App AI Gateway
One secure edge between your applications and every model provider.
Ship AI features without shipping provider keys.
App AI Gateway is a multi-tenant, provider-native proxy for iOS applications and trusted server backends. It authenticates users, enforces request and spending limits, and streams model responses through Cloudflare AI Gateway.
Choose your path
Deploy the gateway
Provision the Worker, D1 database, Durable Object, migrations, and console.
Configure an application
Create a server API-key tenant or an Apple App Attest tenant.
Integrate authentication
Understand issuer tokens, App Attest, development credentials, and server keys.
Explore the API
Browse the generated OpenAPI reference and request shapes.
What the gateway owns
- Provider credentials remain in Cloudflare AI Gateway BYOK/Secrets Store.
- D1 stores tenant configuration, users, credentials, and usage events.
- A Durable Object serializes per-user and optional per-application limits.
- Provider-native bodies and streaming response formats remain intact.
- The administration console and API configure the deployed instance.
What your application owns
Your application supplies its identity policy, allowed provider paths and models, and request or spending limits. An issuer such as Firebase decides who may obtain a mobile gateway token. Trusted servers can use a long-lived per-application API key instead.