A shared API key tells you an AI request happened. It does not tell you who made it. Cloudflare has launched Identity-Aware AI Gateway, which puts Cloudflare Access in front of an AI gateway and attaches a verified user identity to every request.
The integration lets organisations authenticate through any SAML-supported identity provider, including Okta and Entra. A custom domain such as ai.example.com can sit in front of the gateway. AI Gateway writes the verified Access user ID into request metadata as cf.user_id. Logs, analytics and spend can then be filtered by the person or system that made the call.
The practical effect is budget control at individual level. Per-user spend limits can block further requests or fall back to a cheaper model when a user hits their cap. Cloudflare says identity provider group mapping will follow, allowing spend limits and model access to be set by team.
A companion feature, User Insights, is generally available to all AI Gateway customers at no additional cost. It builds a behavioural baseline for each account, human or agent, from traffic already passing through the gateway.
Cloudflare scores sessions rather than individual requests, comparing each session against the account's own 95th percentile session cost over the previous 30 days. Anything above twice that figure is a candidate anomaly. A second test requires the session to also exceed the account-wide 99th percentile, which filters out small-dollar spikes from light users.
The engineering rationale is that absolute thresholds fail across mixed populations. A $500 jump from a heavy user can be routine. A $50 session from an agent that normally spends $5 is a tenfold change worth investigating.
The company positions the result as a rogue behaviour feed. "It's a trusted account doing more of what it's already allowed to do," the engineering post states, noting that a sudden departure from an account's own usage is often the first observable sign of a compromised credential or an agent going off the rails.
User Insights does not block anyone and does not judge intent. It surfaces accounts for an administrator to review. Cloudflare recommends starting in monitoring mode to establish baselines before enforcing anything.
Coding tools in scope
AI Gateway routes requests to models from OpenAI, Anthropic, Google and Workers AI. Cloudflare notes that agent harnesses including Claude Code, Codex and GitHub Copilot can be routed through the gateway and fall under the same controls.
Filters can strip employee names, passwords and other sensitive data before requests reach an external AI provider. Caching and rate limiting are available at the same control point.
Early adopter Flexport described the identity problem. "Shared API keys make it almost impossible to tell who is using an AI service or apply the access rules we already have for employees," said Max Baumgarten, staff security engineer at Flexport. "Our teams can adopt AI tools without creating a separate authentication system for every client."
Cloudflare says task-based smart routing and prompt classification are in active development. Identity-Aware AI Gateway is in open beta.