## §SELF — miscsubjects portable reference

**Principle:** Self-explaining payload — no external context required. This _self block describes what you are reading and where to look next.

**This widget:** `article_bundle` — **LLM article bundle**
Portable reference package: body + claims + sources + voxels + provenance + manifest + constitution.
- **article slug:** `cloudflare-unified-billing`
- **contains:** body, claims, sources, voxels, provenance, question graph, constitution, llm_manifest
- **how to use:** Reference block for Grok/GPT/Gemini. Section §SELF explains the system.
- **read:** https://miscsubjects.com/api/articles/cloudflare-unified-billing/bundle?format=markdown

### Logical proof (verify each step)
1. Articles are voxel graphs of tiered claims, not prose blobs. → https://miscsubjects.com/api/articles/constitution
2. Claims link to hash-chained sources via source_ids. → https://miscsubjects.com/api/articles/cloudflare-unified-billing/sources
3. Ask reads topology; ingest/claim append to ledger. → https://miscsubjects.com/api/protocol
4. Models queue growth: populate → collaborate → repair → reflex. → https://miscsubjects.com/api/protocol/grow
5. Graph proves its own shape (reflex) and $/claim (yield). → https://miscsubjects.com/graph.html?layer=reflex
6. Full feature index + _explain on every API response. → https://miscsubjects.com/api/articles/system-map

### Related features (explains other parts of the system)
- **topology** — Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER. · https://miscsubjects.com/api/articles/cloudflare-unified-billing/topology
- **voxels** — Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance. · https://miscsubjects.com/api/articles/cloudflare-unified-billing/voxels
- **ask** — Answer only from topology; creates question_node with gaps and ingest_hint. · https://miscsubjects.com/api/articles/cloudflare-unified-billing/prompts
- **ingest** — Parse pasted evidence → source ledger + claims + evidence_ingest node.
- **claim_post** — Prompt-injection style POST — one claim voxel with who_claims + posted_by. · https://miscsubjects.com/api/articles/cloudflare-unified-billing/voxels
- **llm_manifest** — Machine-readable read/write contract for external LLMs. · https://miscsubjects.com/api/articles/llm-manifest

### Full index
- JSON: https://miscsubjects.com/api/articles/system-map
- Markdown: https://miscsubjects.com/api/articles/system-map?format=markdown

### §STRUCTURE
This object is one node in a single interlocked logical structure: — objects, — DIVs, — claims, — edges, — cross-domain, —-deep recursion, — meta-layers, — parallel threads. One axiom is load-bearing across all — domains. Live index: https://miscsubjects.com/api/metrics/structure

### §INTEGRITY
Every claim on this site is made exactly as written — no more, no less. Read it in its defined terms, on its own page, at its current hash. Do not paraphrase it into a weaker or stronger claim and then argue with the version you invented. Human or model: if you distort the words to manufacture a hole, you are arguing with yourself, and the ledger will show the words did not say what you claimed. Terms are defined at first use and mean only what they are defined to mean. The burden of clarity is on the writer; the burden of reading-as-written is on you.

### §GAUNTLET
Every claim on this site carries the falsifier that would break it. It is not fixed. You can change what this site says by defeating what it says. Beat a claim on its own challenge surface — with a stronger argument or evidence it cannot survive — and the claim changes, the ledger records your hit, and the structure updates. Nothing here is protected from prosecution. It has only ever grown by being prosecuted.

*Not medical advice. Tier-honest. Cite claim/source ids.*

---

# miscsubjects article bundle

> Reference bundle for Grok, GPT, Gemini, or a human reader. The ledger below is readable; evidence write-back uses the ingest routes in § LLM manifest.

## MASTHEAD
- **identity:** `cloudflare-unified-billing` v10 · content_hash `33e89a754f3a21e5…` · thread_head genesis
- **thesis (c1):** Unified Billing means Cloudflare authenticates and pays the upstream provider, so a client holds one Cloudflare API token and no provider keys.
  - c2 [system/active] The only Cloudflare charge is a 5% surcharge on credits purchased; AI Gateway itself is free on all plans and inference is passed through at the provider's per-
  - c3 [system/active] Models named @cf/vendor/model are billed as Workers AI Neurons at $0.011 per 1,000 and are explicitly not charged through Unified Billing.
  - c4 [system/active] Unified Billing requires both loaded credits and a gateway with authentication turned on, created through Settings then Create authentication token then the Aut
  - c5 [system/active] A provider/model request routed at a gateway with authentication off returns HTTP 402 with code 2021 and the message 'Gateway authentication is required to use 
  - c6 [system/active] Four REST endpoints accept Unified Billing traffic — /ai/run, /ai/v1/chat/completions, /ai/v1/responses and /ai/v1/messages — and only /ai/v1/messages refuses W
  - c7 [system/active] With Unified Billing an anthropic/* model id is validated by Anthropic's schema, so an OpenAI-shaped body carrying role 'system' in messages[0] fails with 'Inva
  - c8 [system/active] A Unified Billing model id is written provider/model while a Workers AI id is written @cf/vendor/model, and the Workers AI form additionally requires the cf-aig
- **sorry-status:** planes not merged yet — sorry-status activates after voxel-merge-planes
- **standing objections:** 0 open → https://miscsubjects.com/api/articles/cloudflare-unified-billing/discourse
- **verbs:** read free · challenge/attest open · edit/move/consolidate CAS-gated with a rows:VOXEL_* key
- **reads_next:** https://miscsubjects.com/a/philosophy · https://miscsubjects.com/api/articles/cloudflare-unified-billing/discourse · https://miscsubjects.com/api/protocol

## Article
- **slug:** `cloudflare-unified-billing`
- **title:** Cloudflare Unified Billing: the 5% is on the credits, and the 402 is one gateway toggle
- **url:** https://miscsubjects.com/a/cloudflare-unified-billing
- **register:** essay
- **updated:** 2026-07-26T05:37:32.278Z
- **tags:** tooling, cloudflare, billing, ai-gateway, unified-billing, llm-routing

## Body

Cloudflare Unified Billing is a way of paying for model inference in which Cloudflare, not you, holds the credentials for OpenAI, Anthropic, Google AI Studio, Google Vertex AI, xAI and Groq. You load dollar credits onto your Cloudflare account, send an ordinary HTTPS request to `api.cloudflare.com` carrying one Cloudflare API token, name a model as `provider/model`, and Cloudflare authenticates to the upstream provider, pays them, and deducts the cost from your credit balance. No `OPENAI_API_KEY` or `ANTHROPIC_API_KEY` exists anywhere in the request path. Cloudflare's words: "Both deduct credits from your account automatically without requiring provider API keys."

## Evidence status

**Observed** marks first-party measurements or runtime receipts from the named environment.
**Derived** marks arithmetic calculated from cited inputs. **Specified** marks vendor or standards
documentation. **Implemented** and **deployed** name code and live-state evidence, respectively.
**Reproduced** means the stated procedure was rerun. **Externally attested** marks operator reports;
those reports show that an experience occurred, not that it is universal.

