AI Tools

What Does Cloudflare AI Gateway Cost in 2026?

Published 2026-10-19 · Researched and price-checked on official sources

Cloudflare AI Gateway costs nothing on any plan for routing, caching, rate limiting and analytics; its one built-in charge is a 5% fee on credits bought through Unified Billing, so a $100 top-up bills $105, verified on Cloudflare's pricing docs on October 19, 2026. Logs, guardrails and Logpush are what actually move the bill.

Key facts

What matters

Core AI Gateway features are free on every plan: analytics, caching, rate limiting and routing, with no subscription tier to buy.
Unified Billing adds 5% to each credit purchase ($100 becomes $105); inference passes through at provider list price with no markup.
Requests on your own provider keys skip both the 5% fee and the 200-requests-per-60-seconds Unified Billing cap that returns 429s.
Free accounts get 10 gateways and 100,000 stored logs across all of them; paid accounts get 20 gateways and 10 million logs per gateway on Legacy Logs.
OpenRouter charges 5.5% on Standard and 8% on Business credits, Vercel charges no token markup, and Portkey sells Production at $49/month, so Cloudflare's edge is the free core, not the cheapest tokens.

What is Cloudflare AI Gateway?

Cloudflare AI Gateway is a proxy that sits between your application and model providers. You point one SDK base URL at it and it handles provider-native routes to OpenAI, Anthropic, Google AI Studio, Vertex AI, Bedrock, Groq, Mistral, xAI, DeepSeek, Replicate and others, plus an OpenAI-compatible Unified API. Cloudflare's docs describe the setup as one line of code.

The paid-for part of the story is almost everything else on a gateway: caching, rate limiting, spend limits, dynamic routing (beta), guardrails, data loss prevention (beta), logging and Logpush export. Those are the features that make a gateway worth running, so it is fair to ask which of them carry a price and which do not. The answer, verified on Cloudflare's docs on October 19, 2026, is narrower than the feature list suggests.

It is also not a model provider. Tokens still bill from OpenAI, Anthropic or whoever serves the request, unless you buy them as Cloudflare credits through Unified Billing, which is where the one built-in fee appears.

Cloudflare AI Gateway pricing at a glance

There is no AI Gateway subscription. Cloudflare states that the gateway is available on all plans and that its core features are free: dashboard analytics, caching and rate limiting. You need a Cloudflare account, and the Workers plan you are on decides your gateway and log ceilings, not your monthly bill.

Four line items can appear on an invoice:

Unified Billing credits: a 5% fee on every credit purchase. A $100 top-up bills $105, and the per-token rates behind those credits are the provider's list prices with no markup.
Guardrails: evaluated with @cf/meta/llama-guard-3-8b on Workers AI, billed as Workers AI token inference that scales with prompt and response length.
Logpush: billed under Cloudflare's Logpush pricing by the volume of logs exported and transformed.
Logs: free within plan limits, but the storage model changed on September 24, 2026 and the new model follows Workers Logs pricing and retention.

Data Loss Prevention scanning is the exception on the feature side: Cloudflare lists DLP as free on all plans, with two predefined profiles (Financial Information, and Social, Insurance and National Identifier Numbers) for accounts without a Zero Trust subscription.

The 5% fee: Unified Billing versus BYOK

Unified Billing is the convenience tier. You buy Cloudflare credits, the gateway deducts usage from that balance, and Cloudflare adds 5% at purchase. The inference rate itself is passed through, so a model that costs $3 per million input tokens on the provider's price list costs $3 through the gateway too. The 5% is a payment-processing and float fee, not a token markup.

Bring your own keys works differently and is the cheaper path for most teams already paying providers directly. The docs attach two concrete advantages to BYOK: no 5% credit fee, and no 200-requests-per-60-seconds cap. That rate limit applies only to requests that use Cloudflare-managed credentials through Unified Billing, and exceeding it returns a 429. Requests on your own keys are exempt, which makes BYOK the right default for anything user-facing at volume.

So the practical rule is simple: if you already have provider contracts, use BYOK and the gateway costs nothing. If you want one invoice and no provider accounts, Unified Billing costs 5% of your credit top-ups and caps bursts at 200 requests per minute per gateway.

A worked example at $2,000 of monthly inference

Take a product that spends $2,000 a month on provider inference. On Unified Billing you buy $2,000 of credits, the card is charged $2,100, and the gateway's entire cost is $100 a month, which is 5%. The same traffic on BYOK costs $2,000 with no gateway fee, because the requests bill from OpenAI, Anthropic or DeepSeek directly at the rates you already negotiated. For a team spending $2,000 a month, the convenience of one invoice costs $1,200 a year.

One detail cuts against topping up defensively: the fee is charged when credits are purchased, not when they are spent. Credits bought for a launch that slips still cost 5%, so size top-ups to actual usage rather than to a comfortable buffer.

Logs, guardrails and Logpush: where the bill actually grows

Gateway fees are small. Observability is where money accumulates, and Cloudflare split its logging model in two on September 24, 2026, so the answer depends on when the account created its first gateway.

Accounts created on or after September 24, 2026 store logs in Workers Logs and inherit that product's pricing and retention. Cloudflare's Workers Logs page puts the maximum retention at 7 days, the per-log size ceiling at 256 KB, and the daily volume ceiling at 5 billion logs per account, with head-based sampling after that.

