Skip to content

Commit 0bd2818

Browse files
daisyfaithaumahyperlint-ai[bot]Oxyjunkathayl
authored
[AIG]Initial authentication documentation (#18072)
* Initial authentication documentation * Added links to authentication * Update src/content/docs/ai-gateway/configuration/authentication.mdx api link Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> * Update src/content/docs/ai-gateway/configuration/authentication.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> * Update src/content/docs/ai-gateway/get-started.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> * Update src/content/docs/ai-gateway/observability/logging/index.mdx Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> * Update src/content/docs/ai-gateway/get-started.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/docs/ai-gateway/get-started.mdx Co-authored-by: Jun Lee <[email protected]> * Update src/content/docs/ai-gateway/configuration/authentication.mdx Co-authored-by: Jun Lee <[email protected]> * Update authentication.mdx * Update get-started.mdx * Update index.mdx * Update authentication.mdx * Update get-started.mdx * Update index.mdx * added examples and changelog * websockets changelog * Update authentication.mdx --------- Co-authored-by: hyperlint-ai[bot] <154288675+hyperlint-ai[bot]@users.noreply.github.com> Co-authored-by: Jun Lee <[email protected]> Co-authored-by: Kathy <[email protected]>
1 parent 7dd03a8 commit 0bd2818

File tree

4 files changed

+86
-0
lines changed

4 files changed

+86
-0
lines changed

‎src/content/changelogs/ai-gateway.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,15 @@ productLink: "/ai-gateway/"
55
productArea: Developer platform
66
productAreaLink: /workers/platform/changelog/platform/
77
entries:
8+
- publish_date: "2024-11-19"
9+
title: WebsocketS API
10+
description: |-
11+
* **Configuration**: Added [WebSockets API](/ai-gateway/configuration/websockets-api/) which provides a single persistent connection, enabling continuous communication.
12+
- publish_date: "2024-11-19"
13+
title: Authentication
14+
description: |-
15+
* **Configuration**: Added [Authentication](/ai-gateway/configuration/authentication/) which adds security by requiring a valid authorization token for each request.
16+
817
- publish_date: "2024-10-28"
918
title: Grok
1019
description: |-

‎src/content/docs/ai-gateway/configuration/authentication.mdx‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
pcx_content_type: configuration
3+
title: Authentication
4+
sidebar:
5+
order: 7
6+
head: []
7+
description: Add security by requiring a valid authorization token for each request.
8+
---
9+
10+
Using an Authenticated Gateway in AI Gateway adds security by requiring a valid authorization token for each request. This feature is especially useful when storing logs, as it prevents unauthorized access and protects against invalid requests that can inflate log storage usage and make it harder to find the data you need. With Authenticated Gateway enabled, only requests with the correct token are processed.
11+
12+
:::note
13+
We recommend enabling Authenticated Gateway when opting to store logs with AI Gateway.
14+
15+
If Authenticated Gateway is enabled but a request does not include the required `cf-aig-authorization` header, the request will fail. This setting ensures that only verified requests pass through the gateway. To bypass the need for the `cf-aig-authorization` header, make sure to disable Authenticated Gateway.
16+
:::
17+
18+
## Setting up Authenticated Gateway using the Dashboard
19+
20+
1. Go to the Settings for the specific gateway you want to enable authentication for.
21+
2. Select **Create authentication token** to generate a custom token with the required `Run` permissions. Be sure to securely save this token, as it will not be displayed again.
22+
3. Include the `cf-aig-authorization` header with your API token in each request for this gateway.
23+
4. Return to the settings page and toggle on Authenticated Gateway.
24+
25+
## Example requests with OpenAI
26+
27+
```bash
28+
curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/openai/chat/completions \
29+
--header 'cf-aig-authorization: Bearer {CF_AIG_TOKEN}' \
30+
--header 'Authorization: Bearer OPENAI_TOKEN' \
31+
--header 'Content-Type: application/json' \
32+
--data '{"model": "gpt-3.5-turbo", "messages": [{"role": "user", "content": "What is Cloudflare?"}]}'
33+
```
34+
35+
Using the OpenAI SDK:
36+
37+
```javascript
38+
import OpenAI from "openai";
39+
40+
const openai = new OpenAI({
41+
apiKey: process.env.OPENAI_API_KEY,
42+
baseURL: "https://gateway.ai.cloudflare.com/v1/account-id/gateway/openai",
43+
defaultHeaders: {
44+
"cf-aig-token": `Bearer {token}`,
45+
},
46+
});
47+
```
48+
49+
## Example requests with the Vercel AI SDK
50+
51+
```javascript
52+
import { createOpenAI } from "@ai-sdk/openai";
53+
54+
const openai = createOpenAI({
55+
baseURL: "https://gateway.ai.cloudflare.com/v1/account-id/gateway/openai",
56+
headers: {
57+
"cf-aig-token": `Bearer {token}`,
58+
},
59+
});
60+
```
61+
62+
## Expected behavior
63+
64+
The following table outlines gateway behavior based on the authentication settings and header status:
65+
66+
| Authentication Setting | Header Info | Gateway State | Response |
67+
| ---------------------- | -------------- | ----------------------- | ------------------------------------------ |
68+
| On | Header present | Authenticated gateway | Request succeeds |
69+
| On | No header | Error | Request fails due to missing authorization |
70+
| Off | Header present | Unauthenticated gateway | Request succeeds |
71+
| Off | No header | Unauthenticated gateway | Request succeeds |

‎src/content/docs/ai-gateway/get-started.mdx‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ Then, create a new AI Gateway.
2424

2525
<Render file="create-gateway" />
2626

27+
## Choosing gateway authentication
28+
29+
When setting up a new gateway, you can choose between an authenticated and unauthenticated gateway. Enabling an authenticated gateway requires each request to include a valid authorization token, adding an extra layer of security. We recommend using an authenticated gateway when storing logs to prevent unauthorized access and protect against invalid requests that can inflate log storage usage and make it harder to find the data you need. Learn more about setting up an [Authenticated Gateway](/ai-gateway/configuration/authentication/).
30+
2731
## Connect application
2832

2933
Next, connect your AI provider to your gateway.

‎src/content/docs/ai-gateway/observability/logging/index.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ You can store up to 10 million logs per gateway. If your limit is reached, new l
1616

1717
To learn more about your plan limits, refer to [Limits](/ai-gateway/reference/limits/).
1818

19+
We recommend using an authenticated gateway when storing logs to prevent unauthorized access and protecs against invalid requests that can inflate log storage usage and make it harder to find the data you need. Learn more about setting up an [authenticated gateway](/ai-gateway/configuration/authentication/).
20+
1921
## Default configuration
2022

2123
Logs, which include metrics as well as request and response data, are enabled by default for each gateway. This logging behavior will be uniformly applied to all requests in the gateway. If you are concerned about privacy or compliance and want to turn log collection off, you can go to settings and opt out of logs. If you need to modify the log settings for specific requests, you can override this setting on a per-request basis.

0 commit comments

Comments
 (0)