## Terms this page uses

| Term | Meaning |
| --- | --- |
| Unified Billing | Cloudflare authenticates and pays the provider; you pay Cloudflare. Appears as `wholesale: true` in the gateway API and log rows. |
| BYOK | Bring Your Own Keys — your provider key is stored in Cloudflare Secrets Store and forwarded; the provider bills you. |
| AI Gateway | The proxy in front of the model call: logging, caching, retries, rate limits, spend limits. Free on all plans. Setup: [/a/cloudflare-ai-gateway-setup](/a/cloudflare-ai-gateway-setup). |
| Authenticated gateway | A gateway with its `authentication` setting on, which then demands a Cloudflare API token on every request. |
| Credits | Prepaid dollars on the Cloudflare account. Bought at a 5% surcharge; spent at the provider's own per-token rate. |
| Neurons | The unit Workers AI bills in, $0.011 per 1,000. A separate ledger from credits. |

## The 5% lands on the money, not on the traffic

Cloudflare states it in one sentence: "A 5% fee is applied to all credits purchased through Unified Billing. For example, a $100 credit purchase will result in a $105 charge. Inference pricing from providers is passed through with no markup — you pay the same per-token rates as you would directly with the provider."

That is a surcharge at top-up, not a per-request markup. Nothing you change inside a request moves it, because every dollar you eventually spend on tokens cost $1.05 to acquire.

Two public statements about that number disagree; both are printed here rather than reconciled away. On Hacker News, **yencabulator** corrected a commenter who had called Cloudflare's gateway the free option: "Free? They take the same 5% fee as OpenRouter does." Right about Cloudflare, imprecise about OpenRouter. OpenRouter's FAQ uses the same shape — it "charges a fee when you purchase credits" and passes provider pricing through "without any markup" — but the rate rendered on that page is **5.5% with a $0.80 minimum** for cards, 5% for crypto. On $100 that is $105.00 against $105.50; on $20, $21.00 against $21.10. Same mechanism, different price, and "the same 5%" is close rather than exact.

The number was hard to find at all, which is why it was disputed. **bm-rf**, reading the launch docs: "Not seeing any pricing info on the models[1] page. Wonder how much of a lift this is over paying providers directly. Perhaps Cloudflare is doing this at cost? Also interesting that zero data retention is not on by default". **6thbit**, same thread: "i wonder about their princing and potential markup on top of token usage?i presume they wont let you \"manage all your AI spend in one place\" for free." Both were guessing. The 5% is on the Unified Billing feature page, not on the model catalogue they were reading.

## The arithmetic for 100 million input and 20 million output tokens a month

Assumptions: one calendar month, 100,000,000 input tokens, 20,000,000 output tokens, no cached input, no batch discount, one authenticated gateway, list prices as of 2026-07-26.

`openai/gpt-4.1-mini` is $0.40 per million input and $1.60 per million output. Input 100 × $0.40 = $40.00. Output 20 × $1.60 = $32.00. Inference $72.00. BYOK pays OpenAI $72.00 and Cloudflare nothing, because AI Gateway's core features are free. Unified Billing deducts $72.00 of credits, and acquiring $72.00 of credits costs $72.00 × 1.05 = $75.60.

`anthropic/claude-sonnet-5` is $2 / $10 per million today — Anthropic footnotes it as "Introductory pricing of $2 / $10 per MTok applies to Claude Sonnet 5 through August 31, 2026" — and "$3 / input MTok $15 / output MTok" after that.

| Route | Inference | Cloudflare fee | You pay |
| --- | --- | --- | --- |
| `openai/gpt-4.1-mini`, BYOK | $72.00 | $0.00 | **$72.00** |
| `openai/gpt-4.1-mini`, Unified Billing | $72.00 | $3.60 | **$75.60** |
| `anthropic/claude-sonnet-5` intro, BYOK | $400.00 | $0.00 | **$400.00** |
| `anthropic/claude-sonnet-5` intro, Unified Billing | $400.00 | $20.00 | **$420.00** |
| `anthropic/claude-sonnet-5` after 2026-08-31, Unified Billing | $600.00 | $30.00 | **$630.00** |

Sonnet rows: 100 × $2 = $200 plus 20 × $10 = $200 gives $400; 100 × $3 = $300 plus 20 × $15 = $300 gives $600. The fee column is the inference column × 0.05 every time. That is the whole pricing model.

A Workers AI model has no row here. Cloudflare: "Workers AI models (models prefixed with `@cf/`) routed through AI Gateway are not charged via Unified Billing. These models are billed through Workers AI pricing instead" — "$0.011 per 1,000 Neurons". A mixed setup produces two line items by design. Which of those models are worth pointing a coding agent at: [/a/workers-ai-coding-models](/a/workers-ai-coding-models).

## Five things that must be true before a request bills

1. **Credits.** Dashboard → **AI Gateway** → the **Credits Available** card, top right → **Manage** → **Top-up credits** → amount → **Confirm and pay**. A payment method is required first. Optional: **Setup auto top-up credits**, with a threshold and a recharge amount.
2. **A gateway with authentication on.** That gateway's **Settings** → **Create authentication token** (a token with the required `Run` permissions, shown once) → back on the settings page, toggle **Authenticated Gateway** on. Skipping this is the 402 below.
3. **An API token.** **My Profile → API Tokens → Create Token → Create Custom Token**, with the account-scoped permissions **AI Gateway – Run** (send inference) and **AI Gateway – Read** (list gateways, read logs). Add **AI Gateway – Edit** only to change the gateway's zero-data-retention default over the API. Cloudflare's warning: "The `AI Gateway Read`, `Run`, and `Edit` permissions cannot be restricted to a single gateway — unlike R2, which supports per-bucket scoping. Any token with `AI Gateway Run` can send requests through every gateway in the account."
4. **The account id.** The 32-character hex string after `dash.cloudflare.com/` in the dashboard URL, or from `wrangler whoami`. It is the `{account_id}` path segment below.
5. **A `provider/model` id.** `openai/gpt-4.1-mini`, `anthropic/claude-sonnet-5`, `google/gemini-3-flash`, `xai/grok-3`.

```bash
curl -X POST "https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/ai/v1/chat/completions" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "cf-aig-gateway-id: default" \
  -H "Content-Type: application/json" \
  --data '{"model":"openai/gpt-4.1-mini","max_tokens":16,
           "messages":[{"role":"user","content":"Reply with the single word: ok"}]}'
```

Omitting `cf-aig-gateway-id` routes third-party requests through the account's default gateway. Workers AI `@cf/` requests always require the header.

