Today, Vantage is launching Token Allocation Support for Cloudflare AI Gateway, turning gateway request metadata into dimensions teams can use to measure and control AI spend. Teams routing LLM traffic through Cloudflare can natively enrich AI cost data with per-request metadata—such as team, product, customer, purpose, or environment—so it becomes available as tags directly in Vantage to use for cost allocation, budgets, alerting, and more.

Vantage published the Token Cost Allocation Specification with the goal being to give teams a common way to bring request-level logs and provider cost data together into the dimensions they actually measure spend by, like team, product, environment, or customer. The spec defines how to attribute token usage proportionally, keep totals aligned with what vendors bill, and carry those dimensions into reporting. Any gateway or logging pipeline that can write that common format to S3 can use it. For customers on gateways like Cloudflare AI Gateway, that used to mean they would have needed to create the same ETL in order to transform their log data to send to Vantage to use enriched LLM cost data.

Now, with the launch of Native Cloudflare AI Gateway Token Allocation, customers can provide Vantage read access to their Cloudflare AI gateway logs, allowing Vantage to continuously enrich their AI spend with request-level metadata for granular allocation. Vantage handles decryption, normalization, deduplication, matching, and allocation. When present, built-in fields such as gateway name, cache status, and rate-limit status are automatically mapped to allocation tags alongside the custom metadata attached at the gateway. The resulting tags are available across Cost Reports, Virtual Tags, Budgets, and Cost Alerts. For example, if an agent attaches a user or user_token to each gateway request, teams can identify which users drove inference spend, even when multiple agents share the same provider API key.

Native Cloudflare AI Gateway Token Allocation is generally available today at no additional cost. To get started, add a Cloudflare AI Gateway source under LLM Enrichment on the Integrations page. See the Cloudflare AI Gateway enrichment documentation for Logpush setup, decryption-key requirements, and tagging guidance.

Frequently Asked Questions

1. What is Vantage launching?

Vantage is launching native Cloudflare AI Gateway enrichment for Token Cost Allocation. Customers can connect encrypted Cloudflare AI Gateway logs from an S3 bucket they own, then use the metadata in those logs to allocate supported model provider costs.

2. Who is this for?

Any Vantage customer using Cloudflare AI gateway as a proxy for their AI consumption.

3. How much does it cost?

There is no additional charge for Cloudflare AI Gateway enrichment. It is included for customers with a supported provider integration, and allocated costs do not count against a separate meter.

4. How does this relate to the Token Cost Allocation Specification?

The Token Cost Allocation Specification remains the common model Vantage uses to allocate AI token costs: join gateway telemetry to provider bills, split costs by token share, preserve bill totals, and surface allocation tags in reporting.

Custom LLM Enrichment is the provider-agnostic path for any source that can emit the schema directly, and the native Cloudflare AI Gateway enrichment inherits that same allocation logic, allowing Cloudflare AI Gateway users an easier path to utilizing the specification. Native bindings for LiteLLM, OpenRouter, and other gateways are on the Vantage roadmap.

5. How does it work?

Cloudflare AI Gateway Logpush writes encrypted, per-request logs to an S3 bucket owned by the customer, under a path ending in YYYYMMDD/*.log.gz (an optional prefix is allowed). In Vantage, the customer connects that bucket as a Cloudflare AI Gateway enrichment source and uploads the RSA private key used to decrypt the objects. Vantage adds read-only S3 permissions to the customer’s existing AWS cross-account role; it does not create a new role or require long-lived AWS credentials.

With each provider cost import, Vantage:

• Decrypts and reads Logpush objects for the relevant dates
• Normalizes successful requests by provider, model, token usage, and metadata tags
• Deduplicates requests on the request identifier within each day (when duplicates exist, the record with the highest total token count wins) and aggregates tokens by tag combination
• Splits matching provider cost rows in proportion to token share
• Appends the corresponding tags to the enriched cost rows, plus a vntg:ai:model tag

Only successful requests with provider, model, and at least one positive token usage count enter the usage index. Non-successful requests—including missing or empty response bodies, non-2xx status, rate-limited requests, or response errors—are skipped. Deduplication uses the provider request ID when present; otherwise, Vantage derives a stable fingerprint from the request ID, timestamp, model, endpoint, and usage.

Provider-billed cost remains the source of truth. Enrichment changes attribution, not the total cost.

6. How do I configure this in Cloudflare?

You will need:

• An AI Gateway with logging enabled
• Workers Logpush available on the Workers Paid plan, with a Logpush job that selects the AI Gateway dataset and delivers encrypted logs to S3 under a day-partitioned YYYYMMDD/*.log.gz path
• Custom request metadata for the dimensions you want to allocate, such as team, purpose, customer, or environment (Cloudflare saves up to five entries per request; string, number, and boolean values only)
• An RSA key pair: the public key uploaded to AI Gateway settings, and the matching PEM-encoded private key for Vantage

Vantage does not create or manage the Logpush job. Customers retain ownership of the bucket and key material.

7. What permissions are required in Vantage?

In Vantage, an Organization Owner or Integration Owner must connect the Cloudflare AI Gateway enrichment source. Viewing enriched costs does not require a special role; the resulting tags follow the same access rules as other cost data.

In AWS, Vantage uses read-only access to the selected bucket:

• s3:GetObject
• s3:GetObjectAcl in generated policies
• s3:ListBucket
• s3:GetBucketLocation
• kms:Decrypt when the bucket uses SSE-KMS

When applicable, KMS grants are configured separately from the generated S3 policies.