Older accounts stay on Legacy Logs. Persistent storage is 100,000 logs total across all gateways on Workers Free, and 10 million logs per gateway on Workers Paid. Ingestion is capped at 500 logs per second per gateway, and a single stored log may not exceed 10 MB.

Logpush is separate again: 4 jobs per account, 1 MB per log, billed by export and transform volume. Teams that ship every request to a SIEM should price that line before assuming the gateway is free at their traffic level.

Guardrails are the second variable cost. Because they run llama-guard-3-8b over prompts and responses, a long-context application pays Workers AI tokens twice per request once guardrails are enabled. Turning them on for every call is a real budget decision, not a checkbox.

Limits that bite before price does

Several ceilings will shape an architecture long before an invoice does. The free plan allows 10 gateways per account and the paid plan 20, so per-tenant gateway designs run out of room quickly on Workers Free. Cacheable request size is 25 MB, cache TTL tops out at one month, and custom metadata is limited to 5 entries per request, which constrains how much routing context you can attach to a log line.

Unified Billing's 200 requests per 60 seconds per gateway is the limit most likely to surprise a team in production, because it produces 429s rather than a bill. A single gateway fronting a chat product with thousands of concurrent users will hit it; BYOK will not.

Cloudflare also offers a limit increase request form, so the numbers above are defaults rather than hard walls on paid contracts. Enterprise buyers should confirm the actual ceilings with an account team, since the pricing page states that prices are subject to change.

Cloudflare AI Gateway vs OpenRouter, Vercel, Portkey and LiteLLM

The fee mechanics differ more than the headline percentages suggest, and that is the part comparison pages usually skip. Cloudflare charges 5% when you buy credits and nothing when you bring keys. OpenRouter charges 5.5% on Standard and 8% on Business credit purchases, never on individual requests, and gives $25,000 of list-price inference per month fee-free on BYOK before the 5% kicks in. Its free tier is real but narrow: 50 requests per day, 25+ free models and 4 free providers.

Vercel's AI Gateway goes the other way on tokens, charging no markup and no platform fee and billing credits at list price, which makes the gateway decision there a hosting-stack decision rather than a margin decision. Portkey sells a subscription instead: Developer is free with 10,000 recorded logs per month and 3-day log retention, Production is $49 per month with 100,000 logs and $9 per additional 100,000 requests, and Enterprise is custom. LiteLLM is free to self-host, with Enterprise priced by annual gateway request capacity, deployment architecture and support.

Put differently: Cloudflare is the cheapest option if you already run Workers and want a zero-margin proxy with observability attached. OpenRouter is the easiest way to reach 500+ models on one balance. Portkey is a predictable flat fee for teams that want prompt management and guardrails without metering credits. LiteLLM is the answer when the gateway has to live inside your own VPC.

Who should use Cloudflare AI Gateway, and the honest catch

It fits teams already on Cloudflare: a Workers or Pages app that calls models from an edge function gains caching, rate limiting and spend limits without a new vendor or a new invoice. It also fits teams that want one place to see provider traffic and are happy to keep paying providers directly through BYOK.

It fits less well in three cases. If you need SSO, in-region routing guarantees or a contractual SLA, those are plan features at OpenRouter and Portkey rather than at Cloudflare's free tier. If you want prompt management and evaluation tooling alongside the proxy, Portkey bundles it for $49 per month. If compliance forbids a third party seeing prompts at all, self-hosted LiteLLM is the only option on this list.

The catch worth knowing before you migrate: the September 24, 2026 logging split means two accounts on the same Cloudflare plan can have different retention, different pricing and different log UIs. Workers Logs retention is 7 days, so an incident investigated on day eight has no gateway log unless Logpush was already exporting. Add the 200-requests-per-minute Unified Billing cap, and the gateway's real cost is architectural attention rather than money.

At a glance

Gateway	Fee on purchased credits	Fee when you use your own keys	Entry plan
Cloudflare AI Gateway	5% on Unified Billing credits	None	Free core on all plans
OpenRouter	5.5% Standard, 8% Business	None up to $25,000/month list price, then 5%	Free: 50 requests/day
Vercel AI Gateway	No markup, no platform fee on tokens	Not stated on the pricing page	Pay-as-you-go credits
Portkey	Not applicable, subscription model	Not stated on the pricing page	Free: 10,000 logs/month; Production $49/month
LiteLLM	None, self-hosted	Uses your own provider keys	Open source free; Enterprise custom

LLM gateway fees as published by each vendor, checked October 19, 2026

FAQ

Is Cloudflare AI Gateway free?

The core gateway is free on all plans, including analytics, caching and rate limiting. You only pay 5% on credits bought through Unified Billing, plus Workers AI tokens if you enable guardrails and Logpush export charges if you ship logs out.

Does Cloudflare AI Gateway mark up token prices?

No. Cloudflare passes provider inference rates through at list price. Its 5% fee applies to the credit purchase through Unified Billing, so $100 of credit costs $105, not to individual requests.

Cloudflare AI Gateway vs OpenRouter: which is cheaper?

They are close on purchased credits, with Cloudflare at 5% and OpenRouter at 5.5% on Standard. Cloudflare is cheaper if you bring provider keys, because BYOK carries no fee and no 200-requests-per-60-seconds cap; OpenRouter is better if you need 500+ models on one balance or in-region routing.