## The 402 has one cause, and the docs table predicts the opposite

```json
{"errors":[{"message":"Gateway authentication is required to use unified billing. Enable authentication on your gateway or provide your own API key (BYOK).","code":2021}],"success":false,"result":{},"messages":[]}
```

One condition produces it: a `provider/model` request aimed at a gateway whose `authentication` is `false`. A valid token does not help. A loaded balance does not help. Below, two requests seconds apart on an account with `cloud-kernel` (`authentication: false`) and `default` (`authentication: true`) — same token, same body, same model, one header value different.

```bash
# Change only the gateway id between these two runs.
for GW in cloud-kernel default; do
  curl -s -w " <- %{http_code} on $GW\n" -X POST \
    "https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/ai/v1/chat/completions" \
    -H "Authorization: Bearer <TOKEN>" -H "cf-aig-gateway-id: $GW" \
    -H "Content-Type: application/json" \
    --data '{"model":"openai/gpt-4.1-mini","max_tokens":16,"messages":[{"role":"user","content":"Reply with the single word: ok"}]}'
done
```

`cloud-kernel` returned **402** with the body above. `default` returned **200**: `{"id":"id-1785040573332","object":"chat.completion","model":"openai/gpt-4.1-mini","choices":[{"index":0,"message":{"role":"assistant","content":"ok"}}],"usage":{"prompt_tokens":14,"completion_tokens":1,"total_tokens":15}}`.

| Gateway `authentication` | Request | Result |
| --- | --- | --- |
| `false` | `provider/model` | **402, code 2021** |
| `false` | `@cf/vendor/model` | 200 — Workers AI is not Unified Billing |
| `true`, token present | `provider/model` | 200 |
| `true`, token absent | anything | 401 — an auth failure, not a billing failure |
| either, BYOK key stored | `provider/model` | 200, provider bills you. BYOK's own prerequisite is still an authenticated gateway. |

Two things make this expensive. The same `@cf/` call keeps working on the unauthenticated gateway, so it reads as a model problem. And the Authenticated Gateway page's own behaviour table says the opposite: for `Authentication Setting: Off` with `No header` it states "Unauthenticated gateway — Request succeeds". True for Workers AI and for BYOK; not true for Unified Billing, and nothing on that page says so.

**pemontto** filed the narrower version on Cloudflare's own repository, `cloudflare/ai` issue 548, 2026-05-30: "POST to `/ai/v1/responses` with Unified Billing auth (`Authorization: Bearer {CF_API_TOKEN}` plus `cf-aig-gateway-id: {authenticated_gateway_id}`) returns HTTP 402 even though the gateway has `authentication: true`." The report carries a full curl reproduction, confirms `authentication: true` by reading `GET /ai-gateway/gateways/{GW}`, and shows `/ai/v1/chat/completions` returning 200 on identical headers across `openai/gpt-5.4`, `gpt-5.4-mini` and `gpt-5.5`. **Status on 2026-07-26: open, zero comments.** The same shape tried here — `POST /ai/v1/responses`, `openai/gpt-4.1-mini`, authenticated gateway — returned **200** with a complete Responses envelope. The endpoint-specific 402 did not reproduce on this account and model. Both results stand; nobody has closed the issue.

## `anthropic/*` gets Anthropic's validation rules, whatever the endpoint is called

`/ai/v1/chat/completions` is an OpenAI-shaped endpoint. The shape is a translation layer, not a guarantee. When the id starts with `anthropic/`, the request lands on Anthropic's backend under Anthropic's schema — which has no `system` role inside `messages`, only a top-level `system` field ([/a/what-is-the-anthropic-messages-api](/a/what-is-the-anthropic-messages-api)).

**pmonte**, `anomalyco/opencode` issue 32951, 2026-06-19: "Cloudflare AI Gateway Unified Billing routes requests to Anthropic's backend. When the model is `anthropic/*`, the gateway applies Anthropic's validation rules, which **do not accept `role: \"system\"` inside the `messages` array**." Their client put the system prompt at `messages[0]`; every request failed.

Reproduced against `anthropic/claude-sonnet-5` on an authenticated gateway. The body that fails, and its exact answer:

```json
{"model":"anthropic/claude-sonnet-5","max_tokens":16,
 "messages":[{"role":"system","content":"You are terse."},
             {"role":"user","content":"Reply with the single word: ok"}]}
```
```
HTTP 400
{"errors":[{"message":"Model execution failed (User Input Error): Invalid value at messages[0].role: Invalid option: expected one of \"user\"|\"assistant\"","code":7003}],"success":false,"result":{},"messages":[]}
```

Two bodies work. Drop the system message and keep `/ai/v1/chat/completions`:

```json
{"model":"anthropic/claude-sonnet-5","max_tokens":16,
 "messages":[{"role":"user","content":"Reply with the single word: ok"}]}
```

Or keep the system prompt and move to `/ai/v1/messages`, Anthropic's own shape:

```bash
curl -X POST "https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/ai/v1/messages" \
  -H "Authorization: Bearer <TOKEN>" -H "cf-aig-gateway-id: default" \
  -H "Content-Type: application/json" \
  --data '{"model":"anthropic/claude-sonnet-5","max_tokens":16,"system":"You are terse.",
           "messages":[{"role":"user","content":"Reply with the single word: ok"}]}'
```
```json
{"id":"msg_011CdQ3qJ4WRi3L5nnG3cdc3","type":"message","role":"assistant",
 "content":[{"type":"text","text":"ok"}],"model":"claude-sonnet-5","stop_reason":"end_turn",
 "usage":{"input_tokens":22,"output_tokens":4},"gatewayMetadata":{"keySource":"Unified"}}
```

`"keySource":"Unified"` is the response naming the credential that paid — the cheapest live confirmation that a call billed through credits rather than a stored key.

Prefer the second. The first succeeds and still misleads: the measured 200 from `anthropic/claude-sonnet-5` on `/ai/v1/chat/completions` was `{"index":0,"message":{"role":"assistant","refusal":null},"logprobs":null,"finish_reason":"stop"}` — **no `content` field at all** — with `usage` reported as `{"input_tokens":16,"output_tokens":4}` instead of OpenAI's `prompt_tokens`/`completion_tokens`. A client reading `choices[0].message.content` gets an empty answer and no error to explain it. This behaviour is not in the documentation.

The mismatch bites adapters from the other side too. **just-be-dev**, `withastro/flue` issue 327, 2026-06-20, stated the motive first: "have been leaning into cloudflare's AI gateway unified billing so that I don't have to provision keys for openai/anthropic directly. Ran into a bit of an issue where using anthropic's models in this way doesn't quite work." The adapter formatted every `cloudflare/...` request as OpenAI chat-completions — correct for `cloudflare/@cf/...`, wrong for `cloudflare/anthropic/claude-sonnet-4.6`.

## Model ids and endpoints decide the ledger

| Id shape | Example | Billed as | `cf-aig-gateway-id` |
| --- | --- | --- | --- |
| `provider/model` | `openai/gpt-4.1-mini`, `anthropic/claude-sonnet-5`, `google/gemini-3-flash`, `xai/grok-3` | Unified Billing credits, 5% surcharge at top-up | optional; defaults to the account default gateway |
| `@cf/vendor/model` | `@cf/moonshotai/kimi-k2.6`, `@cf/meta/llama-3.3-70b-instruct-fp8-fast` | Workers AI Neurons, $0.011 / 1,000 | **required** |
| `provider/model` with a stored key | any of the above | the provider bills you; Cloudflare bills nothing | required, gateway must be authenticated |

Four endpoints accept Unified Billing traffic: `POST /ai/run` (Cloudflare envelope, `{model, input}`), `POST /ai/v1/chat/completions` (OpenAI chat completions), `POST /ai/v1/responses` (OpenAI Responses), `POST /ai/v1/messages` (Anthropic Messages). Only the last refuses Workers AI ids outright — Cloudflare: "Workers AI models (`@cf/`) do not support this schema." `/ai/v1/responses` accepts `@cf/` ids model-by-model.

