If you are here because of the binding: the things that make Cloudflare AI Gateway good — an endpoint that lives at gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}, a cache you steer per-request with cf-aig-* headers, Workers AI one env.AI.run() away — are the same things that make it hard to take with you when half your inference moves off the Cloudflare edge. This post is about that specific trade, with Cloudflare's own numbers, and about what a host-neutral gateway gives up in exchange.

Cloudflare AI Gateway is not a thin product. It ships caching, rate limiting, logging, dynamic routing with retries and model fallbacks, cost analytics, and Guardrails that inspect prompts and responses inline and either log or block (developers.cloudflare.com/ai-gateway, checked 2026-08-23). If you are shipping every inference call from a Worker, it is a defensible default and this post will tell you so twice.

The reason people search for an alternative anyway is narrower than "Cloudflare bad." It is three specific pieces of Cloudflare's design, each of them a deliberate choice on their side, each of them a cost on yours.

Why teams search for a Cloudflare AI Gateway alternative

1. Your account id and gateway id are path segments. The Universal Endpoint is https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id} (Universal Endpoint docs, checked 2026-08-23). That is a reasonable REST shape and it has a consequence: "which gateway am I talking to" is a URL fact, resolved at deploy time, not a credential fact resolved at auth time. Separating staging from production, or one customer's traffic from another's, means minting more gateways and threading more URLs through your config. Gateways are capped at 10 per account on Free and 20 per account on Paid (limits, checked 2026-08-23). Twenty is plenty for environments. It is not plenty if your instinct was one gateway per tenant.

2. The managed-credential path costs 5% and is capped at 200 requests per 60 seconds. Cloudflare's Unified Billing lets you stop holding provider keys: you buy prepaid credits, Cloudflare pays the providers, and you get one bill. The fee is 5% on the credit purchase — a $100 credit purchase is charged as $105 — with provider inference passing through at standard per-token rates (Unified Billing, checked 2026-08-23). The published limit for that path is 200 requests per 60 seconds per gateway, and Cloudflare states plainly that it does not apply to bring-your-own-keys (limits, checked 2026-08-23). So the escape hatch from the throughput ceiling is to go back to holding provider credentials yourself — the exact chore Unified Billing existed to remove. Credential precedence is documented as request-supplied keys first, then stored BYOK, then Unified Billing.

3. Observability is a log pool with hard ceilings, and one of them is five. Free accounts store 100,000 logs per account across all gateways; Paid stores 10 million per gateway. Individual logs cap at 10 MB, ingestion at 500 logs per second per gateway, cached responses at 25 MB per request, and custom metadata at 5 entries per request (limits, checked 2026-08-23). Ten million is a generous number. Five is not: tenant, environment, feature, end-user, and request source is already five tags, and per-customer cost attribution usually wants more than that before it wants anything else. When the pool fills you choose between deleting the oldest logs and refusing to save new ones — both are lossy in the direction of the data you were keeping logs for.

None of the three is a bug. They are what it looks like when a gateway is a feature of an edge platform rather than a product with its own tenancy model.

Side-by-side, on the axes that differ

Rows below are the ones where the two products make genuinely different choices. Every Cloudflare and Vercel cell links to that vendor's own docs and was checked on the date in ## Sources; where a vendor does not publish a number, this table says so rather than guessing.

Axis	Cloudflare AI Gateway	Vercel AI Gateway	nRouter
Endpoint shape	Account + gateway id in the path: `gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}`	`https://ai-gateway.vercel.sh/v1`	`https://api.nrouter.ai/v1` — tenancy resolved from the key, not the URL
Fee on managed spend	5% on credit purchase ($100 → $105)	No markup on tokens	a flat 4% of the credits on pay as you go ($100 → $104.00), 0% on Pro
Throughput on managed credentials	200 requests / 60s per gateway (BYOK exempt)	Not published as a single figure	Per-plan rate limits, published on /pricing
Provider keys	BYOK, or Unified Billing credits	BYOK on the paid tier, or system credentials	No BYOK — nRouter holds them (why)
Log ceiling	100k/account (Free), 10M/gateway (Paid); 500 logs/s	Not published as a single figure	Usage and spend per key and per team, no purchased log tier
Custom metadata	5 entries per request	Not published as a single figure	Per-team and per-key attribution as first-class scopes
Response cache control	`cf-aig-cache-ttl`, `cf-aig-skip-cache`, `cf-aig-cache-key`, status via `cf-aig-cache-status`	Provider prompt caching via provider options (Anthropic's version, checked 2026-08-23)	Not header-steerable per request
Guardrails	✅ inline prompt + response inspection, log or block	Model allowlist on Pro and Enterprise	✅ included on every plan
Evals, A/B tests, prompt management	Verify on Cloudflare's docs	Verify on Vercel's docs	✅ included on every plan
First-party models at the edge	✅ Workers AI	—	—

