompts and responses for sensitive data, such as payment card numbers or personal data. DLP profiles are account-level shared objects, so rules configured once can be reused across many gateways without defining them from scratch each time. There is one technical trade-off to keep in mind: with streamed responses (SSE), DLP scanning requires buffering the entire model response before it reaches the client, which increases time to first token. If an application needs low latency while streaming, a good solution is to limit DLP to scanning prompts only, or to split traffic across separate gateways.

DLP is free on all Cloudflare plans - accounts without a Zero Trust subscription get access to two predefined profiles: financial information and identification and insurance numbers. The latter profile does not cover the Polish PESEL number, however - its detection has to be configured separately as a custom rule. Guardrails has no separate feature fee, but it generates billable usage of the Workers AI model used to evaluate content.

By default, AI Gateway logs store the full content of prompts and responses. The cf-aig-collect-log-payload: false header disables storing the content itself while keeping metadata such as token counts, model, provider, response code or cost - a simple way to keep visibility into usage without storing sensitive prompts.

Cost control, performance and resilience

AI Gateway reduces costs and improves performance on several levels at once. Cache stores responses for identical requests. The cache key is built from the provider, the model, the authorization header and the full request body. Cache TTL can be set from 60 seconds to a month, and an individual request can bypass the cache with the cf-aig-skip-cache header when a fresh response is always needed.

Rate limiting restricts the number of requests in a time window, in fixed or sliding mode, returning a 429 code once the limit is exceeded. A newer feature, Spend limits (beta), goes a step further and lets you set a budget in dollars rather than request counts, broken down by model, provider or any custom dimension, such as a user or team identifier. Once the budget is exceeded, the gateway can block further requests or, combined with dynamic routing, automatically shift traffic to a cheaper model instead of rejecting it. Keep in mind that the cost shown in AI Gateway is an estimate calculated from token counts and provider price lists, not an accounting figure - exact invoicing depends on the model provider itself.

Dynamic routing (beta) lets you build a decision flow, visually or with a JSON file. It can define conditions based on request metadata, request or budget limits with automatic failover to a backup model, and percentage-based traffic splits useful for A/B tests or gradual rollouts of a new model. Together with configurable retries and fallback, this is a real answer to provider-side outages and downtime.

Deployment and integration

Authentication against AI Gateway requires a Cloudflare API token passed in the standard Authorization header for REST API calls, or the cf-aig-authorization header for the older provider-native endpoints. Enabling the Authenticated Gateway feature enforces such a token on every request, so unauthorized requests are rejected outright.

Billing can work in one of two ways. Unified Billing lets you pay for model calls directly through your Cloudflare account, without creating separate accounts with each provider, with a 5 percent fee on purchased credits and no markup on token prices themselves. The alternative is BYOK (bring your own keys), where the company uses its own, previously negotiated API keys with providers and the gateway only proxies the traffic.

When planning a deployment, you also need to know the platform limits: the free plan allows up to 10 gateways per account, the paid plan up to 20, and log storage is limited to 100 thousand logs per account and 10 million per gateway respectively, according to the limits documentation. A single log cannot exceed 10 MB, and a cacheable request is limited to 25 MB.

What AI Gateway does not do

AI Gateway only sees the traffic that is routed through it. It will not cover employees using ChatGPT or other public AI tools directly in the browser - that area is secured by Cloudflare Gateway with DLP, which operates at the level of device network traffic. It does not replace application-level security either: end-user authentication, data access authorization and protection against attacks on the application remain the responsibility of the team building it. Finally, the gateway is not an accounting audit tool - the costs in its analytics are estimates, and the binding bill always comes from the model provider or, with Unified Billing, from the Cloudflare account.

How ICWT helps

Deploying AI Gateway is more than changing a single endpoint. At ICWT we help clients map which teams and applications actually connect to AI models, choose DLP profiles and Guardrails categories appropriate for their industry and regulatory requirements (such as GDPR or NIS2), and configure spend limits and dynamic routing so that a single provider outage does not stop the application. As a Cloudflare partner we also support the decision between Unified Billing and BYOK, depending on the agreements the company already has with model providers. If you want to see what this would look like in your infrastructure, contact us.

Cloudflare AI Gateway: logs, DLP and AI cost control

AI traffic is growing faster than the oversight of it

What Cloudflare AI Gateway is and how it works

Data security: Guardrails and DLP

Cost control, performance and resilience

Deployment and integration

What AI Gateway does not do

How ICWT helps

Sources

FAQ

Related articles

The Evolution of the Threat: Why Shai-Hulud 2.0 Forces Us to Redefine Software Supply Chain Security

Shai-Hulud hits npm again: keyv and hundreds of packages

Malware in the axios package on npm - how to secure your applications?