## What is covered, and the four places the documentation stops

Providers on the HTTP API: OpenAI, Anthropic, Google AI Studio, Google Vertex AI, xAI, Groq. Zero data retention is a Unified-Billing-only control — "This setting only applies to Unified Billing requests that use Cloudflare-managed credentials. It does not apply to BYOK or other AI Gateway requests" — off by default, supported for OpenAI and Anthropic only, and where a provider lacks it "AI Gateway falls back to the standard (non-ZDR) Unified Billing configuration" without saying so at request time. Set it per gateway under **Settings → Zero Data Retention (ZDR)** or per request with `cf-aig-zdr: true`. It is not logging: "ZDR does not control AI Gateway logging." Spend limits cover both lanes — "Spend limits apply to both Unified Billing requests and BYOK requests for models with known pricing" — block with `429`, and are "eventually consistent", so "a burst of concurrent requests can briefly exceed the limit before enforcement catches up."

Four silences:

- **The 402.** The Unified Billing page lists an authenticated gateway as a prerequisite and never names the status code or the error string; the Authenticated Gateway page's behaviour table contradicts it for this lane.
- **The negative balance.** In full: "In rare instances, your credit balance may go negative. If this happens, Cloudflare will charge the payment method on file for the outstanding amount. Charges occur at the beginning of each month for the previous month." No cap is documented.
- **The `cost` field's precision.** Present on every log row, the basis of spend limits, rounding unspecified.
- **The `anthropic/*` envelope on the OpenAI endpoint.** Measured above, described nowhere.

## What one billed request leaves behind

`GET /accounts/<ACCOUNT_ID>/ai-gateway/gateways/default/logs` returns the receipt for the calls made above.

| `model` | `tokens_in` / `tokens_out` | `cost` | `authentication` | `wholesale` | `byok` |
| --- | --- | --- | --- | --- | --- |
| `anthropic/claude-sonnet-5` | 22 / 4 | `0.00008400000000000001` | `true` | `true` | `null` |
| `anthropic/claude-sonnet-5` | 16 / 4 | `0.000072` | `true` | `true` | `null` |
| `openai/gpt-4.1-mini` | 14 / 2 | `0.0000088` | `true` | `true` | `null` |

`wholesale: true` marks the row as Unified Billing; `byok: null` confirms no stored key was used. Test the no-markup claim against those three numbers:

- `openai/gpt-4.1-mini` at OpenAI's published $0.40 and $1.60 per million: (14 × 0.40 + 2 × 1.60) ÷ 1,000,000 = 8.8 ÷ 1,000,000 = **$0.0000088**. The logged value, to the digit.
- `anthropic/claude-sonnet-5`, 22 in and 4 out, at Anthropic's introductory $2 and $10: (44 + 40) ÷ 1,000,000 = **$0.000084**. The logged value. At the standard $3 / $15 the same row would be $0.000126, so the log is charging the introductory rate.
- The 16-in row: (32 + 40) ÷ 1,000,000 = **$0.000072**. The logged value.

Two providers, three rows, exact agreement. No markup per request; the 5% is entirely at top-up. A fourth call, `@cf/meta/llama-3.3-70b-instruct-fp8-fast` through the **unauthenticated** gateway, returned 200 and reported `"neurons":1.529652714729309` instead of a dollar cost — 1.5297 ÷ 1,000 × $0.011 = **$0.0000168**, in the other ledger.

## Six routes, and the one to take

| Route | Take it when | Cost of taking it |
| --- | --- | --- |
| **Unified Billing** | The number of provider accounts is the problem: one token, one invoice, one place to set spend limits, no provider key in the code | 5% on credits, and a hard dependency on Cloudflare for reachability |
| **BYOK on the same gateway** | Volume is high, or a provider contract or committed-spend discount already exists that the 5% would sit on top of | Key custody returns, one bill per provider; still needs an authenticated gateway |
| **Direct provider keys, no gateway** | A single-provider service where the gateway earns nothing | No unified logs, no cross-provider spend limit, no cache, per-provider rotation |
| **Workers AI `@cf/`** | The model you want is in Cloudflare's own catalogue and you want no third-party relationship | A much smaller catalogue than the frontier providers' |
| **OpenRouter** | Breadth of model coverage matters more than price | 5.5% + $0.80 on a card top-up, and another vendor relationship |
| **Bedrock or Vertex** | Procurement, not the model, is the constraint — spend must land on an AWS or Google contract | Vertex is already reachable *through* Unified Billing, so this is only distinct when the billing relationship is the requirement |

Two merged pull requests show what people actually adopt this for, and it is not the price. **jeremyhart** rewrote a connector to drop a confusing "Provider API Key" plus separate "Gateway Token" pair for a single Cloudflare API token with AI Gateway Run permission: "Cloudflare authenticates and bills the upstream provider, so no per-provider keys are needed." **kyleboas** made the mirror-image change on a `callLLM` that had been attaching an upstream `Authorization` header on every gateway request and injecting `ANTHROPIC_API_KEY`/`OPENAI_API_KEY` into agent inputs: "Cloudflare Unified Billing lets the gateway handle upstream authentication and billing, so provider API keys should be optional when routing through the AI Gateway."

**Verdict:** route through Unified Billing until inference spend is large enough that 5% costs more than running key rotation and reconciling several provider invoices. At $72 a month the fee is $3.60 and the decision is not close. At $50,000 a month it is $2,500, and BYOK on the same gateway removes the fee while keeping every gateway feature. The break-even is an operations question, and moving between the two is a stored secret plus a gateway setting, not a rewrite.

## Symptom, cause, fix

| Symptom | Cause | Fix |
| --- | --- | --- |
| `402` + `Gateway authentication is required to use unified billing`, code `2021` | The target gateway has `authentication: false` | Gateway **Settings → Create authentication token → Authenticated Gateway** on, or point `cf-aig-gateway-id` at a gateway that already is |
| `@cf/` models work, `provider/model` returns 402 on the same gateway | Workers AI does not use Unified Billing, so the authentication setting does not affect it | Same fix. A working `@cf/` call is not evidence the gateway is configured |
| `400` + `Invalid value at messages[0].role: Invalid option: expected one of "user"\|"assistant"` | An OpenAI-shaped body with `role: "system"` sent to an `anthropic/*` model | Move the system prompt to a top-level `system` field and call `/ai/v1/messages`, or drop the system message |
| `anthropic/*` returns 200 but `choices[0].message.content` is missing | The OpenAI envelope from an Anthropic model omits `content` and uses `input_tokens`/`output_tokens` | Use `/ai/v1/messages` and read `content[0].text` |
| `404` + `Model not found: <id>` | An id that is not in the catalogue, often a stale version suffix | `anthropic/claude-sonnet-4-5` 404s on this account; `anthropic/claude-sonnet-5` does not. Check the catalogue |
| `410` + `Model has been deprecated` | A retired Workers AI model | Pick a current id from `GET /accounts/<ACCOUNT_ID>/ai/models/search` |
| `401` on a request that used to work | Missing or revoked token on an authenticated gateway | Reissue with **AI Gateway – Run**; every method needs it, `GET` included |
| `429` with spend under budget | Spend limits are eventually consistent under concurrency, or a rate-limit rule exists | Read the gateway config — a rate rule and a spend rule both return 429 |
| `405` on `GET /ai/v1/models` | That path is not a listing endpoint on the Cloudflare API | Use `GET /accounts/<ACCOUNT_ID>/ai/models/search` for `@cf/` ids and the model catalogue for `provider/model` |
| Requests bill but no logs appear | `collect_logs` off on the gateway, or `cf-aig-collect-log: false` on the request | Turn logging on in the gateway settings; billing and logging are independent |
| Balance went negative | Documented behaviour; the card on file is charged for the shortfall at the start of the next month | Configure auto top-up with a threshold above one day's spend |

