AI Gateway credential enforcement now lets you require that every request to a third‑party model provider include explicit BYOK credentials, or that those credentials be stored on the gateway itself. The new toggle blocks the previous behavior where, in the absence of provider credentials, the request would silently fall back to Cloudflare‑managed Unified Billing credentials.
What Changed in AI Gateway
The gateway settings include a Require provider credentials option. When enabled, the platform validates that a request carries a matching credential set; otherwise it rejects the call with an HTTP 400 error. The same effect can be achieved via the API by sending a PUT request with { "byok_only": true } in the body. For a single request you can also set the cf-aig-no-wholesale header to true, which forces the credential check but cannot override a disabled global setting.
{
"byok_only": true
}Why Enforcing Credentials Matters
Practitioners who rely on third‑party models often bring their own keys (BYOK) to keep cost attribution and usage reporting under their control. Without enforcement, a missing or mis‑configured credential would automatically switch to Cloudflare’s unified billing account, potentially mixing cost streams and violating internal chargeback policies. The change gives engineers a deterministic way to guarantee that only authorized BYOK credentials are used, preserving financial and compliance boundaries.
Implementation Steps
- Navigate to the AI Gateway configuration UI and enable Require provider credentials.
- Or, automate the change via the API: issue a
PUTto the gateway endpoint with{ "byok_only": true }in the JSON payload. - For selective enforcement on a per‑request basis, add the header
cf-aig-no-wholesale: trueto the HTTP call. - Verify that requests lacking a matching credential set now receive a 400 response.
- Confirm that Workers AI traffic continues to operate unchanged, as the setting does not affect their billing mode.
Operational and Security Considerations
- Credential storage now resides on the gateway; ensure that gateway access controls and secret management practices are aligned with your organization’s security policies.
- Because the header cannot relax the global setting, accidental omission of the header will not bypass enforcement, reducing the risk of unintended fallback.
- Monitoring should include alerting on 400 responses from AI Gateway, which may indicate missing or expired BYOK credentials.
- Cost reporting tools need to be updated to reflect that Unified Billing will no longer receive traffic from enforced gateways.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
Enabling the BYOK‑only mode gives you explicit control over which credentials are used for third‑party model calls, eliminating silent cost leakage and simplifying compliance tracking. Adopt the setting early in your deployment pipeline, integrate the API flag into IaC scripts, and adjust monitoring to catch credential‑related rejections. This proactive step aligns operational behavior with financial and security policies without affecting existing Workers AI workloads.
