Switch from Cloudflare AI Gateway to TokenZero in one line
Cloudflare AI Gateway is an edge proxy with caching, rate limiting and analytics in front of model providers. TokenZero is a BYOK savings gateway: you keep the base-URL swap; TokenZero sits behind Cloudflare itself, so edge latency is the same order, and every request comes back with a signed receipt for what it saved.
The change
OPENAI_BASE_URL=https://tokenzero.sh/w//v1 ANTHROPIC_BASE_URL=https://tokenzero.sh/w/ # provider keys stay in your code exactly as they are; nothing else changes
Create the workspace first:
curl -s -X POST https://tokenzero.sh/v1/signup -d '{}' # workspace + key, no form
npx -y @tokenzero/cli init # or: audits the repo, writes .envWhat differs from Cloudflare AI Gateway
- Response caching is only one of four engines: prompt-cache formatting and cascade routing reduce the cost of requests that cannot be cached at all.
- Savings are signed per request with the list-price baseline, not inferred from cache hit rates.
- Hosted audits and the CLI find waste in your source code before it is sent.
What TokenZero does
- Bring your own key. Provider keys pass through untouched; TokenZero never holds them.
- Four engines. Prompt-cache formatting (Anthropic breakpoints, OpenAI
prompt_cache_key/ 12h retention), exact and semantic response cache, calibrated cascade routing with a shadow-parity breaker, and a signed savings ledger. - Measured, not claimed. Gateway overhead and the audit corpus are published on /benchmarks with the scripts that produced them.
- Free up to $500/month of routed spend; paid plans are a share of verified savings with a 3x-ROI-or-$0 rule.
Verified, not reported
Every request through the gateway gets an Ed25519-signed receipt with list-price baseline, actual provider cost and the difference, chained per workspace (seq, prev_receipt_hash), verifiable offline with npx -y @tokenzero/cli verify --chain.
Questions
Does the cache work the same way?
Exact caching applies to deterministic requests (temperature 0 or opt-in); semantic caching is opt-in per workspace. Each entry belongs to one workspace and expires on its TTL (1 hour default, up to 30 days).
Is there a migration tool?
No tool is needed: change the base URL (or the /w/<key>/ prefix) and keep your provider keys. Run npx -y @tokenzero/cli audit first to see what the gateway will act on.