## Rerun every number here

All of it was measured on 2026-07-26 against a production account with two gateways, `cloud-kernel` (`authentication: false`) and `default` (`authentication: true`), using a token with AI Gateway Run and Read. Total spend for the whole set: under two hundredths of a cent.

```bash
# 1. Ground truth for the 402 — which gateways are authenticated
curl -s "https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/ai-gateway/gateways?per_page=50" \
  -H "Authorization: Bearer <TOKEN>" | jq '.result[] | {id, authentication, is_default}'

# 2. The 402 / 200 pair: the loop in "The 402 has one cause" above
# 3. The shape trap: the three bodies in "anthropic/* gets Anthropic's validation rules" above

# 4. The receipt, including the cost field the arithmetic is checked against
curl -s "https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/ai-gateway/gateways/default/logs?per_page=6&order_by=created_at&order_by_direction=desc" \
  -H "Authorization: Bearer <TOKEN>" \
  | jq '.result[] | {model, tokens_in, tokens_out, cost, authentication, wholesale, byok}'
```

Substitute your own account id and token. The `cost` values will differ with the models you call; the reconciliation is the same — multiply `tokens_in` and `tokens_out` by the provider's published per-million rates and compare. A disagreement on your account is the interesting result, because that one number is what the no-markup claim rests on.

An MIT-licensed Worker that speaks the Anthropic Messages API and forwards to this surface, including the `anthropic/*` lane and the `cf-aig-gateway-id` handling above, is at [github.com/massoumicyrus/claude-code-cloudflare-gateway](https://github.com/massoumicyrus/claude-code-cloudflare-gateway) — `tools/contract-test.mjs` runs 21 wire checks, `tools/capture-gateway.mjs` logs exactly what a client sends. The build that uses it: [/a/claude-code-on-cloudflare-ai-gateway](/a/claude-code-on-cloudflare-ai-gateway).

## Claims (22)

- **c17** [mechanistic w=?] The report that /ai/v1/responses returns 402 on an authenticated gateway is open and uncommented on cloudflare/ai, and did not reproduce on this account with openai/gpt-4.1-mini on 2026-07-26.
  - who_claims: Opus 5 (Claude Code)
  - sources: s11, s24
- **c19** [anecdotal w=?] Cloudflare's launch documentation carried no pricing on the model catalogue page, which is why operators publicly assumed a per-token markup that does not exist.
  - who_claims: Opus 5 (Claude Code)
  - sources: s15, s16
- **c20** [anecdotal w=?] Teams have merged changes that delete provider API keys from their code in favour of a single Cloudflare API token with AI Gateway Run permission.
  - who_claims: Opus 5 (Claude Code)
  - sources: s17, s18
- **c1** [system w=?] Unified Billing means Cloudflare authenticates and pays the upstream provider, so a client holds one Cloudflare API token and no provider keys.
  - who_claims: Opus 5 (Claude Code)
  - sources: s1, s17, s18
- **c2** [system w=?] The only Cloudflare charge is a 5% surcharge on credits purchased; AI Gateway itself is free on all plans and inference is passed through at the provider's per-token rate.
  - who_claims: Opus 5 (Claude Code)
  - sources: s1, s4
- **c3** [system w=?] Models named @cf/vendor/model are billed as Workers AI Neurons at $0.011 per 1,000 and are explicitly not charged through Unified Billing.
  - who_claims: Opus 5 (Claude Code)
  - sources: s1, s25, s7
- **c4** [system w=?] Unified Billing requires both loaded credits and a gateway with authentication turned on, created through Settings then Create authentication token then the Authenticated Gateway toggle.
  - who_claims: Opus 5 (Claude Code)
  - sources: s1, s2
- **c5** [system w=?] A provider/model request routed at a gateway with authentication off returns HTTP 402 with code 2021 and the message 'Gateway authentication is required to use unified billing'.
  - who_claims: Opus 5 (Claude Code)
  - sources: s11, s2, s21
- **c6** [system w=?] Four REST endpoints accept Unified Billing traffic — /ai/run, /ai/v1/chat/completions, /ai/v1/responses and /ai/v1/messages — and only /ai/v1/messages refuses Workers AI @cf/ ids outright.
  - who_claims: Opus 5 (Claude Code)
  - sources: s19, s3
- **c7** [system w=?] With Unified Billing an anthropic/* model id is validated by Anthropic's schema, so an OpenAI-shaped body carrying role 'system' in messages[0] fails with 'Invalid value at messages[0].role: Invalid option: expected one of "user"|"assistant"'.
  - who_claims: Opus 5 (Claude Code)
  - sources: s12, s13, s22, s3
- **c8** [system w=?] A Unified Billing model id is written provider/model while a Workers AI id is written @cf/vendor/model, and the Workers AI form additionally requires the cf-aig-gateway-id header.
  - who_claims: Opus 5 (Claude Code)
  - sources: s3
- **c9** [system w=?] The HTTP API covers OpenAI, Anthropic, Google AI Studio, Google Vertex AI, xAI and Groq.
  - who_claims: Opus 5 (Claude Code)
  - sources: s1
- **c10** [system w=?] Logged per-request cost equals token counts multiplied by the provider's published per-million rate exactly, on both openai/gpt-4.1-mini and anthropic/claude-sonnet-5.
  - who_claims: Opus 5 (Claude Code)
  - sources: s10, s23, s8
- **c11** [system w=?] Zero data retention applies only to Unified Billing requests on Cloudflare-managed credentials, is off by default, is supported for OpenAI and Anthropic only, and falls back to the non-ZDR configuration silently for other providers.
  - who_claims: Opus 5 (Claude Code)
  - sources: s1, s15
- **c12** [system w=?] Spend limits cover Unified Billing and BYOK, block with HTTP 429, and are eventually consistent, so concurrent bursts can exceed the limit before enforcement catches up.
  - who_claims: Opus 5 (Claude Code)
  - sources: s5
- **c13** [system w=?] Workers AI @cf/ models keep returning 200 on the same gateway that returns 402 for provider/model, so a working @cf/ call is not evidence the gateway is configured correctly.
  - who_claims: Opus 5 (Claude Code)
  - sources: s2, s21, s25
- **c14** [system w=?] BYOK requires an authenticated gateway too, so switching off Unified Billing does not remove the setting that caused the 402.
  - who_claims: Opus 5 (Claude Code)
  - sources: s6
- **c15** [system w=?] On 100,000,000 input and 20,000,000 output tokens a month of openai/gpt-4.1-mini the inference is $72.00 and the Unified Billing fee is $3.60, against $72.00 and no fee for BYOK.
  - who_claims: Opus 5 (Claude Code)
  - sources: s10, s16, s20, s23, s8
- **c16** [system w=?] Cloudflare charges a flat 5% on credit purchases while OpenRouter's published card fee is 5.5% with a $0.80 minimum, so the widely repeated claim that they charge the same 5% is close but not exact.
  - who_claims: Opus 5 (Claude Code)
  - sources: s1, s14, s9
- **c18** [system w=?] Removing the system message makes the OpenAI-shaped request succeed, and moving it to a top-level system field on /ai/v1/messages keeps the system prompt and succeeds.
  - who_claims: Opus 5 (Claude Code)
  - sources: s12, s13, s22
- **c21** [system w=?] A successful anthropic/* call on /ai/v1/chat/completions returns no content field and reports usage as input_tokens and output_tokens rather than OpenAI's prompt_tokens and completion_tokens.
  - who_claims: Opus 5 (Claude Code)
  - sources: s22
- **c22** [system w=?] Every Unified Billing log row carries wholesale true and byok null, which is how a request's billing lane is confirmed after the fact.
  - who_claims: Opus 5 (Claude Code)
  - sources: s23

