Cloudflare AI Gateway connection
Cloudflare AI Gateway routes supported model requests through a configured gateway connection.
What it is
A Cloudflare AI Gateway connection sends model requests through a gateway before they reach the selected service. Gateway Sub-Provider identifies that upstream service and request format. Powerfront manages this connection on your AI account.
Who uses it and why
Administrators agree gateway requirements with Powerfront. Developers check upstream compatibility, authentication and the intended route. Operators continue to use their enabled AI features without selecting a gateway themselves.
Where to find it
Powerfront manages the gateway fields in Settings › AI › Accounts. They appear for accounts configured for gateway routing. Ask Powerfront to prepare or change this connection for you.
How it works
- INSIDE identifies the gateway using Gateway Account ID and Gateway ID.
- Gateway Sub-Provider selects OpenAI Chat Completions, OpenAI Responses, Google AI Studio, AWS Bedrock or Workers AI (Native).
- INSIDE sends the model request through that route, using the upstream service's supported request format.
- The result returns to the AI feature as a complete reply or supported stream.
Gateway Authorization authenticates the gateway connection separately from the upstream API Key. A recognised gateway guardrail block is treated as an incomplete, content-filtered result.
Configure it
Ask Powerfront to confirm the account's effective gateway route, upstream model, identifiers and required credentials. No gateway account or gateway identifier is supplied automatically. Leaving Gateway Base URL unset uses the built-in Cloudflare AI Gateway address.
For Bedrock, Gateway Region takes priority over the account region. If neither is configured, the connection uses us-east-1.
Selecting a model configured as Workers AI (Cloudflare) makes an AiFlow account use gateway routing. Workers AI requires a model identifier and a Cloudflare API token in API Key.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Gateway Sub-Provider | Settings › AI › Accounts | website | OpenAI Chat Completions in the gateway form | Powerfront | Chooses the upstream service and request format; saving an AiFlow account can align it with the selected model's provider. A saved gateway connection without this selection cannot send requests. |
| Gateway Region | Settings › AI › Accounts | website | Account Region, otherwise us-east-1 | Powerfront | Selects the Bedrock region when the gateway's upstream service is AWS Bedrock. |
| Gateway Base URL | Settings › AI › Accounts | website | Not set | Powerfront | Overrides the gateway service address; an unset or blank value uses the built-in Cloudflare AI Gateway address. |
Fields
| Field | Where | Required | What it is for |
|---|---|---|---|
| Gateway Account ID | Settings › AI › Accounts | Yes | Identifies the Cloudflare account; no identifier is supplied by default. |
| Gateway ID | Settings › AI › Accounts | Yes | Identifies the gateway within the Cloudflare account; no identifier is supplied by default. |
| Gateway Authorization | Settings › AI › Accounts | No | Supplies gateway authentication separately from the upstream API Key when required by the gateway. |
| API Key | Settings › AI › Accounts | No | Supplies the upstream service credential, or a Cloudflare API token for Workers AI. |
Limits and good to know
- The upstream selection must match the account's model. Saving the account can realign Gateway Sub-Provider with that model's provider.
- In particular, saving a gateway account with a generic OpenAI model selects the Chat Completions route. Ask Powerfront to verify the effective route if Responses is required.
- The Google gateway path in 3.3 omits new function declarations, function-selection controls and thinking options. It sends instructions as conversation text. Ask Powerfront to use a direct Google connection when those capabilities are needed.
- A Gateway Authorization value does not remove Google's, Bedrock's or Workers AI's local credential requirement in this release.
- Gateway routing alone does not establish caching, retries, quotas or a data-residency policy. Agree any required policy with Powerfront.
Depends on and works with
View all connections as a list
This feature uses
- AI reply streaming settingsConfigured by
The AI feature's streaming options control progressive delivery of supported gateway output.
- AI accounts and shared defaultsRequires
Gateway details and credentials belong to the AI account.
- AI model catalogueConfigured by
The selected model can determine the effective upstream provider.
- OpenAI API connection optionsEnhances
OpenAI Chat Completions and Responses requests can use the gateway.
- Google AI Studio model connectionEnhances
Google AI Studio requests can use the gateway with release-specific capability limits.
- AWS Bedrock model connectionEnhances
AWS Bedrock requests can use a gateway region.
Used by
- AI model provider selectionEnhances
Cloudflare AI Gateway can route supported model requests.
- OpenAI API connection optionsEnhances
OpenAI requests can be routed through a configured gateway.
- Google AI Studio model connectionEnhances
Google requests can use a gateway, with reduced tool and thinking support in this release.
- AWS Bedrock model connectionEnhances
A configured gateway can route Bedrock model requests.
FAQ and troubleshooting
Why are there two authentication fields?
Gateway Authorization is for the gateway. API Key is for the upstream model service, or is the Cloudflare API token for Workers AI.
Why did my OpenAI gateway API choice change after saving?
Saving an account can align the upstream route with its model's provider. A generic OpenAI model selects Chat Completions. Ask Powerfront to check the saved connection.
Why does a Google feature lose function use through the gateway?
The gateway path omits new function declarations and selection controls in 3.3. Ask Powerfront to use a direct Google connection for that feature.
Does a blocked request mean the model service is unavailable?
No. A gateway guardrail can block a request before a normal reply is returned. Powerfront can check the block and its configured handling.