Update example for AI Gateway + BYOK + @ai-sdk/anthropic

[kamal]

With the following set up:

1. Authenticated Cloudflare AI Gateway
2. Anthropic API token stored in AI Gateway's Provider Key
3. @ai-sdk/anthropic

To successfully set up @ai-sdk/anthropic, you need to specify

const anthropic = createAnthropic({
  apiKey: "",
  baseURL: await env.AI.gateway(env.GATEWAY_ID).getUrl("anthropic"),
  headers: {
    "cf-aig-authorization": `Bearer ${env.GATEWAY_API_KEY}`,
  }
});

• apiKey is needed even if it's an empty string even though we've provided the Anthropic api key to AI Gateway. ai-sdk will throw an exception if it's not defined (and ANTHROPIC_API_KEY doesn't exist in env)
• passing in custom header for cf-aig-authorization is needed if running authenticated AI Gateway

It would be ideal if AI Gateway will take the gateway API key as apiKey and move it to x-api-token so that the definition could just be

const anthropic = createAnthropic({
  apiKey: GATEWAY_API_KEY,
  baseURL: await env.AI.gateway(env.GATEWAY_ID).getUrl("anthropic")
});

[threepointone]

this seems like an issue to file with ai sdk

[kamal]

Maybe? Or this could be an issue for the AI Gateway team to make the DX smoother. Alternatively, support calling non-open source models in workers-ai-provider if you use it in conjunction with the AI Gateway. I would prefer

const workersai = createWorkersAI({ binding: env.AI });
const model = workersai("@anthropic/claude-sonnet-4-20250514");

[threepointone]

yup we could probably handle this in ai-gateway-provider

[jezweb]

This is what claude decided was the fix for this problem, seems not ideal but works:

Cloudflare AI Gateway BYOK:

• Gateway stores the key ✅ (you did this)
• Gateway adds it automatically only when requests arrive without auth headers
• Anthropic SDK always sends auth headers = incompatible with BYOK

Our Solution (AI Gateway WITHOUT BYOK):

• Worker secret stores key ✅ (you just added it)
• Anthropic SDK sends key in headers
• AI Gateway passes it through while logging everything
• You still get: analytics, caching, rate limiting, logging 📊