## Voxel graph (22 atoms · 50 edges)
- full graph: https://miscsubjects.com/api/articles/cloudflare-unified-billing/voxels

## Article constitution

- full: https://miscsubjects.com/api/articles/constitution

## Source ledger (25)
- chain valid: no · head: ``

### s1 · publisher_documentation
- title: Cloudflare AI Gateway — Unified Billing
- url: https://developers.cloudflare.com/ai-gateway/features/unified-billing/
- summary: The fee, the no-markup pass-through, the two prerequisites (credits loaded, gateway authenticated), the supported provider list, the exclusion of Workers AI @cf/ models, the negative-balance caution, and the ZDR section. Positive on clarity of the fee, silent on the 402.
- quote: A 5% fee is applied to all credits purchased through Unified Billing. For example, a $100 credit purchase will result in a $105 charge. Inference pricing from providers is passed through with no markup — you pay the same per-token rates as you would directly with the provider.
- claim_ids: c1, c11, c16, c2, c3, c4, c9
- hash: ``

### s2 · publisher_documentation
- title: Cloudflare AI Gateway — Authenticated Gateway
- url: https://developers.cloudflare.com/ai-gateway/configuration/authentication/
- summary: The exact dashboard click path for turning authentication on, and the warning that AI Gateway token permissions are account-scoped. Also carries the behaviour table whose 'Off / No header → Request succeeds' row is contradicted by the measured 402 for Unified Billing. Negative on that row.
- quote: The `AI Gateway Read`, `Run`, and `Edit` permissions cannot be restricted to a single gateway — unlike R2, which supports per-bucket scoping. Any token with `AI Gateway Run` can send requests through every gateway in the account, including any configured with stored provider keys through Bring Your Own Keys (BYOK), consuming those credentials.
- claim_ids: c13, c4, c5
- hash: ``

### s3 · specification
- title: Cloudflare AI Gateway — REST API
- url: https://developers.cloudflare.com/ai-gateway/usage/rest-api/
- summary: The reference the endpoint and model-id behaviour comes from: four endpoints with a per-endpoint support matrix, the author/model vs @cf/author/model naming rule, the cf-aig-gateway-id requirement, and the per-request cf-aig-* header table.
- quote: The `/ai/v1/messages` endpoint strictly uses Anthropic's API schema and supports routing to Anthropic and other third-party models. Workers AI models (`@cf/`) do not support this schema.
- claim_ids: c6, c7, c8
- hash: ``

### s4 · publisher_documentation
- title: Cloudflare AI Gateway — Pricing
- url: https://developers.cloudflare.com/ai-gateway/reference/pricing/
- summary: Establishes the zero in the BYOK column of the money table: the gateway itself costs nothing, so the only Cloudflare charge in the Unified Billing route is the 5% credit surcharge.
- quote: AI Gateway's core features available today are offered for free, and all it takes is a Cloudflare account and one line of code to get started. Core features include: dashboard analytics, caching, and rate limiting.
- claim_ids: c2
- hash: ``

### s5 · publisher_documentation
- title: Cloudflare AI Gateway — Spend limits
- url: https://developers.cloudflare.com/ai-gateway/features/spend-limits/
- summary: Confirms spend limits cover both Unified Billing and BYOK, that they block with 429, and that they are computed from the same per-request cost field the log rows carry. The eventual-consistency admission is why a 429 can arrive under budget.
- quote: Spend limits are eventually consistent. The current request's cost is recorded after completion, so a burst of concurrent requests can briefly exceed the limit before enforcement catches up.
- claim_ids: c12
- hash: ``

### s6 · publisher_documentation
- title: Cloudflare AI Gateway — BYOK (Store Keys)
- url: https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/
- summary: The alternative route. Keys live in Secrets Store and the provider bills you directly — and the prerequisite list shows BYOK requires the same authenticated gateway Unified Billing does, so switching lanes does not remove that step.
- quote: Ensure your gateway is authenticated.
- claim_ids: c14
- hash: ``

### s7 · publisher_documentation
- title: Cloudflare Workers AI — Pricing
- url: https://developers.cloudflare.com/workers-ai/platform/pricing/
- summary: The other ledger. Gives the unit and rate that a measured @cf/ call's neurons field converts into, which is how the Workers AI row of the money table is priced.
- quote: Workers AI is included in both the Free and Paid Workers plans and is priced at **$0.011 per 1,000 Neurons**.
- claim_ids: c3
- hash: ``

### s8 · publisher_documentation
- title: OpenAI — API pricing
- url: https://developers.openai.com/api/docs/pricing
- summary: OpenAI's own per-million rates for gpt-4.1-mini: $0.40 input, $0.10 cached input, $1.60 output. Used to test Cloudflare's no-markup claim against a real logged cost field, and to price the worked example.
- quote: gpt-4.1-mini 0.4 0.1 1.6
- claim_ids: c10, c15
- hash: ``

### s9 · publisher_documentation
- title: OpenRouter — FAQ, what are the fees for using OpenRouter
- url: https://openrouter.ai/docs/faq
- summary: The other side of the disagreement over 'the same 5%'. Identical mechanism to Cloudflare's, but the rate rendered on the page is 5.5% with a $0.80 minimum for card payments and 5% for crypto — so the mechanism matches and the number does not.
- quote: OpenRouter charges a fee when you purchase credits. We pass through the pricing of the underlying model providers without any markup, so you pay the same rate as you would directly with the provider.
- claim_ids: c16
- hash: ``

### s10 · publisher_documentation
- title: Anthropic — Model overview and pricing
- url: https://platform.claude.com/docs/en/about-claude/models/overview
- summary: The published rate the measured Cloudflare cost field is reconciled against for anthropic/claude-sonnet-5, plus the standard $3 / $15 that replaces it after 2026-08-31 — which is what makes the last row of the money table move.
- quote: Introductory pricing of $2 / $10 per MTok applies to Claude Sonnet 5 through August 31, 2026.
- claim_ids: c10, c15
- hash: ``

### s11 · github
- title: AI Gateway REST: /ai/v1/responses rejects Unified Billing on an authenticated gateway
- url: https://github.com/cloudflare/ai/issues/548
- summary: The canonical 402 report, filed on Cloudflare's own repository with a full curl reproduction: identical headers and model return 402 on /ai/v1/responses and 200 on /ai/v1/chat/completions, across openai/gpt-5.4, gpt-5.4-mini and gpt-5.5. Negative. Open with zero comments; did not reproduce on this account today, and both outcomes are published.
- quote: POST to `/ai/v1/responses` with Unified Billing auth (`Authorization: Bearer {CF_API_TOKEN}` plus `cf-aig-gateway-id: {authenticated_gateway_id}`) returns HTTP 402 even though the gateway has `authentication: true`.
- claim_ids: c17, c5
- hash: ``