Cloudflare, Cloudflare AI Gateway, Workers, and Workers AI are trademarks of Cloudflare, Inc.; Vercel and Vercel AI Gateway are trademarks of Vercel Inc. nRouter is not affiliated with or endorsed by either. All claims above are sourced from their public pricing or documentation on the dates linked in ## Sources; if any have changed, email hello@nrouter.ai and we will update.

The cache is the interesting part, and it is exact-match

Cloudflare's cache is the feature most worth understanding before you decide, because it is both the strongest argument for staying and the one most likely to under-deliver against the number in your spreadsheet.

You control it per request. cf-aig-cache-ttl sets a duration, bounded at 60 seconds minimum and one month maximum. cf-aig-skip-cache forces a fresh call. cf-aig-cache-key overrides the default key. Responses carry cf-aig-cache-status: HIT or MISS (caching docs, checked 2026-08-23). That is a genuinely good API — it puts the decision at the call site, where the developer knows whether this particular completion is worth reusing.

The default key is a hash of the provider, the endpoint, the model, the provider Authorization header, and the full request body. Cloudflare describes it as exact-match: any variation in the body is a separate entry. Three things follow, and they are worth checking against your actual traffic before you model a hit rate:

A timestamp, a request id, or a shuffled RAG context in the prompt is a cache miss, every time. Most production prompts are templated with per-request data. The share of your traffic that is byte-identical to an earlier request is usually much smaller than the share that is semantically identical, and Cloudflare's own docs list semantic search as a future enhancement rather than current behaviour.
The key includes the provider auth header. That is correct for isolation — one credential's completions cannot be served to another — and it also means rotating a provider key cold-starts the cache, and that a BYOK fleet with a key per tenant gets a cache per tenant rather than a shared one.
Two identical requests in flight at once can both miss. Cloudflare documents exactly this: the first may not have cached in time for the second. Cache-stampede-shaped traffic — a deploy, a cron fan-out, a viral page — is the traffic where you most wanted the cache.

nRouter does not expose a per-request cache-control header, and this is a real gap rather than a design flourish: if cf-aig-cache-ttl at the call site is load-bearing for your cost model, that is a point for Cloudflare and you should weigh it as one. What nRouter does instead is put the money controls one layer up — budgets and rate limits scoped to an organisation, a team, and an individual key, applied before the provider call rather than after — so the guarantee is about spend, not about hit rate.

Where Cloudflare AI Gateway is genuinely better

Four things, and they are not throat-clearing.

Workers AI co-location. If your inference is a Cloudflare-hosted model invoked as env.AI.run(...) from inside a Worker, the gateway sits in the same request lifecycle as the compute. No network hop leaves Cloudflare. nRouter cannot match that and does not claim to — the call has to reach api.nrouter.ai to be governed.

Provider breadth on the managed path. Unified Billing covers OpenAI, Anthropic, Google AI Studio, Google Vertex AI, xAI, and Groq. nRouter's live catalog is Anthropic, OpenAI, Azure AI Foundry, and AWS Bedrock — no Google model is served, and no xAI or Groq model is served. If your shortlist has a Gemini or a Grok model on it, that is disqualifying today and you should stop reading here. The current list is at /models; the honest version of "one API key for every provider" is "one API key for the providers in the live catalog," which is what this post says everywhere else.

Per-request cache control. Covered above. Header-level TTL and key override is more granular than anything nRouter exposes.

