An application can call an AI model directly, but a successful answer does not tell you how the request was authorized, whether it was cached or limited, or which route handled a failure. Cloudflare AI Gateway is a named checkpoint between the application and its upstream model. It gives several model requests one observable place for access control, logs and traffic policy.
This course adds that checkpoint to small Workers AI applications one idea at a time. You will first route a request, then investigate failures, reuse safe repeat responses, apply request and spending controls, and build a bounded model fallback. Short explanations appear beside each operation, so no previous gateway or AI-operations experience is assumed.
The course contains 5 guided labs and 1 independent gateway-bypass challenge. Guided Labs introduce each capability before the independent challenge.
What You Will Learn
- Route Inference Through a Gateway: create an authenticated gateway and distinguish gateway access from upstream model authorization.
- Trace a Failed Model Request: attach nonsecret metadata and use logs to separate input, gateway and upstream failures.
- Cache Repeat Inference Requests: observe an exact cache miss and hit, then bypass reuse when fresh output matters.
- Control Request and Spending Limits: prove a small request limit and read back a scoped cost policy without exhausting a budget.
- Recover with a Model Fallback: recover from one controlled primary failure while keeping the fallback chain finite.
- Hidden Gateway Bypass: independently repair a Worker whose direct model call avoids the intended gateway policy.
Who This Course Is For
Developers who have called Workers AI and want to observe and control model requests.
Prerequisites: Complete Cloudflare Workers AI for Beginners and Connect LabEx to Your Cloudflare Account. You should recognize a JavaScript Worker, a Workers AI binding and a small model request; the course introduces the gateway concepts from the beginning.
Learning environment: Use your own dedicated Cloudflare learning account. Every unit starts in a fresh VM, creates uniquely named disposable resources and finishes by deleting them and logging out. The exercises use Cloudflare-hosted models and a very small number of requests within Workers Free; they do not require Workers Paid or an external AI provider account.
Frequently Asked Questions
Do I need an external AI provider account?
No. The exercises use Cloudflare-hosted models and a small number of requests. They do not require Workers Paid or an external provider account.
Is gateway authentication the same as model authorization?
No. You test gateway access separately from upstream model access, then use nonsecret metadata and logs to distinguish input, gateway and upstream failures.
Will I exhaust a budget to test a spending policy?
No. You prove a small request limit and read back the scoped cost policy. That is different from establishing that a spending limit has been reached.
What does the final challenge assess?
Repair a Worker that calls the model directly and bypasses the intended gateway policy. Keep recovery bounded and remove only the resources created for the exercise.
