Comparison

KeyVault Edge vs Cloudflare AI Gateway

Both sit between your app and an AI provider and can hold the provider key for you. They're built for different callers: AI Gateway for your servers, KeyVault Edge for code that ships to users' browsers and phones.

Pick Cloudflare AI Gateway if

Your AI calls already come from a server or a Worker, and the gateway credential never leaves it.
You want response caching, gateway analytics and logs across many model providers.
You're already on Cloudflare and want it free: core features are available on all plans.

Pick KeyVault Edge if

The call has to come from browser or mobile code and you don't want to run a backend for it.
You want one token per app or customer, each with its own allowed hosts, endpoints, rate limits and monthly cost cap, revocable without rotating the provider key.
You also proxy non-AI APIs (Stripe, Twilio, SendGrid or any HTTPS API).
You want an incident evidence report for a provider billing dispute if a token is abused.

Side by side

	KeyVault Edge	Cloudflare AI Gateway
Holds the provider key and injects it upstream	Yes, encrypted; added at the edge per request	Yes, with stored keys (BYOK)
Credential your app sends	A kvt_ token scoped to one key, with its own allowed hosts and endpoints	A Cloudflare API token; any token with AI Gateway Run can use every gateway in the account
Rate limiting	Per token: per minute, hour and day	Per gateway or per request, sliding or fixed window
Spend limit	Monthly cost cap per token (estimated from model prices)	Budget limits through dynamic routes
Response caching
Logs	Per-token usage and blocked attempts, exportable as an evidence report	Dashboard analytics and logs (100,000 stored logs on the free plan)
Price	$9/month (Developer), or $90 once for 12 months	Core features free on all plans; 5% fee on Unified Billing credits

The difference that matters: who holds the credential

AI Gateway authenticates requests with a Cloudflare API token. That's the right design for a server, and the wrong thing to put in a web page: Cloudflare's own docs note that any token with AI Gateway Run can send requests through every gateway in the account, including gateways with stored provider keys.

A KeyVault Edge token is meant to sit in client code. A copy can be read from your bundle, so what limits it is the policy attached to it: browsers on other sites are refused by the Origin check, calls outside the allowed endpoints are refused, and rate limits and the monthly cost cap bound what a copy can spend. A script outside a browser can fake the Origin header, which is exactly why the caps and one-click revoke exist.

See it work before you decide

The free sandbox adds a fake key to a new account and sends three real requests through the proxy: one allowed, one from a foreign site, one to a blocked endpoint. No real key needed. Plans start at $9/month, or $90 once for 12 months with no auto-renewal.

Sources

Checked November 2026. Products change; if something here is out of date, email support@keyvaultedge.com and we'll fix it.