Skip to content

Add CF_AI_GATEWAY_MODEL for arbitrary AI Gateway model selection#187

Merged
andreasjansson merged 8 commits intomainfrom
ai-gateway-model
Feb 6, 2026
Merged

Add CF_AI_GATEWAY_MODEL for arbitrary AI Gateway model selection#187
andreasjansson merged 8 commits intomainfrom
ai-gateway-model

Conversation

@andreasjansson
Copy link
Collaborator

Adds CF_AI_GATEWAY_MODEL env var that lets users choose any model through Cloudflare AI Gateway — not just Anthropic. This enables Workers AI, OpenAI, Groq, and any other AI Gateway provider with a single env var.

OpenClaw's built-in cloudflare-ai-gateway provider hardcodes the /anthropic endpoint. This PR works around that by patching the config at startup to add a provider entry for whatever gateway provider the user specifies.

Usage

npx wrangler secret put CF_AI_GATEWAY_MODEL
# Enter: workers-ai/@cf/meta/llama-3.3-70b-instruct-fp8-fast

Format is provider/model-id. Works with any AI Gateway provider:

Provider Example value
Workers AI workers-ai/@cf/openai/gpt-oss-120b
OpenAI openai/gpt-4o
Anthropic anthropic/claude-sonnet-4-5
Groq groq/llama-3.3-70b

Requires CLOUDFLARE_AI_GATEWAY_API_KEY, CF_AI_GATEWAY_ACCOUNT_ID, and CF_AI_GATEWAY_GATEWAY_ID to be set. When CF_AI_GATEWAY_MODEL is not set, existing behavior is unchanged (defaults to Anthropic Claude Sonnet 4.5).

Changes

  • start-openclaw.sh: Config patch parses provider/model-id, constructs the gateway URL, picks the API type, and sets it as default model
  • src/types.ts, src/gateway/env.ts: Pass CF_AI_GATEWAY_MODEL and CF_ACCOUNT_ID through to container
  • README.md: Rewrite AI Gateway section with setup instructions, model selection docs, provider table, Unified Billing note, and legacy deprecation notice
  • .dev.vars.example: Add CF_AI_GATEWAY_MODEL
  • .github/workflows/test.yml: Add new AI Gateway secrets, add workers-ai matrix entry

Andreas Jansson added 4 commits February 6, 2026 19:09
- Quick Start: replace legacy AI_GATEWAY_* with new env vars
- AI Gateway section: rewrite with explanation of how the gateway proxies
  requests and what each secret actually is
- Clarify that CLOUDFLARE_AI_GATEWAY_API_KEY is your provider's API key
  (e.g. Anthropic key), not a Cloudflare-specific key — it's forwarded
  through the gateway to the upstream provider
- All three secrets (API key + account ID + gateway ID) are required
- Secrets table: add new vars, deprecate old AI_GATEWAY_* vars
- Add legacy deprecation note
Add CF_AI_GATEWAY_MODEL env var (format: provider/model-id) that lets
users choose any model through Cloudflare AI Gateway. The startup
script parses the provider slug, constructs the correct gateway URL,
picks the API type (anthropic-messages or openai-completions), and
patches the OpenClaw config.

Examples:
  workers-ai/@cf/meta/llama-3.3-70b-instruct-fp8-fast
  openai/gpt-4o
  anthropic/claude-sonnet-4-5
  groq/llama-3.3-70b

For Workers AI without an AI Gateway, falls back to the direct
Cloudflare API using CF_ACCOUNT_ID.

Changes:
- types.ts: add CF_AI_GATEWAY_MODEL to MoltbotEnv
- env.ts: pass CF_AI_GATEWAY_MODEL and CF_ACCOUNT_ID to container
- env.test.ts: tests for new passthrough
- start-openclaw.sh: config patch for provider + default model
- README.md: document model selection, provider table, secrets ref
- .dev.vars.example: add CF_AI_GATEWAY_MODEL
- Add new secrets: CLOUDFLARE_AI_GATEWAY_API_KEY, CF_AI_GATEWAY_ACCOUNT_ID,
  CF_AI_GATEWAY_GATEWAY_ID (keep legacy AI_GATEWAY_* for compat)
- Pass CF_AI_GATEWAY_MODEL from matrix to env
- Add 'workers-ai' matrix entry with CF_AI_GATEWAY_MODEL=workers-ai/@cf/openai/gpt-oss-120b
- Remove legacy ANTHROPIC_BASE_URL provider patching that creates a
  provider entry without a models array, breaking OpenClaw v2026.2.3
  config validation. The Anthropic SDK picks up ANTHROPIC_BASE_URL
  from the environment natively.
- Remove console.log that dumps the full config (including API keys
  and gateway tokens) to stdout.
Andreas Jansson added 4 commits February 6, 2026 19:23
The deploy script was only pushing legacy AI_GATEWAY_* secrets.
Add CLOUDFLARE_AI_GATEWAY_API_KEY, CF_AI_GATEWAY_ACCOUNT_ID,
CF_AI_GATEWAY_GATEWAY_ID, and CF_AI_GATEWAY_MODEL.
OpenClaw v2026.2.3 requires explicit credentials when using --url
override. All openclaw devices CLI invocations (list, approve,
approve-all) now pass --token from MOLTBOT_GATEWAY_TOKEN.

This was the root cause of 'Container service disconnected' errors
and missing devices in the admin UI — the devices list CLI command
was failing with 'gateway url override requires explicit credentials'.
@andreasjansson andreasjansson merged commit 5593ac1 into main Feb 6, 2026
4 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant