Quick answer
Add gateway ID default to an authenticated Workers AI binding or REST request. Cloudflare says AI Gateway will create that gateway on the first request and begin providing traffic visibility without prior dashboard setup.
Before sending sensitive traffic, review logging and data governance. The announcement says exact prompts and responses can appear in the dashboard. Observability is valuable, but payload capture can expose personal, confidential, regulated, or secret material if access and retention are not controlled.
Binding and REST choices
For a Workers binding, pass the gateway configuration as the third argument to env.AI.run():
const result = await env.AI.run(model, input, {
gateway: { id: "default" },
});For the unified REST path, authenticate with Cloudflare and set cf-aig-gateway-id: default. Confirm the exact current endpoint for the model and modality; the shared API includes universal and SDK-compatible shapes.
Do not copy example account IDs, tokens, model names, or payloads into production. Use a least-privilege API token and keep it outside source, prompts, client-side code, and ordinary logs.
Observability baseline
Validate that the dashboard and exports attribute request count, errors, latency, token usage, and costs to the expected gateway, model, provider, environment, and owner. Decide whether payload logging is allowed, redacted, sampled, or disabled for each data class.
Define access review, retention, deletion, export, incident, and legal hold procedures. Treat prompt and response logs as potentially sensitive application data rather than generic infrastructure telemetry.
Default versus named gateways
The default gateway is suitable for evaluation or a deliberately shared boundary. Create named gateways when applications need different cache rules, retries, rate limits, budgets, providers, logging, retention, identities, or incident owners.
Test that a request cannot select an unauthorized gateway, evade an application budget, poison a shared cache, or leak metadata between workloads. Verify cache keys and retries for nondeterministic or state-changing model/tool workflows.
Use the unified control-plane guide for architecture, billing guide for credits and limits, and readiness checker before rollout.
Frequently asked questions
When is Cloudflare’s default AI Gateway created?
Cloudflare says the default gateway is created automatically on the first authenticated request that specifies default as the gateway ID.
What can AI Gateway observability show?
Cloudflare documents request volume, errors, latency, token usage, costs, and—when logging is configured—request and response payloads.
Should every application share the default gateway?
Not necessarily. Named gateways can separate applications or workloads when ownership, logging, caching, rate, budget, data, or incident boundaries differ.
Official sources
Source check: August 12, 2026. Recheck authentication, gateway creation, logging, analytics, retention, caching, retries, and access behavior.