ai-gateway.mjs

Functions

Imports

It imports no other module of this repo. No module of this repo imports it.

Source

1/**
2 * Where a site sends its Anthropic calls: Cloudflare AI Gateway when the site is configured for it, Anthropic directly
3 * when it is not. One decision for every site, so the gateway's URL check, its sign-in header and the body-logging
4 * switch are made once and cannot drift apart per site.
5 *
6 * - OPT IN, BY ENVIRONMENT. With `AI_GATEWAY_BASE_URL` unset the answer is Anthropic's own origin and no extra header,
7 *   so a site behaves exactly as before until its gateway exists. Set, it is the gateway's Anthropic endpoint,
8 *   `https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/anthropic` (developers.cloudflare.com/ai-gateway/
9 *   usage/providers/anthropic/), or a custom domain's `/anthropic`. Anything not https or not ending in `/anthropic`
10 *   throws: a gateway URL that is set but wrong would otherwise send every call to the wrong place.
11 * - THE SITE'S OWN KEY STAYS THE CREDENTIAL. The caller still sends its Anthropic key (`x-api-key`) and the gateway
12 *   passes it on, so no key is stored in the gateway and billing stays with Anthropic.
13 * - AUTHENTICATED GATEWAY. A gateway with authentication on (the default for a new one) refuses a request without
14 *   `cf-aig-authorization: Bearer <token>`; `AI_GATEWAY_TOKEN` is that token. It is optional so a gateway with
15 *   authentication off also works.
16 * - BODIES ARE NOT LOGGED. AI Gateway stores request and response bodies by default; the sites' prompts carry readers'
17 *   and customers' data. `cf-aig-collect-log-payload: false` keeps the metadata log (model, tokens, cost, status,
18 *   duration), which is what the gateway is for, and drops the bodies (AI Gateway changelog, 2026-03-17). It is a header
19 *   in code rather than a dashboard toggle so it cannot drift unseen.
20 * - ONE GATEWAY, SPLIT BY SITE. `cf-aig-metadata: {"app": ...}` tags each log entry with the site, so one gateway's logs
21 *   and analytics still separate the sites.
22 */
23
24export const ANTHROPIC_ORIGIN = "https://api.anthropic.com";
25
26/** The AI Gateway request headers this module sets, spelled as Cloudflare documents them. */
27export const AI_GATEWAY_HEADERS = Object.freeze({
28  auth: "cf-aig-authorization",
29  bodyLog: "cf-aig-collect-log-payload",
30  metadata: "cf-aig-metadata",
31});
32
33/**
34 * The base URL for a site's Anthropic calls and the headers that go with them. Pass `baseURL` and `headers` to the
35 * Anthropic SDK as `baseURL` and `defaultHeaders`, or fetch `${baseURL}/v1/messages` with `headers` added.
36 * @param {{ AI_GATEWAY_BASE_URL?: string; AI_GATEWAY_TOKEN?: string }} env
37 * @param {string} app the site's name, as the gateway's logs should show it
38 * @returns {{ baseURL: string; headers: Record<string, string>; gateway: boolean }}
39 */
40export function anthropicRoute(env, app) {
41  const url = env.AI_GATEWAY_BASE_URL?.trim().replace(/\/+$/, "") ?? "";
42  if (!url) return { baseURL: ANTHROPIC_ORIGIN, headers: {}, gateway: false };
43  if (!/^https:\/\/[^/]+\/.*anthropic$/.test(url)) {
44    throw new Error(
45      "AI_GATEWAY_BASE_URL must be the gateway's Anthropic endpoint, https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/anthropic",
46    );
47  }
48  /** @type {Record<string, string>} */
49  const headers = {
50    [AI_GATEWAY_HEADERS.bodyLog]: "false",
51    [AI_GATEWAY_HEADERS.metadata]: JSON.stringify({ app }),
52  };
53  const token = env.AI_GATEWAY_TOKEN?.trim();
54  if (token) headers[AI_GATEWAY_HEADERS.auth] = `Bearer ${token}`;
55  return { baseURL: url, headers, gateway: true };
56}