Cloudflare AI Gateway now requires authentication for new gateways
New AI Gateways created through the API are authenticated by default, and the setting cannot be switched back off once it is on. Existing gateways are left alone unless you opt in.
Cloudflare changed the default for its AI Gateway on 3 November: any new gateway created through the API now requires authentication, so it can no longer be reached by an unauthenticated request. Once authentication is switched on for a gateway, there is no way to turn it back off, through the dashboard or the API.
Creating a gateway without specifying the authentication field, or setting it to true, both work as before. Setting it to false now returns an HTTP 400. Existing gateways that were created without authentication keep working exactly as they do now, unless you choose to turn it on yourself. Requests sent through a Workers binding were already authenticated and are unaffected either way.
If you do turn authentication on for a gateway you already run, Cloudflare’s advice is to update your HTTP clients to send a valid Cloudflare API token first, otherwise those requests start failing the moment the switch flips.
Why it matters: anyone scripting gateway creation, in Terraform, a deploy pipeline or a setup script, should check whether it assumes authentication: false is a valid option. That assumption now fails outright, and it fails one way only, since the setting can’t be reversed once applied.