Ten million logs per gateway, and the platform around them. On the paid tier, log volume is large and it sits next to the rest of Cloudflare — WAF, DDoS, R2, Vectorize, AutoRAG. If your security and your storage already live there, so does your incident review, and one dashboard is worth real money in a postmortem.

Pricing: the one number that matters here

Against Cloudflare the number is the fee on managed spend: Cloudflare's Unified Billing adds 5% on credit purchases; nRouter's platform fee is a flat 4% of the credits on pay as you go and 0% on Pro, added on top at purchase so the credits land in full — a $100 load is charged $104.00, a $4.00 fee against Cloudflare's $5 on the same $100. The full plan table, the rate limits, and the breakeven arithmetic live on /pricing — one page, kept current, rather than a copy in each comparison post that drifts.

Two caveats so the comparison stays honest. First, Cloudflare's 5% buys you a platform you may already be paying for, so the marginal cost of the gateway on an existing Cloudflare account is not the whole 5%. Second, if you run Cloudflare with BYOK instead of Unified Billing, the fee is not the axis at all — the axes are the 200-requests-per-60-seconds exemption, the key management you keep, and the log ceiling.

Signup here is not free and there is no trial: a card is required, the minimum credit purchase is $5, and the platform fee is charged on top.

Switch cost: one base URL, one API key

If you call Cloudflare through a provider-specific path or the Universal Endpoint with an OpenAI-compatible client — the OpenAI Node SDK below, or any other client speaking the same Chat Completions contract (both checked 2026-08-23) — the change is two lines:

  // your existing code, OpenAI SDK or any OpenAI-compatible client
  const client = new OpenAI({
-   baseURL: 'https://gateway.ai.cloudflare.com/v1/<account-id>/<gateway-id>/openai',
-   apiKey: process.env.CF_AI_GATEWAY_API_KEY,
+   baseURL: 'https://api.nrouter.ai/v1',
+   apiKey: process.env.NROUTER_API_KEY,
  });

Model strings, message arrays, tool-call structures and streaming consumers do not change. The account id and gateway id leave the URL entirely — with nRouter the tenant is resolved from the key, which is why a key rotation, an environment split, or a per-customer key does not touch a base URL anywhere in your config.

If you call Workers AI through the Cloudflare binding rather than over HTTP, this is a larger change: env.AI.run(...) becomes a fetch or an OpenAI-SDK call, and the Cloudflare-hosted model on the other side has no equivalent in nRouter's catalog. That is a rewrite of the call site, not a config swap, and it is the honest reason a Workers-AI-native team should not do this migration.

Migrating your Cloudflare-specific config

Maps cleanly. The Universal Endpoint's fallback array — a list of provider objects tried in order — becomes a routing configuration rather than a payload your client assembles per request. Rate limits become per-key limits. Cost analytics become per-key and per-team spend.

Maps differently. Cloudflare's Universal Endpoint expects each element of that array to carry its own Authorization header, so today your client is holding provider credentials and choosing the fallback order at call time. nRouter has no BYOK: the provider credentials are ours to hold and rotate, and the client sends one sk-nrouter-… key. That is a deliberate trade with real downsides — you cannot spend provider-granted credits through us, and you cannot point us at a private deployment of your own — and the reasoning is in why nRouter does not do BYOK.

Has no equivalent. cf-aig-cache-ttl, cf-aig-skip-cache, cf-aig-cache-key and cf-aig-cache-status have no counterpart; there is no per-request cache-control header to port them to. Workers AI models have no counterpart in the catalog. Custom metadata does not port one-for-one either, though the five-entry ceiling means most teams are porting fewer tags than they wish they had.

One thing to check on the way out. nRouter reports an unknown cost as unpriced and omits the x-nr-request-cost header entirely rather than sending a zero. If you have dashboards that sum a cost field and treat a missing value as 0, they will silently under-report instead of showing you a gap. Read the paired x-nr-cost-status header and treat unpriced as unknown, not as free.

Why every feature on every plan is sustainable

Short version: the platform fee is not where the margin is meant to come from, so there is no commercial reason to put guardrails or budgets behind an upgrade. The long version — what funds it, what we are betting on, and what would have to change for the position to break — is one post, written once: Every Feature on Every Plan: We Charge a Fee, Not a Gate.

