Cloudflare AI Gateway Setup

Cloudflare AI Gateway acts as a proxy in front of provider APIs, offering analytics, caching, and access controls. When using Anthropic, OpenClaw sends requests through your Gateway endpoint via the Anthropic Messages API.

Property	Value
Provider	`cloudflare-ai-gateway`
Plugin	official external package (`@openclaw/cloudflare-ai-gateway-provider`)
Base URL	`https://gateway.ai.cloudflare.com/v1/<account_id>/<gateway_id>/anthropic`
Default model	`cloudflare-ai-gateway/claude-sonnet-4-6`
API key	`CLOUDFLARE_AI_GATEWAY_API_KEY` (your provider API key for requests through the Gateway)

Note

For Anthropic models routed through Cloudflare AI Gateway, use your Anthropic API key as the provider key.

When extended thinking is enabled for Anthropic Messages models, OpenClaw removes any trailing assistant prefill turns before sending the payload through Cloudflare AI Gateway. Anthropic rejects response prefilling combined with extended thinking, but standard non-thinking prefill still works.

Install plugin

Install the official plugin, then restart Gateway:

openclaw plugins install @openclaw/cloudflare-ai-gateway-provider
openclaw gateway restart

Getting started

Set the provider API key and Gateway details

Run onboarding and select the Cloudflare AI Gateway authentication option:

openclaw onboard --auth-choice cloudflare-ai-gateway-api-key

You will be prompted for your account ID, gateway ID, and API key.

Set a default model

Add the model to your OpenClaw configuration:

{
  agents: {
    defaults: {
      model: { primary: "cloudflare-ai-gateway/claude-sonnet-4-6" },
    },
  },
}

Verify the model is available

openclaw models list --provider cloudflare-ai-gateway

Non-interactive example

For scripted or CI environments, pass all values on the command line:

openclaw onboard --non-interactive \
  --mode local \
  --auth-choice cloudflare-ai-gateway-api-key \
  --cloudflare-ai-gateway-account-id "your-account-id" \
  --cloudflare-ai-gateway-gateway-id "your-gateway-id" \
  --cloudflare-ai-gateway-api-key "$CLOUDFLARE_AI_GATEWAY_API_KEY"

Advanced configuration

Authenticated gateways

If you enabled Gateway authentication in Cloudflare, include the cf-aig-authorization header. This is in addition to your provider API key.

{
  models: {
    providers: {
      "cloudflare-ai-gateway": {
        headers: {
          "cf-aig-authorization": "Bearer <cloudflare-ai-gateway-token>",
        },
      },
    },
  },
}

Tip

The cf-aig-authorization header authenticates with the Cloudflare Gateway itself, while the provider API key (for example, your Anthropic key) authenticates with the upstream provider.

Environment note

If the Gateway runs as a daemon (launchd/systemd), ensure CLOUDFLARE_AI_GATEWAY_API_KEY is accessible to that process.

Warning

A key exported only in an interactive shell will not be available to a launchd/systemd daemon unless that environment is imported there as well. Set the key in ~/.openclaw/.env or via env.shellEnv so the gateway process can read it.

Model selection, Choosing providers, model refs, and failover behavior.
Troubleshooting, General troubleshooting and FAQ.