# Cloudflare AI Gateway connection Cloudflare AI Gateway routes supported model requests through a configured gateway connection. *Release 3.3 · admin, developer* **Settings › AI › Accounts** ## What it is A Cloudflare AI Gateway connection sends model requests through a gateway before they reach the selected service. **Gateway Sub-Provider** identifies that upstream service and request format. Powerfront manages this connection on your AI account. ## Who uses it and why Administrators agree gateway requirements with Powerfront. Developers check upstream compatibility, authentication and the intended route. Operators continue to use their enabled AI features without selecting a gateway themselves. ## Where to find it Powerfront manages the gateway fields in **Settings › AI › Accounts**. They appear for accounts configured for gateway routing. Ask Powerfront to prepare or change this connection for you. ## How it works 1. INSIDE identifies the gateway using **Gateway Account ID** and **Gateway ID**. 2. **Gateway Sub-Provider** selects **OpenAI Chat Completions**, **OpenAI Responses**, **Google AI Studio**, **AWS Bedrock** or **Workers AI (Native)**. 3. INSIDE sends the model request through that route, using the upstream service's supported request format. 4. The result returns to the AI feature as a complete reply or supported stream. **Gateway Authorization** authenticates the gateway connection separately from the upstream **API Key**. A recognised gateway guardrail block is treated as an incomplete, content-filtered result. ## Configure it Ask Powerfront to confirm the account's effective gateway route, upstream model, identifiers and required credentials. No gateway account or gateway identifier is supplied automatically. Leaving **Gateway Base URL** unset uses the built-in Cloudflare AI Gateway address. For Bedrock, **Gateway Region** takes priority over the account region. If neither is configured, the connection uses **us-east-1**. Selecting a model configured as **Workers AI (Cloudflare)** makes an AiFlow account use gateway routing. Workers AI requires a model identifier and a Cloudflare API token in **API Key**. ### Settings | Setting | Where | Applies to | Default | Who can change it | What it does | |---|---|---|---|---|---| | Gateway Sub-Provider | Settings › AI › Accounts | website | OpenAI Chat Completions in the gateway form | Powerfront, on request | Chooses the upstream service and request format; saving an AiFlow account can align it with the selected model's provider. A saved gateway connection without this selection cannot send requests. | | Gateway Region | Settings › AI › Accounts | website | Account Region, otherwise us-east-1 | Powerfront, on request | Selects the Bedrock region when the gateway's upstream service is AWS Bedrock. | | Gateway Base URL | Settings › AI › Accounts | website | Not set | Powerfront, on request | Overrides the gateway service address; an unset or blank value uses the built-in Cloudflare AI Gateway address. | ### Fields | Field | Where | Required | What it is for | |---|---|---|---| | Gateway Account ID | Settings › AI › Accounts | Yes | Identifies the Cloudflare account; no identifier is supplied by default. | | Gateway ID | Settings › AI › Accounts | Yes | Identifies the gateway within the Cloudflare account; no identifier is supplied by default. | | Gateway Authorization | Settings › AI › Accounts | No | Supplies gateway authentication separately from the upstream API Key when required by the gateway. | | API Key | Settings › AI › Accounts | No | Supplies the upstream service credential, or a Cloudflare API token for Workers AI. | ## Limits and good to know - The upstream selection must match the account's model. Saving the account can realign **Gateway Sub-Provider** with that model's provider. - In particular, saving a gateway account with a generic **OpenAI** model selects the Chat Completions route. Ask Powerfront to verify the effective route if Responses is required. - The Google gateway path in 3.3 omits new function declarations, function-selection controls and thinking options. It sends instructions as conversation text. Ask Powerfront to use a direct Google connection when those capabilities are needed. - A **Gateway Authorization** value does not remove Google's, Bedrock's or Workers AI's local credential requirement in this release. - Gateway routing alone does not establish caching, retries, quotas or a data-residency policy. Agree any required policy with Powerfront. ## Depends on and works with ### This feature uses - **Requires** [AI accounts and shared defaults](AIP-001.md): Gateway details and credentials belong to the AI account. - **Configured in** [AI reply streaming settings](AI-037.md): The AI feature's streaming options control progressive delivery of supported gateway output. - **Configured in** [AI model catalogue](AIP-002.md): The selected model can determine the effective upstream provider. - **Works better with** [OpenAI API connection options](AIP-004.md): OpenAI Chat Completions and Responses requests can use the gateway. - **Works better with** [Google AI Studio model connection](AIP-005.md): Google AI Studio requests can use the gateway with release-specific capability limits. - **Works better with** [AWS Bedrock model connection](AIP-006.md): AWS Bedrock requests can use a gateway region. ### Used by - **Enhances** [AI model provider selection](AIP-003.md): Cloudflare AI Gateway can route supported model requests. - **Enhances** [OpenAI API connection options](AIP-004.md): OpenAI requests can be routed through a configured gateway. - **Enhances** [Google AI Studio model connection](AIP-005.md): Google requests can use a gateway, with reduced tool and thinking support in this release. - **Enhances** [AWS Bedrock model connection](AIP-006.md): A configured gateway can route Bedrock model requests. ## FAQ and troubleshooting ### Why are there two authentication fields? **Gateway Authorization** is for the gateway. **API Key** is for the upstream model service, or is the Cloudflare API token for Workers AI. ### Why did my OpenAI gateway API choice change after saving? Saving an account can align the upstream route with its model's provider. A generic OpenAI model selects Chat Completions. Ask Powerfront to check the saved connection. ### Why does a Google feature lose function use through the gateway? The gateway path omits new function declarations and selection controls in 3.3. Ask Powerfront to use a direct Google connection for that feature. ### Does a blocked request mean the model service is unavailable? No. A gateway guardrail can block a request before a normal reply is returned. Powerfront can check the block and its configured handling.