Skip to main content

Hosts & Gateways

Cloudflare AI Gateway

If you already reach OpenAI through Cloudflare AI Gateway, put Verdictan in front of it. Requests then go from your application to Verdictan, which applies your policies, to Cloudflare AI Gateway, and on to OpenAI.

In this setup, Cloudflare stores the OpenAI key. The Verdictan gateway only holds a Cloudflare gateway token.

Before you start​

  • A working gateway from the quickstart.
  • A Cloudflare AI Gateway, with its account ID and gateway ID.
  • Your OpenAI key stored in Cloudflare with its BYOK option, and a Cloudflare API token allowed to use the gateway. See Cloudflare's OpenAI setup.
  • Access to the text model in your OpenAI account.
  • The gateway startup command, and a separate application token for test requests.

Configure the provider​

base_url is the Cloudflare gateway URL, ending in the /openai provider segment. The Cloudflare OpenAI route has no /v1 segment, so set path_template: /chat/completions.

policy-config.yaml
pack:
  name: cloudflare-gateway-integration
  version: 1.0.0
  enabled: true
policies:
  chain:
    - prompt-injection
providers:
  targets:
    - id: cloudflare-gateway-primary
      provider: cloudflare-gateway
      model: "gpt-4o-mini"
      base_url: https://gateway.ai.cloudflare.com/v1/replace-with-account-id/replace-with-gateway-id/openai
      path_template: /chat/completions
      secret_key_ref:
        env: VERDICTAN_CLOUDFLARE_GATEWAY_TOKEN

Verdictan sends the Cloudflare gateway token from VERDICTAN_CLOUDFLARE_GATEWAY_TOKEN as a Bearer credential, and Cloudflare adds the stored OpenAI key for the upstream call. When Cloudflare stores the key, the token is required.

Start and verify​

You can deploy the Cloudflare target through its agent with CLI 0.1.14 or later. Keep the Cloudflare token in the gateway environment. After In sync, send the model request below.

With the quickstart in Docker, follow the container steps instead of steps 1 to 3.

  1. In the gateway terminal, set the token and lint the file:

    export VERDICTAN_CLOUDFLARE_GATEWAY_TOKEN="<cloudflare-gateway-token>"
verdictan policy lint --file policy-config.yaml

  2. Restart the test gateway with the Cloudflare token in its environment.

  3. Deploy the file to the test agent in Configurations. If that agent already runs pack.version 1.0.0, increase the version first. Then wait for the gateway log line connected read model refresh applied updated config with your version as config_version. Try the change on a test gateway has the steps.

  4. In a second terminal, send a request for the configured model:

    export VERDICTAN_CLIENT_TOKEN="<application-token>"
curl --fail-with-body http://127.0.0.1:41002/v1/chat/completions \
  -H "Authorization: Bearer ${VERDICTAN_CLIENT_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"Reply with Hello."}]}'

choices[0].message.content contains the reply. The request appears in History when capture is on, or in the delivered events, and also in the Cloudflare AI Gateway logs.

Supported requests​

RequestSupport
Chat CompletionsYes, sent to /chat/completions. Streaming and tools work if the model supports them.
MessagesTranslated to Chat Completions
Responses, embeddings, image input, response_format, parallel tool callsNo

This is not a general proxy for every Cloudflare AI Gateway route. Cloudflare can offer features that this adapter does not.

Failure behavior​

ProblemWhat to check
401 from the gatewayThe application token is active, and the Cloudflare token is set on the gateway host.
401 or 403 from CloudflareThe Cloudflare token can use this gateway, and the OpenAI key is stored in Cloudflare.
404 from CloudflareThe account ID, gateway ID, /openai segment, and path_template: /chat/completions.
Model not foundThe request model matches the target, and your OpenAI account can use it.
Provider 429 or another upstream errorThe response body, Cloudflare limits, and OpenAI quota. See Error Handling.

Limits​

  • Route URLs, stored-key options, and data terms are in the Cloudflare AI Gateway OpenAI documentation. Model names and prices are in the OpenAI documentation.
  • Cloudflare adds its own logging and caching to the path. Verdictan does not read or change them.
  • A listener on a non-loopback address needs TLS and network controls.

Next steps​