​

Overview

• Chat and Responses with Workers AI text models, streaming included
• Embeddings, including as the embedding provider for semantic caching
• Decisions with Cloudflare’s Clef models (clef, clef-flash, clef-omni), including image inputs

​

Supported Operations

​

Setup & Configuration

• Web UI
• config.json
• API
• Go SDK

1. Navigate to Models > Model Providers. Click Add New Provider and select Cloudflare.
2. Click Add Key.
3. Set a name for the key.
4. Paste your API token, or use an environment variable such as env.CLOUDFLARE_API_TOKEN.
5. Set Account ID (Required), for example env.CLOUDFLARE_ACCOUNT_ID.
6. Set Allowed Models to All Models (default) or a specific allowlist.
7. Save the provider configuration.

{
  "providers": {
    "cloudflare": {
      "keys": [
        {
          "name": "cloudflare-key-1",
          "value": "env.CLOUDFLARE_API_TOKEN",
          "models": ["*"],
          "weight": 1.0,
          "cloudflare_key_config": {
            "account_id": "env.CLOUDFLARE_ACCOUNT_ID"
          }
        }
      ]
    }
  }
}

Field	Type	Required	Description
cloudflare_key_config.account_id	string	Yes	Cloudflare account ID that serves Workers AI. Supports the env. prefix

Refer to the API documentation for Provider Keys Management. Include cloudflare_key_config.account_id in the key body.

case schemas.Cloudflare:
    return []schemas.Key{{
        Name:   "cloudflare-key-1",
        Value:  *schemas.NewSecretVar("env.CLOUDFLARE_API_TOKEN"),
        Models: []string{"*"},
        Weight: 1.0,
        CloudflareKeyConfig: &schemas.CloudflareKeyConfig{
            AccountID: *schemas.NewSecretVar("env.CLOUDFLARE_ACCOUNT_ID"),
        },
    }}, nil

​

Migrating a custom cloudflare provider

1. Review the preview. The account ID is read from the base URL, and the token from the Authorization header if the old provider was keyless. Fill in either by hand if it could not be read.
2. Re-enter any secret stored as a masked literal; env. references carry over.
3. Confirm. Keys, virtual key grants, budgets, and rate limits keep working. Request path overrides and allowed-request restrictions are not carried over.

​

1. Chat Completions

curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "cloudflare/@cf/meta/llama-4-scout-17b-16e-instruct",
    "messages": [{"role": "user", "content": "Hello!"}]
  }'

​

2. Responses API

BifrostResponsesRequest
  → ToChatRequest()
  → ChatCompletion
  → ToBifrostResponsesResponse()

​

3. Embeddings

curl -X POST http://localhost:8080/v1/embeddings \
  -H "Content-Type: application/json" \
  -d '{
    "model": "cloudflare/@cf/baai/bge-large-en-v1.5",
    "input": "Bifrost is an AI gateway"
  }'

​

4. Decisions

curl http://localhost:8080/v1/decisions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "cloudflare/clef-flash",
    "input": "Customer message: I was double charged and nobody replied to my two emails.",
    "questions": [
      { "type": "predicate", "name": "is_frustrated", "instructions": "Is the customer frustrated?" }
    ]
  }'

• Images are supported. input_image parts are moved into Clef’s images field. Send them as base64 data URLs.
• Validation is strict. Clef returns a 422 for a null input or for any field it does not define, so do not pass extra params to it.

​

5. List Models

​

Caveats