Effective immediately, every AI Gateway created on Cloudflare enforces authentication and the setting cannot be turned off via the UI or API. Engineers responsible for building or operating AI services must ensure that any client invoking the gateway presents a valid Cloudflare API token, otherwise requests will be rejected.
Default Authentication Behavior
When a gateway is provisioned through the API, the authentication flag is implicitly true. Omitting the field or explicitly setting it to true succeeds, while an explicit false triggers a HTTP 400 error. This guarantees that fresh deployments start with a secure posture without additional steps.
Impact on Existing Gateways
Gateways that were created before this change and have authentication disabled continue to operate unchanged. However, once authentication is enabled—either via the portal settings or an update request—the same API will reject any attempt to set authentication to false. Updating a gateway without specifying the field preserves its current state, so accidental removal of authentication is prevented.
{
"authentication": true
}Turning authentication on for an existing gateway follows the same JSON payload, and the request will succeed only if the gateway is currently unauthenticated.
Operational Adjustments
Before enabling authentication, teams must configure their HTTP clients to attach a Cloudflare API token in the request headers. This token is the only credential accepted for direct gateway calls; calls made through Workers bindings remain pre‑authenticated and do not require modification. Deployment pipelines that automate gateway creation or updates should remove any logic that attempts to set authentication to false and should verify that the token is available in the runtime environment.
Monitoring should be updated to watch for HTTP 400 responses from the gateway API, as they now indicate an illegal attempt to disable authentication rather than a generic client error.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Practitioners should audit all automation that interacts with AI Gateways, ensure API tokens are provisioned securely, and remove any code paths that try to disable authentication. Existing unauthenticated gateways can stay as‑is, but any plan to secure them must use the update flow shown above. Finally, update operational dashboards to surface authentication‑related errors so that misconfigurations are caught early.