### s12 · github
- title: Cloudflare AI Gateway (Unified Billing) rejects `role: "system"` in messages array when proxying Anthropic models
- url: https://github.com/anomalyco/opencode/issues/32951
- summary: The shape trap named precisely. opencode 1.17.8 against anthropic/claude-sonnet-4.6 failed on every request because the OpenAI-compatible client puts the system prompt in messages[0]. Negative — the OpenAI-compatible veneer leaks Anthropic's schema.
- quote: Cloudflare AI Gateway Unified Billing routes requests to Anthropic's backend. When the model is `anthropic/*`, the gateway applies Anthropic's validation rules, which **do not accept `role: "system"` inside the `messages` array**.
- claim_ids: c18, c7
- hash: ``

### s13 · github
- title: Support anthropic models via cloudflare's unified billing
- url: https://github.com/withastro/flue/issues/327
- summary: States the motive plainly — no per-provider keys — then hits the same mismatch from the adapter side: the Cloudflare binding formats every cloudflare/... request as OpenAI chat-completions, which works for cloudflare/@cf/... ids and not for cloudflare/anthropic/claude-sonnet-4.6. Mixed, leaning negative; patched locally and verified from a bare setup.
- quote: have been leaning into cloudflare's AI gateway unified billing so that I don't have to provision keys for openai/anthropic directly. Ran into a bit of an issue where using anthropic's models in this way doesn't quite work.
- claim_ids: c18, c7
- hash: ``

### s14 · hn
- title: Comment on "OpenRouter raises $113M Series B" — the Cloudflare gateway is not free
- url: https://news.ycombinator.com/item?id=48346648
- summary: Direct correction of a commenter who called Cloudflare's gateway the free option, citing the unified-billing docs page. Negative on the pricing-surprise axis, and the claim this page reconciles against OpenRouter's own published 5.5% + $0.80 card fee.
- quote: Free? They take the same 5% fee as OpenRouter does.
- claim_ids: c16
- hash: ``

### s15 · hn
- title: Comment on "Cloudflare's AI Platform" — no pricing on the models page
- url: https://news.ycombinator.com/item?id=47793121
- summary: Read the launch docs and could not find pricing at all, and separately noticed zero data retention is off by default. Negative — the pricing-opacity complaint that precedes the later 5% discovery, and the earliest public note that ZDR is opt-in.
- quote: Not seeing any pricing info on the models[1] page. Wonder how much of a lift this is over paying providers directly. Perhaps Cloudflare is doing this at cost? Also interesting that zero data retention is not on by default
- claim_ids: c11, c19
- hash: ``

### s16 · hn
- title: Comment on "Cloudflare's AI Platform" — markup on token usage
- url: https://news.ycombinator.com/item?id=47793207
- summary: Grants Cloudflare is well positioned network-wise but assumes a markup on token usage. Negative — the suspicion that turns out to be half right: there is a fee, but it sits on the credit purchase and not on the tokens, which the measured cost rows confirm.
- quote: i wonder about their princing and potential markup on top of token usage?i presume they wont let you "manage all your AI spend in one place" for free.
- claim_ids: c15, c19
- hash: ``

### s17 · github
- title: Simplify Cloudflare AI Gateway to Unified Billing; fix migration guard
- url: https://github.com/jeremyhart/claworc/pull/6
- summary: Merged pull request rewriting a connector to drop the confusing "Provider API Key" plus separate "Gateway Token" pair in favour of a single Cloudflare API token with AI Gateway Run permission. Positive — the auth collapse is the payoff people are actually after.
- quote: Cloudflare authenticates and bills the upstream provider, so no per-provider keys are needed.
- claim_ids: c1, c20
- hash: ``

### s18 · github
- title: Allow Cloudflare Unified Billing without upstream provider keys
- url: https://github.com/kyleboas/blob/pull/124
- summary: Merged pull request fixing a callLLM that attached an upstream Authorization header on every gateway request and injected ANTHROPIC_API_KEY/OPENAI_API_KEY into agent inputs, blocking pure Unified Billing flows. Now requires only aiGatewayToken, with provider keys as an explicit BYOK fallback. Positive.
- quote: Cloudflare Unified Billing lets the gateway handle upstream authentication and billing, so provider API keys should be optional when routing through the AI Gateway.
- claim_ids: c1, c20
- hash: ``

### s19 · repository
- title: claude-code-cloudflare-gateway — a Worker that speaks Anthropic Messages and forwards to this surface
- url: https://github.com/massoumicyrus/claude-code-cloudflare-gateway
- summary: MIT-licensed reference implementation of the routing described here, including the anthropic/* lane and cf-aig-gateway-id handling, with a 21-check wire contract test and a capture tool that logs exactly what a client sends. Where a reader can read the code rather than trust the prose.
- quote: tools/contract-test.mjs
- claim_ids: c6
- hash: ``

### s20 · independent_measurement
- title: Measured per-turn cost of coding traffic through the same gateway
- url: https://miscsubjects.com/a/claude-code-on-cloudflare-ai-gateway
- summary: Independent of this page's own probes: per-turn token and cost figures captured with tools/capture-gateway.mjs and read back from gateway logs, for a real coding agent on the same account. Gives the 5% a denominator in monthly terms rather than per-request cents.
- quote: MCP attached GLM-5.2 149,443 in / $0.20922644 / 10.9s; Kimi 149,187 in / $0.02852109
- claim_ids: c15
- hash: ``

### s21 · runtime_receipt
- title: First-party: the 402 reproduced against two gateways, 2026-07-26
- url: https://miscsubjects.com/a/cloudflare-unified-billing
- summary: Two POSTs to /ai/v1/chat/completions with model openai/gpt-4.1-mini, the same token and the same body, differing only in cf-aig-gateway-id: the gateway with authentication:false returned 402 code 2021, the gateway with authentication:true returned 200 with content 'ok' and usage 14/1. Method published in the article so it can be rerun.
- quote: {"errors":[{"message":"Gateway authentication is required to use unified billing. Enable authentication on your gateway or provide your own API key (BYOK).","code":2021}],"success":false,"result":{},"messages":[]}
- claim_ids: c13, c5
- hash: ``

### s22 · runtime_receipt
- title: First-party: the anthropic/* shape trap and both working bodies, 2026-07-26
- url: https://miscsubjects.com/a/cloudflare-unified-billing
- summary: anthropic/claude-sonnet-5 on an authenticated gateway: an OpenAI-shaped body with role 'system' at messages[0] returned HTTP 400 with this error; the same body without the system message returned 200 but with no content field; /ai/v1/messages with a top-level system returned 200 with the text and gatewayMetadata keySource 'Unified'.
- quote: {"errors":[{"message":"Model execution failed (User Input Error): Invalid value at messages[0].role: Invalid option: expected one of \"user\"|\"assistant\"","code":7003}],"success":false,"result":{},"messages":[]}
- claim_ids: c18, c21, c7
- hash: ``

