Cloudflare Workers AI

Run models that Cloudflare hosts on Workers AI behind your Verdictan gateway. You need your Cloudflare account ID and an API token with Workers AI access.

To reach OpenAI through Cloudflare instead, see Cloudflare AI Gateway.

Before you start

• A working gateway from the quickstart.
• Your Cloudflare account ID, a Cloudflare API token with Workers AI access, and one Workers AI model ID.
• The gateway startup command, and a separate application token for test requests.

Configure the provider

Use exactly provider: cloudflare-ai. The gateway picks the Workers AI adapter only for this alias. With cloudflare_account_id, it builds the base URL https://api.cloudflare.com/client/v4/accounts/<account-id>/ai/v1 for you.

policy-config.yaml

pack:
  name: cloudflare-ai-integration
  version: 1.0.0
  enabled: true
policies:
  chain:
    - prompt-injection
providers:
  targets:
    - id: cloudflare-ai-primary
      provider: cloudflare-ai
      model: "replace-with-workers-ai-model-id"
      cloudflare_account_id: "replace-with-cloudflare-account-id"
      secret_key_ref:
        env: VERDICTAN_CLOUDFLARE_AI_API_KEY

You can set base_url to the full account address instead, starting with https://. The gateway sends the token from VERDICTAN_CLOUDFLARE_AI_API_KEY as a Bearer token. Use the full Workers AI model ID, including its namespace.

Start and verify

For terminal deployment, use CLI 0.1.14 or later with the Workers AI target file. Check In sync. Then test the configured model and Cloudflare account with the request below.

With the quickstart in Docker, follow the container steps instead of steps 1 to 3.

1. In the gateway terminal, set the token and lint the file:

   export VERDICTAN_CLOUDFLARE_AI_API_KEY="<provider-api-key>"
   verdictan policy lint --file policy-config.yaml

2. Restart the test gateway with the Cloudflare token in its environment.

3. Deploy the file to the test agent in Configurations. If that agent already runs pack.version 1.0.0, increase the version first. Then wait for the gateway log line connected read model refresh applied updated config with your version as config_version. Try the change on a test gateway has the steps.

4. In a second terminal, send a request for the configured model:

   export VERDICTAN_CLIENT_TOKEN="<application-token>"
   curl --fail-with-body http://127.0.0.1:41002/v1/chat/completions \
     -H "Authorization: Bearer ${VERDICTAN_CLIENT_TOKEN}" \
     -H "Content-Type: application/json" \
     -d '{"model":"replace-with-workers-ai-model-id","messages":[{"role":"user","content":"Reply with Hello."}]}'

choices[0].message.content contains the reply, and the request appears in History when capture is on, or in the delivered events.

Supported requests

Request	Support
Chat Completions	Yes, on the account's /ai/v1/chat/completions route. Streaming and tools work if the model supports them.
Messages	Translated to Chat Completions
Embeddings	Yes, with an embedding model. The policy chain does not run on embeddings.
Responses, image input, response_format, parallel tool calls	No

Failure behavior

Problem	What to check
401 from the gateway	The application token is active, and the Cloudflare token is set on the gateway host.
Provider authentication error	VERDICTAN_CLOUDFLARE_AI_API_KEY is set and has Workers AI access for this account.
Model not found	The full model ID with its namespace, and the account ID.
capability.unsupported_family	The request uses a family from the table, and provider is exactly cloudflare-ai.
Provider 429 or another upstream error	The response body and your Workers AI limits. See Error Handling.

Limits

• Model names, prices, rate limits, and data terms are in the Cloudflare Workers AI documentation.
• Streaming and tools vary by model. Test each one with your model.
• A listener on a non-loopback address needs TLS and network controls.

Next steps

• Cloudflare AI Gateway: reach OpenAI through Cloudflare.
• Cloud Provider Configuration: the Cloudflare fields.