Cloudflare AI Gateway vs OpenRouter for GPT Image 2

Comparing Cloudflare AI Gateway with OpenRouter begins with a category mistake: they do not occupy the same layer. For teams calling GPT Image 2 from a Cloudflare Worker, the practical decision is which request path should carry the image job.

OpenRouter is a model aggregator and inference router. Cloudflare AI Gateway is a control layer that can sit in front of a provider, including OpenRouter. A Cloudflare Worker can also call a third-party model through the AI binding and Unified Billing, which is a different route again. In some systems, all three names can appear in the same request path.

For GPT Image 2, that distinction changes the endpoint, credentials, billing account, request schema, response shape, privacy controls, rate limits, and what a Hong Kong or Singapore location actually tells you.

Direct OpenRouter is the clearest documented baseline for the Images API. AI Gateway becomes useful when Cloudflare-side logging or policy controls justify another layer, although the image endpoint still needs to be verified. The AI binding serves Cloudflare's managed third-party billing path. A relay belongs in the design only when fixed egress is an explicit network requirement.

The useful starting point is the path, not the logo:

Application
  -> Cloudflare Worker
       -> OpenRouter Images API -> OpenAI
       -> Cloudflare AI Gateway -> OpenRouter -> OpenAI
       -> Cloudflare AI binding + AI Gateway -> OpenAI
       -> fixed-egress relay -> OpenRouter or another provider

These routes solve different problems. Treating them as interchangeable is how an apparently small provider change turns into failed image jobs.

Cloudflare AI Gateway vs OpenRouter: which layer fits your image workflow?

A Worker calling OpenRouter directly

This is the shortest documented OpenRouter path. The Worker sends an OpenRouter token to the dedicated Images API, and OpenRouter routes the request to an eligible upstream provider. At the time of this review, the GPT Image 2 endpoint metadata lists one provider: OpenAI.

OpenRouter owns the API contract, usage record, provider routing policy, and credit balance for this path. Cloudflare still runs the Worker, but it is not the AI billing intermediary.

For a team that wants a broad AI image generation API and may switch models, this route has the clearest public contract. It also has the fewest extra hops to diagnose.

AI Gateway in front of OpenRouter

Cloudflare documents an OpenRouter adapter at an AI Gateway URL. The request still carries an OpenRouter token, and OpenRouter still handles model routing and inference billing. AI Gateway adds Cloudflare-side logging, analytics, rate controls, caching controls, and other gateway features around the call.

There is an important caveat for image generation. Cloudflare's current OpenRouter provider guide shows chat/completions, not OpenRouter's dedicated /api/v1/images endpoint. The page also contains inconsistent chat path examples. That is not enough evidence to call the Images API a drop-in supported route.

The architecture is plausible and attractive, but the exact image endpoint must pass an authenticated production-like test before a team depends on it. An observability layer is only useful if it preserves the API you need.

The Cloudflare AI binding with Unified Billing

This route does not call OpenRouter. The Worker calls env.AI.run() with Cloudflare's third-party model ID:

openai/gpt-image-2

The model is explicitly marked Third-party in Cloudflare's catalog. It is not a native @cf/... Cloudflare Workers AI model, so the native Workers AI Neuron allowance and image-model price table do not apply.

Third-party binding calls require an AI Gateway. Cloudflare can use managed provider credentials and deduct Unified Billing credits. A stored BYOK key under the default alias takes precedence. Other aliases are ignored on the binding path and fall back to Unified Billing; selecting a non-default alias requires a provider-native endpoint plus cf-aig-byok-alias.

This path is appealing when consolidated Cloudflare billing, gateway controls, or managed credentials matter more than keeping the OpenRouter interface. It is a migration, though, not a base-URL substitution.

A fixed-egress relay

A relay is a small backend service with a stable public network location. The Worker calls the relay; the relay calls OpenRouter or another provider. It is useful when an upstream service enforces source-IP allowlists, source-country rules, or network behavior that the edge runtime cannot guarantee.

The relay does not choose where OpenAI runs the model. It only makes the outbound caller's network location predictable. In exchange, the team owns another service, including its capacity, secrets, timeouts, queues, monitoring, patching, and regional availability.

That makes a relay a narrow infrastructure tool, not a default ingredient in an AI stack.

