AI Spend Is Out of Control. Cloudflare Has a Way to Rein It In.

AI adoption has been a wild scramble. Companies told teams to move fast and worry about the bill later. For many, that bet paid off with genuine transformations. But the invoices are now landing, and finance departments are asking hard questions about runaway token costs and unexplained usage spikes.

Cloudflare is addressing this pain point with new spend controls for its AI Gateway, alongside a closed beta for identity-driven budgets and routing that integrates with Cloudflare Access and your existing identity provider.

The Shared-Key Problem

The typical AI rollout story is familiar: give every engineer access to frontier models via a single shared API key, watch usage explode, and then be unable to explain the monthly bill. Was it a machine learning team training a new pipeline? An intern using a top-tier model for email triage? A CI job that burned millions of tokens overnight? With a shared key, you have no way to know.

Without visibility or budget guardrails, the default behavior is to use the most powerful model available for every task. A code review summary and a complex architecture refactor rarely need the same model, but without a reason to choose differently, developers will gravitate to the biggest, most expensive option. This makes it nearly impossible to calculate a return on AI investment.

Cloudflare AI Gateway sits between your applications and AI providers, offering unified billing across providers, centralized logging, caching, and rate limiting. It also provides features like content guardrails and the ability to block PII and secrets before they reach a model.

The problem: AI Gateway could show aggregate usage for an entire account, but it couldn't attribute specific costs to specific people or teams. It couldn't differentiate between Jane in engineering spending $2,000 on Claude and the entire data science team spending $400. Budgets per team or per role were simply impossible to enforce.

A New Budget System: Limits in Dollars, Not Tokens

AI Gateway now offers spend limits as a core feature. These are true budget controls based on dollar amounts, not token counts. They track cumulative spend across all requests, distinct from traditional rate limiting.

These limits can be scoped to a combination of dimensions, including model, provider, or custom attributes you define, such as user, team, or application. The time windows are flexible; you can set fixed windows that reset on a schedule like the first of the month or a Monday, or use rolling windows. There are options for blocking requests entirely when the budget is hit, or using Dynamic Routes to fall back to a more cost-effective model so a hard cap doesn't kill productivity. Alerts for when limits are reached are on the roadmap.

The feature is available in open beta starting today for all AI Gateway users. You can configure limits via the dashboard or API. Cloudflare recommends starting with a high limit in monitoring mode to understand your current usage patterns before enforcing stricter budgets.

Cloudflare is dogfooding this internally. They already route millions of requests and billions of tokens per month through AI Gateway. By integrating with Cloudflare Access, they attach a user's identity from a JWT to each request, enabling per-user and per-team cost attributions across the organization.

Identity-Driven Budgets and Policies

Spend limits alone rely on your application to pass metadata that AI Gateway trusts. For fully verified, automatic attribution, Cloudflare is announcing a closed beta for identity-driven budgets and policies.

When AI Gateway is combined with Cloudflare Access, it can see not just your account, but the specific employee, IdP group, or service making each request. This enables precise policies based on your existing IdP groups.

The feature supports common scenarios:

  • Per-user budgets: Individual contributors might get $500 a month, while senior engineers get $2,000. Requests can be downgraded to cheaper models or blocked when a user hits their cap.
  • Per-team model policies: You can make certain models available to the rights teams. Your ML team gets access to Claude Opus and GPT-4o, brand design can use image generation tools, and interns default to open-source models on Workers AI. These map directly to your IdP groups.
  • Named service identities for agents: For CI/CD pipelines and autonomous agents, Access service tokens give each bot a named identity. You can isolate a runaway agent and apply a budget policy to it individually without affecting others.

The setup is simple: create a Cloudflare Access application for your AI Gateway endpoint and configure policies. When a developer or agent makes a request, they authenticate via OAuth with a typical CLI device-code flow. AI Gateway validates the token and extracts the identity, meaning you don't have to build custom workers to parse JWTs or rely on honor-system headers.

From Cost Control to Cost Optimization

Setting a budget is the first step; getting the most value for that money is the next. Cloudflare is working on intelligent, task-based routing within AI Gateway to automatically send each request to the model that yields the best result at the lowest cost. This feature is in active development.

Spend limits are available now for all users. To get per-user attribution and team-based policy features, you can request access to the identity-driven budgets closed beta.