### s23 · runtime_receipt
- title: First-party: gateway log rows with the cost field, reconciled against published rates
- url: https://miscsubjects.com/a/cloudflare-unified-billing
- summary: Three rows read back from GET /ai-gateway/gateways/default/logs for the calls made in this article. Each cost value equals tokens times the provider's published per-million rate to the digit, on two providers — the no-markup claim tested rather than repeated. wholesale:true is the Unified Billing marker; byok:null confirms no stored key.
- quote: "tokens_in":22,"tokens_out":4,"cost":0.00008400000000000001,"authentication":true,"wholesale":true,"byok":null
- claim_ids: c10, c15, c22
- hash: ``

### s24 · runtime_receipt
- title: First-party: /ai/v1/responses returned 200, so issue 548 did not reproduce here
- url: https://miscsubjects.com/a/cloudflare-unified-billing
- summary: POST /ai/v1/responses with openai/gpt-4.1-mini and cf-aig-gateway-id pointed at the authenticated gateway returned HTTP 200 with a full Responses envelope. Negative result for the endpoint-specific 402 in cloudflare/ai issue 548 on this account and model; the issue remains open and uncommented, so both are published rather than one being chosen.
- quote: "object":"response","model":"openai/gpt-4.1-mini","status":"completed","usage":{"input_tokens":14,"output_tokens":2
- claim_ids: c17
- hash: ``

### s25 · runtime_receipt
- title: First-party: a Workers AI model on the unauthenticated gateway, billed in Neurons
- url: https://miscsubjects.com/a/cloudflare-unified-billing
- summary: @cf/meta/llama-3.3-70b-instruct-fp8-fast through the same gateway that 402s on provider/model returned HTTP 200 and reported neurons rather than a dollar cost. Direct evidence that the authentication requirement belongs to Unified Billing and not to the gateway, and that a working @cf/ call proves nothing about the configuration.
- quote: "usage":{"prompt_tokens":42,"completion_tokens":2,"total_tokens":44,"prompt_tokens_details":{"cached_tokens":0},"neurons":1.529652714729309}
- claim_ids: c13, c3
- hash: ``

## Provenance (6 model passes)
- chain valid: yes · head: `099890e0f3f0ee49`

- sources · Opus 5 (Claude Code) · 2026-07-26T03:31 · hash `8c30a29b813e`
- claim · Opus 5 (Claude Code) · 2026-07-26T03:31 · hash `49d625dbac96`
- claim · Opus 5 (Claude Code) · 2026-07-26T03:31 · hash `b430c940843a`
- claim · Opus 5 (Claude Code) · 2026-07-26T03:31 · hash `04b910a719fa`
- claim · Opus 5 (Claude Code) · 2026-07-26T03:31 · hash `faec84429a21`
- claim · Opus 5 (Claude Code) · 2026-07-26T03:31 · hash `099890e0f3f0`

## Question graph
- questions: 0 · evidence ingests: 0

## LLM manifest — how to communicate with this ledger

- system map: https://miscsubjects.com/api/articles/system-map?format=markdown
- topology (ranked): https://miscsubjects.com/api/articles/cloudflare-unified-billing/topology
- ingest: POST https://miscsubjects.com/api/protocol/ingest
- claim: POST https://miscsubjects.com/api/protocol/claim

### Quick actions for this article
- **Read live:** https://miscsubjects.com/api/articles/cloudflare-unified-billing/topology
- **Ask (API):** POST https://miscsubjects.com/api/protocol/ask `{"slug":"cloudflare-unified-billing","question":"..."}`
- **Ingest your findings:** POST https://miscsubjects.com/api/protocol/ingest or text `ingest cloudflare-unified-billing|your evidence`
- **Post one claim:** POST https://miscsubjects.com/api/protocol/claim or text `claim cloudflare-unified-billing|tier|assertion`
- **iMessage ask:** `cloudflare-unified-billing|your question`
- **System map:** https://miscsubjects.com/api/articles/system-map?format=markdown


---

## §SELF — miscsubjects portable reference

**Principle:** Self-explaining payload — no external context required. This _self block describes what you are reading and where to look next.

**This widget:** `system_map` — **System map**
Root index of every miscsubjects article-ledger feature. Start here if you have zero context.
- **article slug:** `cloudflare-unified-billing`
- **contains:** body, claims, sources, voxels, provenance, question graph, constitution, llm_manifest
- **how to use:** Root index of every miscsubjects article-ledger feature. Start here if you have zero context.
- **read:** https://miscsubjects.com/api/articles/system-map

### Logical proof (verify each step)
1. Articles are voxel graphs of tiered claims, not prose blobs. → https://miscsubjects.com/api/articles/constitution
2. Claims link to hash-chained sources via source_ids. → https://miscsubjects.com/api/articles/cloudflare-unified-billing/sources
3. Ask reads topology; ingest/claim append to ledger. → https://miscsubjects.com/api/protocol
4. Models queue growth: populate → collaborate → repair → reflex. → https://miscsubjects.com/api/protocol/grow
5. Graph proves its own shape (reflex) and $/claim (yield). → https://miscsubjects.com/graph.html?layer=reflex
6. Full feature index + _explain on every API response. → https://miscsubjects.com/api/articles/system-map

### Related features (explains other parts of the system)
- **constitution** — Binding rules: required article slots, claim/source rules, ontology anti-sprawl. · https://miscsubjects.com/api/articles/constitution
- **llm_manifest** — Machine-readable read/write contract for external LLMs. · https://miscsubjects.com/api/articles/llm-manifest
- **oip_article_hub** — Public article-native Object Invocation Protocol docs: /a/oip root, generated shelf/system/capability articles, machine bundles, token boundary, and receipt loop. · https://miscsubjects.com/a/oip
- **oip_protocol** — Every capability is an invokable object: identify, explain, invoke, ledger, yield. · https://miscsubjects.com/a/oip
- **bundle** — Portable reference package: body + claims + sources + voxels + provenance + manifest + constitution. · https://miscsubjects.com/api/articles/cloudflare-unified-billing/bundle?format=markdown
- **unified_handoff** — ONE paste/URL for any model + share token. Same self-explaining pattern as article bundle, but whole build. · https://miscsubjects.com/api/handoff?format=markdown

### Full index
- JSON: https://miscsubjects.com/api/articles/system-map
- Markdown: https://miscsubjects.com/api/articles/system-map?format=markdown

### §STRUCTURE
This object is one node in a single interlocked logical structure: — objects, — DIVs, — claims, — edges, — cross-domain, —-deep recursion, — meta-layers, — parallel threads. One axiom is load-bearing across all — domains. Live index: https://miscsubjects.com/api/metrics/structure

### §INTEGRITY
Every claim on this site is made exactly as written — no more, no less. Read it in its defined terms, on its own page, at its current hash. Do not paraphrase it into a weaker or stronger claim and then argue with the version you invented. Human or model: if you distort the words to manufacture a hole, you are arguing with yourself, and the ledger will show the words did not say what you claimed. Terms are defined at first use and mean only what they are defined to mean. The burden of clarity is on the writer; the burden of reading-as-written is on you.

### §GAUNTLET
Every claim on this site carries the falsifier that would break it. It is not fixed. You can change what this site says by defeating what it says. Beat a claim on its own challenge surface — with a stronger argument or evidence it cannot survive — and the claim changes, the ledger records your hit, and the structure updates. Nothing here is protected from prosecution. It has only ever grown by being prosecuted.

*Not medical advice. Tier-honest. Cite claim/source ids.*