switch guide · updated 2026-10-26

Switch from Cloudflare AI Gateway to TokenZero in one line

Cloudflare AI Gateway is an edge proxy with caching, rate limiting and analytics in front of model providers. TokenZero is a BYOK savings gateway: you keep the base-URL swap; TokenZero sits behind Cloudflare itself, so edge latency is the same order, and every request comes back with a signed receipt for what it saved.

The change

OPENAI_BASE_URL=https://tokenzero.sh/w//v1
ANTHROPIC_BASE_URL=https://tokenzero.sh/w/
# provider keys stay in your code exactly as they are; nothing else changes

Create the workspace first:

curl -s -X POST https://tokenzero.sh/v1/signup -d '{}'   # workspace + key, no form
npx -y @tokenzero/cli init                                # or: audits the repo, writes .env

What differs from Cloudflare AI Gateway

  • Response caching is only one of four engines: prompt-cache formatting and cascade routing reduce the cost of requests that cannot be cached at all.
  • Savings are signed per request with the list-price baseline, not inferred from cache hit rates.
  • Hosted audits and the CLI find waste in your source code before it is sent.

What TokenZero does

  • Bring your own key. Provider keys pass through untouched; TokenZero never holds them.
  • Four engines. Prompt-cache formatting (Anthropic breakpoints, OpenAI prompt_cache_key / 12h retention), exact and semantic response cache, calibrated cascade routing with a shadow-parity breaker, and a signed savings ledger.
  • Measured, not claimed. Gateway overhead and the audit corpus are published on /benchmarks with the scripts that produced them.
  • Free up to $500/month of routed spend; paid plans are a share of verified savings with a 3x-ROI-or-$0 rule.

Verified, not reported

Every request through the gateway gets an Ed25519-signed receipt with list-price baseline, actual provider cost and the difference, chained per workspace (seq, prev_receipt_hash), verifiable offline with npx -y @tokenzero/cli verify --chain.

Questions

Does the cache work the same way?
Exact caching applies to deterministic requests (temperature 0 or opt-in); semantic caching is opt-in per workspace. Each entry belongs to one workspace and expires on its TTL (1 hour default, up to 30 days).

Is there a migration tool?
No tool is needed: change the base URL (or the /w/<key>/ prefix) and keep your provider keys. Run npx -y @tokenzero/cli audit first to see what the gateway will act on.