Cloudflare AI Gateway Provider Setup

Cloudflare AI Gateway acts as a layer between provider APIs and your application, offering caching, analytics, and governance features. When working with Anthropic, OpenClaw routes the Anthropic Messages API through your Gateway endpoint.

Property	Value
Provider	`cloudflare-ai-gateway`
Plugin	official external package (`@openclaw/cloudflare-ai-gateway-provider`)
Base URL	`https://gateway.ai.cloudflare.com/v1/<account_id>/<gateway_id>/anthropic`
Default model	`cloudflare-ai-gateway/claude-sonnet-4-6`
API key	`CLOUDFLARE_AI_GATEWAY_API_KEY` (your provider API key for requests through the Gateway)

Note

When routing Anthropic models via Cloudflare AI Gateway, the provider key must be your Anthropic API key.

For Anthropic Messages models with thinking enabled, OpenClaw removes any trailing assistant prefill turns prior to forwarding the request to Cloudflare AI Gateway. Response prefilling combined with extended thinking is rejected by Anthropic, though standard prefill without thinking remains supported.

Install plugin

Start by installing the official plugin, then restart Gateway:

openclaw plugins install @openclaw/cloudflare-ai-gateway-provider
openclaw gateway restart

Getting started

Set the provider API key and Gateway details

Launch onboarding and pick the Cloudflare AI Gateway authentication option:

openclaw onboard --auth-choice cloudflare-ai-gateway-api-key

You will be asked for your account ID, gateway ID, and API key.

Set a default model

Add the model to your OpenClaw configuration:

{
  agents: {
    defaults: {
      model: { primary: "cloudflare-ai-gateway/claude-sonnet-4-6" },
    },
  },
}

Verify the model is available

openclaw models list --provider cloudflare-ai-gateway

Non-interactive example

For automated or CI workflows, supply every value through the command line:

openclaw onboard --non-interactive --accept-risk --skip-health \
  --mode local \
  --auth-choice cloudflare-ai-gateway-api-key \
  --cloudflare-ai-gateway-account-id "your-account-id" \
  --cloudflare-ai-gateway-gateway-id "your-gateway-id" \
  --cloudflare-ai-gateway-api-key "$CLOUDFLARE_AI_GATEWAY_API_KEY"

Advanced configuration

Authenticated gateways

If Gateway authentication is turned on in Cloudflare, include the cf-aig-authorization header. This comes on top of your provider API key.

{
  models: {
    providers: {
      "cloudflare-ai-gateway": {
        headers: {
          "cf-aig-authorization": "Bearer <cloudflare-ai-gateway-token>",
        },
      },
    },
  },
}

Tip

The cf-aig-authorization header handles authentication with Cloudflare Gateway itself, whereas the provider API key (such as your Anthropic key) takes care of authenticating with the upstream provider.

Environment note

When Gateway operates as a daemon (launchd/systemd), confirm that CLOUDFLARE_AI_GATEWAY_API_KEY is accessible to that process.

Warning

An API key set only in an interactive shell will not be available to a launchd/systemd daemon unless that environment is also imported there. Put the key in ~/.openclaw/.env or use env.shellEnv so the gateway process can access it.

Model selection, How to pick providers, model references, and failover settings.
Troubleshooting, Common issues and answers.