Create each key on its own page, paste it below, then copy the finished lines into your project's .env file. What you paste stays in this tab. It is never sent to Wirestack or saved.
Cloudflare Workers AI Account IDCLOUDFLARE_ACCOUNT_IDGet key
Click Use REST API. Your Account ID is shown there
Cloudflare Workers AI API tokenCLOUDFLARE_API_TOKENGet key
Click Use REST API, then Create a Workers AI API Token
On November 3, 2026 Cloudflare made authentication required for new AI Gateways. Every request to a new gateway must carry a valid Cloudflare API token.
Creating a gateway with the API: authentication is on by default. Leave authentication out or set it to true; setting it to false returns HTTP 400.
Existing gateways with authentication off keep working without it. You can turn it on in the gateway's settings, or send { "authentication": true } in a gateway update request.
Once it's on, it stays on. Turning it off afterwards returns HTTP 400, and it can't be turned off in the dashboard either. Leaving authentication out of an update keeps the current setting.
Workers bindings are not affected: requests through Workers bindings stay pre-authenticated.
Prerequisites
A Cloudflare account ID in CLOUDFLARE_ACCOUNT_ID
A Cloudflare API token in CLOUDFLARE_API_TOKEN: for the REST API at api.cloudflare.com it needs the Account > Workers AI > Read permission; for the provider-native endpoints, the gateway's own authentication token (Run permission) works
Steps
Before you create a new gateway, or turn authentication on for an existing one, make sure every HTTP client that calls it sends the token.
With the REST API at api.cloudflare.com, send the token in the standard Authorization header.
With the provider-native endpoints at gateway.ai.cloudflare.com, send it in the cf-aig-authorization header instead. Cloudflare recommends the REST API for new integrations.
In the dashboard, go to your gateway's Settings and select Create authentication token to make a token with the Run permission. Save it right away: it isn't shown again.
Test it
Call the gateway once without the token and once with it. Without it, the request should be refused; with it, you should get the model's answer.
Not confirmed
The changelog doesn't show the exact error code a request without a token gets; the authentication page only calls it a missing-authorization error. Wirestack's Workers AI recipe calls the model through a Workers binding, so it doesn't need changing.
Wirestack