cloudflare / cloudflare/ai

AI Gateway REST: /ai/v1/responses rejects Unified Billing on an authenticated gateway

Open
#548 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
1.2k
Forks
345
Avg merge
13h 31m
Merged PRs (30d)
1

Description

POST to `/ai/v1/responses` with Unified Billing auth (`Authorization: Bearer {CF_API_TOKEN}` plus `cf-aig-gateway-id: {authenticated_gateway_id}`) returns HTTP 402 even though the gateway has `authentication: true`. The identical headers and model on `/ai/v1/chat/completions` work.

Reproduced on every OpenAI 5.x model reachable through Unified Billing on this account: `openai/gpt-5.4`, `openai/gpt-5.4-mini`, `openai/gpt-5.5`.

### Environment

- Endpoint: `POST /ai/v1/responses`
- Comparison endpoint: `POST /ai/v1/chat/completions` (works with the same auth)
- Gateway: `authentication: true` (verified via `GET /ai-gateway/gateways/{GW}` → `"authentication": true`)
- Models tested: `openai/gpt-5.4`, `openai/gpt-5.4-mini`, `openai/gpt-5.5`
- Auth: `Authorization: Bearer {CF_API_TOKEN}` + `cf-aig-gateway-id: {GW}`

### Steps to reproduce

```bash
# Fails: HTTP 402
curl -X POST "https://api.cloudflare.com/client/v4/accounts/${ACCT}/ai/v1/responses" \
-H "Authorization: Bearer ${CF_API_TOKEN}" \
-H "cf-aig-gateway-id: ${CF_GATEWAY_ID}" \
-H "content-type: application/json" \
-d '{"model":"openai/gpt-5.4-mini","input":"reply ok","max_output_tokens":16}'

# Succeeds on the same gateway, same model, same auth: HTTP 200
curl -X POST "https://api.cloudflare.com/client/v4/accounts/${ACCT}/ai/v1/chat/completions" \
-H "Authorization: Bearer ${CF_API_TOKEN}" \
-H "cf-aig-gateway-id: ${CF_GATEWAY_ID}" \
-H "content-type: application/json" \
-d '{"model":"openai/gpt-5.4-mini","messages":[{"role":"user","content":"reply ok"}],"max_completion_tokens":16}'
```

### Expected

Both endpoints accept the same Unified Billing auth on the same authenticated gateway.

### Actual

```
HTTP 402
{"error":{"code":"invalid_prompt","message":"Gateway authentication is required to use unified billing. Enable authentication on your gateway or provide your own API key (BYOK)."}}
```

Identical error on all three models. The gateway IS authenticated.

### Suggested fix

Make `/ai/v1/responses` accept the same Unified Billing auth that `/ai/v1/chat/completions` accepts.

### Related

- #399: Older report of Responses API issues, but on the deprecated `/compat/` path and Azure-specific. This issue is on the new REST endpoint at `api.cloudflare.com/.../ai/v1/responses` with `openai/*` models on Unified Billing.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.