Summary
On September 14, 2026, Cloudflare AI Gateway added a byok_only setting that forces third-party provider requests to carry a team's own credentials and prevents fallback to Cloudflare's Unified Billing keys. Requests without applicable credentials return HTTP 400; Workers AI requests are unaffected.
What changed
AI Gateway can now require bring-your-own-key credentials for third-party providers via byok_only (set true in a PUT to the gateway, or per-request with the cf-aig-no-wholesale header). Requests lacking credentials return HTTP 400; Workers AI billing is unchanged.
Why it matters
Enterprises routing LLM traffic through a gateway need certainty about which billing account and contract governs each call. byok_only removes silent fallback, giving finance and security teams deterministic control over spend attribution and vendor data-processing terms.
Evidence excerpt
Requests without applicable credentials then return an HTTP 400 response. Workers AI requests remain allowed, and the setting does not change their configured billing mode.