8. Does Vantage have write access to Cloudflare or S3?

No. Vantage does not use a Cloudflare API token for this enrichment path, does not modify gateway configuration, and does not write to the connected S3 bucket.

This path is separate from the Cloudflare provider integration, which imports Cloudflare platform spend such as Workers through the Cloudflare API. Cloudflare AI Gateway enrichment only reads encrypted log objects from your S3 bucket and reattributes costs from your model-provider integrations.

9. Which provider costs are supported?

Cloudflare AI Gateway enrichment supports the following providers:

• OpenAI
• Anthropic
• Amazon Bedrock
• Azure OpenAI
• Google Vertex AI
• Google AI Studio
• Cloudflare Workers AI
• xAI
• ElevenLabs
• Baseten

Azure CSP billing accounts are not supported.

10. Do I need a Cloudflare cost integration to use this?

No, you do not need to have the Cloudflare cost integration in Vantage to use the Cloudflare AI Gateway integration.

11. Which tags and dimensions become available?

When present, Vantage includes gateway request-context tags from top-level Logpush fields: gateway, cached, and rate_limited. endpoint is promoted to vntg:ai:endpoint rather than a bare endpoint tag. Safe scalar entries in custom metadata also become allocation tags, with keys normalized to snake_case. Cloudflare AI Gateway currently allows up to five custom metadata entries per request (string, number, or boolean values), so customers should prioritize stable, low-cardinality business dimensions such as team, purpose, environment, and customer.

Never include API key values, credentials, secrets, or other sensitive authentication material in custom metadata. Prefer keeping request-scoped identifiers out of metadata as well. Request identifiers and resourceAccountId / resource_account_id are never turned into tags. High-cardinality keys can also make reports harder to use.

If one bucket contains traffic for multiple integrations of the same provider, customers should add resourceAccountId or resource_account_id to the metadata so Vantage can match requests to the correct provider account.

Enriched rows also receive Vantage-managed vntg:ai:* tags such as vntg:ai:model, vntg:ai:token_type, and related fields when present. Once enriched rows exist for the selected period, the new attributes appear in the Tag Key menu in Cost Reports, and can be used with Virtual Tags, Budgets, and Cost Alerts.

12. Do I need to change what my app sends through Cloudflare AI Gateway?

Not if the application already sends useful metadata through Cloudflare AI Gateway. It can continue calling models through the gateway as it does today. On the Vantage side, the only work is connecting the Logpush bucket and decryption key.

If request metadata does not yet contain the dimensions needed for allocation, the application or gateway configuration must add them so those values are present in each log record.

13. Do Cloudflare customers still need Custom LLM Enrichment?

Not for traffic captured by the Cloudflare AI Gateway. Native enrichment removes the need to transform those logs into the common schema.

Custom LLM Enrichment remains appropriate for non-Cloudflare sources, mixed pipelines, and teams that already emit the Token Cost Allocation Specification from their own collectors.

14. Does Vantage collect prompts or completions?

No. Enrichment is metadata-only. To read the provider, model, token counts, and custom metadata, Vantage transiently decrypts each record’s encrypted fields (including request and response bodies) in memory, but it extracts only those values. Prompt and completion text are never collected, stored, or written to a Vantage-owned artifact, and enrichment data is not used to train models.

15. How fresh are allocated costs?

Allocation runs as part of each provider’s existing cost-ingestion process and follows that provider’s refresh cadence. Vantage reprocesses a rolling three-day window so late-arriving objects are picked up automatically.

16. What happens when the Cloudflare log volume does not match the provider bill?

The same reconciliation rules used by Custom LLM Enrichment apply:

• If telemetry covers fewer tokens than the bill, Vantage creates a leftover row for the uncovered amount.
• If telemetry reports more tokens than the bill, allocated slices scale down to the billed amount and no leftover row is created.
• If a cost row has no matching telemetry, it passes through unsplit.

In every case, provider-level totals remain unchanged.

17. Why might costs fail to split?

Common causes include:

• There is no active Cloudflare AI Gateway source, or logs have not been ingested for that billing period
• The cost row’s model or token type could not be matched to a logged request for that provider, date, and token kind
• Records were skipped because decrypted metadata was missing, the provider was blank or unsupported, the model was blank or unmatched, the request was not successful, or no usage value was a positive integer
• Multiple integrations share a provider, but resourceAccountId / resource_account_id is missing

After connecting the source, use Check Permissions and confirm that the intended metadata keys are present on live gateway traffic. See the accepted Provider values in the documentation.

18. What does Vantage read from each Logpush record?

For each decryptable request, Vantage uses provider, model, token usage, success status, and metadata used for allocation. From top-level fields it also reads gateway, endpoint, cache, and rate-limit context. Only successful requests with at least one positive token usage count contribute to allocation.

19. What happens after I connect?

Vantage validates S3 read access and that the uploaded private key can decrypt a sample object through Check Permissions. Connecting immediately scans recent gateway logs—from the first day of the previous calendar month through today—so you can review which providers were found and choose which connected cost integrations should receive enrichment. On each selected provider’s next data refresh, Vantage builds a usage index from the gateway logs days in the billing period, joins indexed tokens to matching cost rows, and writes enriched rows. Recent days reopen on a three-day window so late objects are picked up; older days rebuild when the set of objects for that day changes. A given cost integration can have only one active gateway enrichment source; Cloudflare AI Gateway and Custom LLM Enrichment cannot both enrich the same provider cost integration at the same time.