GPT Image 2 exposes the contract differences

Both Cloudflare and OpenRouter currently list the direct model as openai/gpt-image-2, but the matching name hides different interfaces. Do not substitute a related GPT-5.4 Image 2 wrapper ID without checking the live endpoint metadata: a product label is not always the API model ID.

OpenRouter's public GPT Image 2 endpoint metadata supports up to 16 input references, quality controls, multiple aspect ratios, n from 1 to 10, output compression, and streaming. Its Images API returns base64-encoded image data and usage information. These capabilities should still be read from the live endpoint record because provider support can change.

Cloudflare's model schema accepts a prompt plus up to 16 base64 image inputs, along with quality, size, background, and output-format fields. Its documented output contains an image URI. It is not the binary ReadableStream used by some native Workers AI image examples.

An application moving between the two should normalize a provider result into its own internal object, for example:

type GeneratedImage = {
  bytes?: Uint8Array;
  sourceUrl?: string;
  mediaType: string;
  providerRequestId?: string;
  costUsd?: number;
};

That boundary is more valuable than a universal provider wrapper that assumes all image APIs accept the same fields. Reference-image encoding, streaming, multiple outputs, usage reporting, and errors should be tested as separate capabilities. Treat transparent backgrounds as unsupported until Cloudflare's catalog and schema agree or an integration test proves the response.

OpenRouter pricing and Cloudflare billing are close on fees, not identical in cost

The public OpenRouter GPT Image 2 endpoint record lists input image tokens at $8 per million, input text tokens at $5 per million, and output image tokens at $30 per million. OpenRouter says it passes through provider inference pricing without markup. Stripe credit purchases carry a 5.5% fee with a $0.80 minimum; crypto credit purchases carry a 5% fee.

Cloudflare also says it passes through provider inference pricing without markup. Unified Billing adds 5% when credits are purchased. Its public GPT Image 2 page points to the authenticated dashboard for the exact model price, so a defensible public comparison cannot manufacture a Cloudflare per-image number from the fee alone.

Nor can either token rate be converted into a universal "$X per image." Input references, output dimensions, quality, and the delivered image all affect usage. The useful number is the mean cost of successful images from a representative workload, with retries and failed jobs reported separately.

Cloudflare-managed Unified Billing requests also have a documented limit of 200 requests per 60 seconds per gateway. BYOK traffic is not subject to that specific managed-credential limit. This is a request-rate limit, not a promise about concurrent image-generation capacity or completion time.

The funding-fee difference is rarely the whole architecture decision. A real cost model also includes failed generations, duplicate retries, object storage, gateway log storage, relay hosting, operational work, and the cost of a model switch. In image systems, reliability can outweigh a small percentage-point credit fee.

AI Gateway privacy is separate from provider retention

"Zero data retention" is not one switch that covers every hop.

Cloudflare marks its GPT Image 2 third-party route as ZDR-capable for eligible Unified Billing traffic using Cloudflare-managed credentials. That control is separate from AI Gateway logging. Gateway logs are enabled by default and can include request and response payloads. A caller can disable the log entry with cf-aig-collect-log: false, or keep metadata while excluding raw payloads with cf-aig-collect-log-payload: false.

OpenRouter says it records request metadata but does not store prompts or responses by default, including on errors, unless the customer opts in. The request still reaches an upstream model provider, so that provider's current retention and training policy remains part of the decision. OpenRouter privacy settings can restrict routing when an endpoint does not meet the selected policy.

At the August 25, 2026 snapshot, OpenRouter's provider-policy record reported OpenAI as training: false while still indicating prompt retention. Re-fetch that policy before publication because provider settings can change separately from model endpoint metadata.

For product image generation, prompts may contain unreleased product details and references may contain brand assets. A practical policy therefore names every data processor in the path, disables raw gateway payload logs unless they are needed, and records which provider policy was accepted. Adding a gateway does not erase the provider; enabling provider ZDR does not silently disable gateway logs.

A Hong Kong Worker does not mean Hong Kong inference

Cloudflare's edge routing can make a request enter through a Hong Kong colo. That observation identifies where the Worker request was handled. It does not identify the country used for an outbound provider connection, and it says nothing conclusive about where OpenAI ran the image model.

