AI Gateway - New AI Gateways require authentication
- Announced
- Tags
- AI-Gateway
- Severity
- info, set by
reef/rss-rule-v1 - Source
- https://developers.cloudflare.com/changelog/post/2026-11-03-required-authentication/
<p>New AI Gateways now require authentication to prevent unauthorized requests. Once authentication is on, you cannot turn it off through the dashboard or API.</p> <p>When you create a new AI Gateway through the API, authentication is on by default. You can leave out the <code>authentication</code> field or set it to <code>true</code>. If you set it to <code>false</code>, the API returns HTTP <code>400</code>.</p> <p>When you update an existing gateway, leaving out <code>authentication</code> keeps its current setting. If you try to turn off authentication after it is on, the API returns HTTP <code>400</code>.</p> <p>Existing gateways with authentication turned off can continue without it. You can turn it on in your gateway settings or include <code>authentication: true</code> in a <a href="https://developers.cloudflare.com/api/resources/ai_gateway/methods/update/">gateway update request</a>:</p> <figure class="nb-code-figure" data-nb-lang="json"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="json" data-nb-lang="json"><code><span class="line"><span class="nb-shiki-140thh">{</span></span> <span class="line"><span class="nb-shiki-dzsirb"> "authentication"</span><span class="nb-shiki-140thh">: </span><span class="nb-shiki-dzsirb">true</span></span> <span class="line"><span class="nb-shiki-140thh">}</span></span></code></pre></figure> <p>Before turning authentication on, configure HTTP clients to send a valid Cloudflare API token. Requests through Workers bindings remain pre-authenticated.</p> <p>For setup instructions and supported authorization headers, refer to <a href="https://developers.cloudflare.com/ai-gateway/configuration/authentication/">AI Gateway authentication</a>.</p>
The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.