cloudflare · superhighfives · Sep 4, 2026 · Sep 4, 2026
@@ -8,7 +8,7 @@ products:
   - ai-gateway
 ---
 
-import { Render } from "~/components";
+import { DashButton, Render, Steps } from "~/components";
 
 You have several different options for managing an AI Gateway.
 
@@ -24,13 +24,14 @@ The request that triggers auto-creation must be authenticated. When using the [R
 
 The auto-created default gateway uses the following settings:
 
-| Setting            | Default value    |
-| ------------------ | ---------------- |
-| Authentication     | On               |
-| Log collection     | On               |
-| Caching            | Off (TTL of 0)   |
-| Rate limiting      | Off              |
-| Workers AI billing | Standard billing |
+| Setting                      | Default value    |
+| ---------------------------- | ---------------- |
+| Authentication               | On               |
+| Log collection               | On               |
+| Caching                      | Off (TTL of 0)   |
+| Rate limiting                | Off              |
+| Require provider credentials | Off              |
+| Workers AI billing           | Standard billing |
 
 After creation, you can edit the default gateway settings like any other gateway. If you delete the default gateway, sending a new authenticated request to the `default` gateway ID auto-creates it again.
 
@@ -66,6 +67,25 @@ To use prepaid AI Gateway credits for Workers AI requests:
 
 Workers AI requests routed through this gateway will deduct from your AI Gateway credit balance in real time.
 
+### Require provider credentials
+
+By default, third-party provider requests without credentials can use [Unified Billing](/ai-gateway/features/unified-billing/). To prevent this fallback:
+
+<Steps>
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and go to **AI** > **AI Gateway**.
+
+   <DashButton url="/?to=/:account/ai/ai-gateway" />
+
+2. Select your gateway.
+3. Go to **Settings** and find **Require provider credentials**.
+4. Turn on **Require provider credentials**.
+5. Confirm the change.
+</Steps>
+
+Third-party provider requests must use credentials supplied with the request or stored on the gateway. Requests without applicable credentials return an HTTP `400` response instead of using Unified Billing.
+
+Workers AI requests do not use provider credentials. This setting does not block these requests. They use standard Workers AI account billing, not AI Gateway Unified Billing.
+
 ## Retry requests
 
 You can configure your gateway to automatically retry failed requests to upstream providers. This is useful when you do not control the client and cannot implement client-side retries or backoff logic.

@@ -11,7 +11,7 @@ products:
   - ai-gateway
 ---
 
-import { DashButton, Render, TabItem, Tabs } from "~/components";
+import { DashButton, Render, Steps, TabItem, Tabs } from "~/components";
 
 Unified Billing allows users to call Workers AI and connect to various AI providers (such as OpenAI, Anthropic, and Google AI Studio) and receive a single Cloudflare bill. To use Unified Billing, you must purchase and load credits into your Cloudflare account in the Cloudflare dashboard, which you can then spend with AI Gateway.
 
@@ -70,6 +70,32 @@ On requests routed through Unified Billing endpoints (for example, `env.AI.run()
 The `cf-aig-byok-alias` header selects a non-default alias only on [direct provider-passthrough](/ai-gateway/usage/providers/) requests.
 :::
 
+## Require provider credentials
+
+Turn on **Require provider credentials** to prevent Unified Billing fallback for third-party providers. Third-party provider requests must use credentials supplied with the request or stored on the gateway. Requests without applicable credentials return an HTTP `400` response instead of using Cloudflare-managed credentials.
+
+<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
+
+<Steps>
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and go to **AI** > **AI Gateway**.
+
+   <DashButton url="/?to=/:account/ai/ai-gateway" />
+
+2. Select your gateway.
+3. Go to **Settings** and turn on **Require provider credentials**.
+4. Confirm the change.
+</Steps>
+
+</TabItem> <TabItem label="API">
+
+Send a [`PUT` request](/api/resources/ai_gateway/methods/update/) to update the gateway. Include `byok_only: true` in the request body.
+
+</TabItem> </Tabs>
+
+To require provider credentials for one third-party provider request, set the `cf-aig-no-wholesale` header to `true`. This header can prevent Unified Billing fallback but cannot relax the gateway setting. If **Require provider credentials** is on, setting the header to `false` has no effect.
+
+Workers AI requests do not use provider credentials. This setting does not block these requests. They use standard Workers AI account billing, not AI Gateway Unified Billing.
+
 ## Use Unified Billing
 
 Unified Billing works in two ways: through the AI binding or through the HTTP API. Both deduct credits from your account automatically without requiring provider API keys.

@@ -24,3 +24,5 @@ Settings in AI Gateway can be configured at two levels: **Request** and **Gatewa
    Act as the default if no headers are set at the request level.
 
 This hierarchy ensures consistent behavior, prioritizing the most specific configurations. Use request-level headers for fine-tuned control, and gateway settings for general defaults.
+
+Some restrictive settings are additive. The `cf-aig-no-wholesale` header can require provider credentials for a third-party provider request, but it cannot turn off **Require provider credentials** when that gateway setting is on.
@@ -61,6 +61,10 @@ entries:
     general_definition: |-
       A response header returned when a [DLP policy](/ai-gateway/features/dlp/set-up-dlp/#dlp-response-header) matches a request or response. Contains JSON with the action taken (Flag or Block), matched policy IDs, matched profile IDs, and detection entry IDs.
 
+  - term: cf-aig-no-wholesale
+    general_definition: |-
+      Prevents [Unified Billing fallback](/ai-gateway/features/unified-billing/#require-provider-credentials) for a third-party provider request when set to `true`. The request must use provider credentials supplied with the request or stored on the gateway.
+
   # Deprecated headers
   - term: cf-cache-ttl
     general_definition: |-
Original file line number	Diff line number	Diff line change
Expand Up		@@ -24,3 +24,5 @@ Settings in AI Gateway can be configured at two levels: Request and **Gatewa
		Act as the default if no headers are set at the request level.

		This hierarchy ensures consistent behavior, prioritizing the most specific configurations. Use request-level headers for fine-tuned control, and gateway settings for general defaults.

		Some restrictive settings are additive. The `cf-aig-no-wholesale` header can require provider credentials for a third-party provider request, but it cannot turn off Require provider credentials when that gateway setting is on.