AI Gateway Unified Billing: anthropic/* returns 401 in Cloudflare's own Playground, and openai/* returns 402 "Payment error" on the API-token path while the identical request succeeds via dashboard session

### Summary

On an account with US$50 of Unified Billing credits and **zero** consumption, two distinct failures are reproducible. Both are demonstrated below with a control case that rules out client-side misconfiguration.

**Environment**

- Unified Billing credits: US$50.00 available, US$0.00 ever consumed
- Usage over the last 30 days: 48 requests, 0 tokens, $0.00 cost, 100% error rate across both gateways
- Two gateways, both with Authentication enabled
- **No BYOK provider keys configured for any provider** — Unified Billing is the only credential source on the account
- Account ID available on request

---

### Issue 1 — `anthropic/*` returns 401 inside the Cloudflare Dashboard Playground

In the Dashboard AI Gateway **Playground**, model `anthropic/claude-opus-5`:

```
Error: inferenceChatCompletions returned 401
```

Reproduced three times. On the **same gateway, same endpoint, same session**, `openai/gpt-4.1-mini` returns a normal completion.

Network capture — both requests hit the same URL:

```
POST https://dash.cloudflare.com/api/v4/accounts//ai-gateway/inference//compat/chat/completions

openai/gpt-4.1-mini → 200, normal completion
anthropic/claude-opus-5 → 401
```

The Playground supplies its own authentication. No user-supplied header, API token, or provider key is involved, and BYOK is unconfigured. This isolates the fault to the **Cloudflare-managed Anthropic provider credential** for this account.

---

### Issue 2 — Unified Billing ledger unreachable from API-token authentication

Same gateway, same `/compat/chat/completions` path, three requests:

| # | Model | Auth | Result |
|---|---|---|---|
| A | `openai/definitely-not-a-real-model` | API token via `cf-aig-authorization` | HTTP 500 — `{"error":"Model not found: ...","state":"Failed"}` |
| B | `openai/gpt-4.1-mini` | API token via `cf-aig-authorization` | **HTTP 402 — `{"error":"Model execution failed (Payment error)","state":"Failed"}`** (610 ms) |
| C | `openai/gpt-4.1-mini` | Dashboard session (Playground) | **200 — normal completion** |

**A** shows gateway authentication and routing are healthy: an invalid model is rejected at model resolution, not at auth.

**C** shows the credit ledger is funded and spendable: the same model on the same path completes.

**B** therefore cannot mean "insufficient credits." A byte-identical request to a model that demonstrably works returns a payment error **solely because it was authenticated with an API token rather than a dashboard session**. The token-authenticated path does not appear to resolve the account's Unified Billing ledger.

#### Additional account-level REST control

The documented account-level endpoint was also tested with the Cloudflare API token in `Authorization` and no gateway ID:

```
POST https://api.cloudflare.com/client/v4/accounts//ai/v1/chat/completions

openai/gpt-4.1-mini → HTTP 402, code 2021, "Model execution failed (Payment error)"
openai/definitely-not-a-real-model → HTTP 404, code 7003, "Model not found"
```

This independently confirms that account authentication and model resolution work while execution of a documented valid model fails specifically at the payment stage.

### Questions

1. Is a specific API token permission required to spend Unified Billing credits? If so, it is not documented at https://developers.cloudflare.com/ai-gateway/features/unified-billing/.
2. What causes error 2021 / HTTP 402 on an account with a positive credit balance?
3. Is the Cloudflare-managed Anthropic credential provisioned correctly for accounts of this type?

Two support cases have been open since 2026-07-26 with no engineering response; the Dashboard Support Portal returns `ErrorCode 41 — Cannot locate dashboard account` for this account, so email is the only working channel. Happy to supply account ID, gateway IDs, request IDs, and screenshots privately.

No repository files or tests are identified in the report. Start by reproducing the documented /ai/v1/chat/completions and Dashboard Playground requests, comparing dashboard-session and API-token authentication; done requires an engineering diagnosis and resolution for the 401 and 402 responses, with any required token permissions documented.

Written by the indexing model from the issue text.