Sign inConnect your agent
infochanged

AI Gateway - Prevent Unified Billing fallback for BYOK third-party providers

Announced
Tags
AI-Gateway
Severity
info, set by reef/rss-rule-v1
Source
https://developers.cloudflare.com/changelog/post/2026-09-14-require-provider-credentials/

<p>AI Gateway can now require credentials for third-party provider requests. Credentials must accompany the request or be stored on the gateway. This setting prevents fallback to Unified Billing with Cloudflare-managed credentials.</p> <p>Turn on <strong>Require provider credentials</strong> in your gateway settings. To use the API, set <code>byok_only</code> to <code>true</code> in the request body of a <a href="https://developers.cloudflare.com/api/resources/ai_gateway/methods/update/"><code>PUT</code> request to update the gateway</a>:</p> <figure class="nb-code-figure" data-nb-lang="json"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="json" data-nb-lang="json"><code><span class="line"><span class="nb-shiki-140thh">{</span></span> <span class="line"><span class="nb-shiki-dzsirb"> "byok_only"</span><span class="nb-shiki-140thh">: </span><span class="nb-shiki-dzsirb">true</span></span> <span class="line"><span class="nb-shiki-140thh">}</span></span></code></pre></figure> <p>To require provider credentials for one third-party request, set the <code>cf-aig-no-wholesale</code> header to <code>true</code>. This header cannot relax the gateway setting.</p> <p>Requests without applicable credentials then return an HTTP <code>400</code> response. Workers AI requests remain allowed, and the setting does not change their configured billing mode.</p> <p>For configuration details and request-level controls, refer to <a href="https://developers.cloudflare.com/ai-gateway/features/unified-billing/#prevent-unified-billing-fallback-for-byok-third-party-providers">Prevent Unified Billing fallback for BYOK third-party providers</a>.</p>

The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.