When nRouter is the right choice

Pick nRouter over Cloudflare AI Gateway if two or more of these are true:

Inference originates from more than one place — Workers and Lambda, Cloud Run, Fly, a Kubernetes pod, a laptop — and you want one governance plane over all of it rather than one per host.
You want to stop holding provider credentials entirely, and the 200 requests / 60 seconds ceiling on Cloudflare's managed path is below where your traffic is heading.
Your cost attribution needs more than five metadata entries per request, or needs budgets that refuse a call rather than dashboards that report one.
You need guardrails, evals, A/B tests, prompt management and per-team budgets now, on the cheapest plan, without a Cloudflare account-plan conversation.
Your shortlist is Anthropic, OpenAI, Azure AI Foundry and Bedrock models, which is what the live catalog serves.

When to stay on Cloudflare AI Gateway

Stay if any of these is true. These are disqualifying, not close calls:

A Gemini, Vertex, xAI or Groq model is on your shortlist. nRouter serves none of them.
Your inference is Workers AI invoked through the binding. The migration is a call-site rewrite with no model on the other side.
cf-aig-cache-ttl at the call site is doing real work in your cost model and your traffic is genuinely byte-repetitive.
You are already paying for Cloudflare's platform, your LLM spend is small enough that 5% of it is noise, and the gateway is one more thing on a bill you already reconcile.
You want ten million logs per gateway retained next to your WAF and DDoS events, in one incident-review surface.

For everyone else — multi-host teams, teams whose attribution needs outgrew five tags, teams who would rather never hold an OpenAI key again — the switch is the two lines above.

Try it

Pay as you go starts at $5. Load the $5 minimum, with the platform fee on top and no subscription. That is enough to wire a guardrail, set a team budget low enough to watch it refuse a call, and run an A/B test across two models before you decide anything.

→ Get started at app.nrouter.ai/signup

Weighing pay as you go against Pro? Bring your current Cloudflare bill and your Workers AI usage report to a 30-minute call and we will do the breakeven math live. Questions go to the public nRouter Slack — #support for migration, #feature-requests if there is a Cloudflare capability you want us to match.

Sources

Every Cloudflare and Vercel claim above is sourced from that vendor's own public documentation and was checked on 2026-08-23. If a vendor has changed a number since, email hello@nrouter.ai and we will re-audit within one business day.

Cloudflare AI Gateway overview, checked 2026-08-23: developers.cloudflare.com/ai-gateway
Cloudflare AI Gateway Universal Endpoint, checked 2026-08-23: developers.cloudflare.com/ai-gateway/usage/universal
Cloudflare AI Gateway limits (gateways per account, log ceilings, 500 logs/s, 25 MB cache, 5 metadata entries, 200 req/60s on managed credentials), checked 2026-08-23: developers.cloudflare.com/ai-gateway/reference/limits
Cloudflare AI Gateway Unified Billing (5% credit fee, provider coverage, credential precedence), checked 2026-08-23: developers.cloudflare.com/ai-gateway/features/unified-billing
Cloudflare AI Gateway caching (cf-aig-cache-ttl, cf-aig-skip-cache, cf-aig-cache-key, cf-aig-cache-status, exact-match keying), checked 2026-08-23: developers.cloudflare.com/ai-gateway/features/caching
Cloudflare AI Gateway Guardrails, checked 2026-08-23: developers.cloudflare.com/ai-gateway/features/guardrails
Cloudflare Workers AI pricing, checked 2026-08-23: developers.cloudflare.com/workers-ai/platform/pricing
Vercel AI Gateway docs (no token markup, BYOK), checked 2026-08-23: vercel.com/docs/ai-gateway
OpenAI Chat Completions reference — the contract both gateways serve, and the reason the switch is a base-URL edit rather than a rewrite, checked 2026-08-23: platform.openai.com
OpenAI Node SDK — the client in the diff above, and its baseURL option, checked 2026-08-23: github.com/openai/openai-node
Anthropic prompt caching — the provider-side caching the Vercel column refers to, which is a different mechanism from a gateway response cache, checked 2026-08-23: docs.anthropic.com
nRouter pricing: /pricing · nRouter live catalog: /models

Cloudflare AI Gateway alternative: a managed LLM gateway that isn't tied to one cloud edge