Neither of the reviewed GPT Image 2 interfaces exposes a parameter that fixes the inference region. OpenRouter currently shows a single OpenAI endpoint for the model, so general provider-routing options do not create an alternative Singapore GPT Image 2 provider. Putting Cloudflare AI Gateway in the middle adds controls, but its documentation does not promise Singapore egress for an OpenRouter-bound request.

This is why a regional diagnosis needs more than request.cf.colo. Record the Worker colo, exact request path, time to headers or first event, full completion time, provider request ID, HTTP status, retry count, input-reference count, quality, dimensions, and output count. Compare success rate and p50/p95 completion time from the locations that represent actual users.

If the provider explicitly requires a stable source country or IP, a relay in that country can satisfy the network requirement. It still cannot force the provider's internal inference location, and it should not be introduced merely because an edge trace happened to say HKG.

Choose the route by the failure you need to prevent

For the most direct, publicly documented GPT Image 2 API on OpenRouter, call the OpenRouter Images API from the Worker. This is the cleanest baseline for a team that values model access and a consistent aggregator interface.

If Cloudflare-side observability, policy, or spend controls are the primary need, AI Gateway in front of OpenRouter is conceptually the right layer. For image generation, prove the dedicated Images API path first. Do not infer its support from a chat-completions example.

If the goal is Cloudflare-managed credentials and consolidated billing, use the AI binding with the third-party openai/gpt-image-2 contract. Budget and test it as a third-party model, not as free native Workers AI inference.

If the hard requirement is a stable outbound country or IP, use a relay and accept that it becomes a production backend. A relay should have bounded concurrency, queue visibility, idempotent requests, health checks, and a plan for regional failure before it carries customer jobs.

Migrate image jobs without changing every variable at once

The safest migration starts above the provider. Persist an immutable job input, assign an idempotency key, and normalize every provider response into one internal result. That prevents a retry after a timeout from quietly becoming a second billable generation or a second customer charge.

Next, run the target path as a small canary with the same prompts, reference images, quality settings, and output counts used in production. Validate the actual image bytes or URI, not only a 200 response. Record provider IDs, usage, gateway log IDs, end-to-end duration, and failure categories.

Only then move a controlled traffic share. Keep the old path available long enough to separate an endpoint-contract failure from a regional network issue. Changing the model, gateway, response parser, retry policy, and relay in one release produces plenty of logs but very little evidence.

Routing architecture determines whether an image job completes predictably; it does not determine whether the result is commercially useful. For the model and output-quality side of the decision, see our GPT Image 2 vs Gemini product photography comparison.

FAQ: Cloudflare AI Gateway vs OpenRouter

Is Cloudflare AI Gateway a replacement for OpenRouter?

Not by itself. OpenRouter provides model access and routing, while AI Gateway adds a Cloudflare control layer. They can be combined, but they are not the same product or billing path.

Can AI Gateway proxy OpenRouter's Images API?

Cloudflare's current OpenRouter guide documents chat completions, not the dedicated /api/v1/images endpoint. Treat image forwarding as unverified until an authenticated production-like request succeeds.

Does a Hong Kong Worker guarantee Hong Kong or Singapore inference?

No. A Worker colo identifies request ingress, not the provider's outbound connection or model-inference location. Use a relay only when a stable source country or IP is an explicit requirement.

The route matters more than the vendor label

Cloudflare AI Gateway and OpenRouter can appear in the same architecture because they solve different problems. OpenRouter provides model access and routing; AI Gateway adds Cloudflare-side control; the AI binding provides Cloudflare's managed third-party model path. A relay is separate infrastructure for a fixed network exit, not a substitute for any of them.

Then test the exact path you intend to run. A diagram cannot verify an endpoint, a colo code cannot locate inference, and a ZDR label cannot describe every log in a multi-hop system.

Official sources

Facts and API metadata checked on August 25, 2026. Product behavior, pricing, limits, and provider policies can change.

• Cloudflare: OpenRouter provider guide
• Cloudflare: AI Gateway Workers bindings
• Cloudflare: GPT Image 2 model catalog
• Cloudflare: Unified Billing
• Cloudflare: AI Gateway logging
• Cloudflare: AI Gateway limits
• OpenRouter: image generation guide
• OpenRouter: GPT Image 2 endpoint metadata
• OpenRouter: pricing and fees
• OpenRouter: data collection
• OpenRouter: provider logging policies