A Cloudflare (or Vercel) AI Gateway alternative for generative media

AI gateways — Cloudflare's and Vercel's — are excellent at what they do: caching, rate-limiting, analytics, spend limits, and fallback in front of model providers. Both route generative media now, so this isn't about modalities. It's about shape. A gateway hands the output back for you to save; it doesn't take custody, doesn't record media provenance, and its “audit log” is a config-change log. For media that has to survive an audit, a proxy is the wrong layer — and Cloudflare now owns a model host too.

AI gateways = proxy/observability · they route media, but hand outputs back · no custody, no media provenance

Real pipeline output · Z-Image · Kie.ai — receipt in the showcase manifest

First, a correction we owe you, because we got it wrong ourselves at first draft: bothCloudflare AI Gateway and Vercel AI Gateway now route generative media, not just text. Vercel's gateway supports image and video generation directly; Cloudflare's is provider-agnostic and routes hundreds of image and video models (through fal and others). So this page is not "gateways can't do media." They can. It's about a difference in shape that survives that fact.

What an AI gateway is genuinely for

An AI gateway is a proxy that sits in front of model providers and adds the operational layer: caching, rate-limiting, spend limits, analytics, logging, guardrails, and automatic fallback to another provider when one fails. Cloudflare's core gateway features are free and pass provider pricing through with no inference markup (you pay for log volume beyond a generous free tier); Vercel's is pass-through too, with add-on surcharges for optional reporting features. If what you need is observability and resilience in front of your calls, these are very good tools, and we're not competing for that job.

Proxy versus proof layer

The tell is what happens to the output. When Vercel's gateway generates a video, it hands the bytes back to you — a Uint8Arrayor base64 — for you to save. That's the correct design for a gateway. It's also the exact boundary of what a gateway does: the moment the response returns, its job is done. It doesn't take custodyof the asset, it doesn't record where the asset came from, and it doesn't keep the chain when that asset becomes the input to the next job.

A gateway proves your request was fast and cached. A proof layer proves what the request produced, where it went, and that it hasn't changed since.

Cloudflare AI Gateway does have an "Audit logs" feature, which is worth naming precisely because it sounds like provenance and isn't: those logs record gateway configuration changes— a gateway created, deleted, or updated — not the lineage of any generated asset. It's a good ops log. It is not a media audit trail.

What a proxy structurally isn't

A custody point

Gateways return the output for you to store. Custody means the bytes stream into your bucket, byte-exact, with a sha256 recorded at ingestion — a step that has to happen at the layer that holds the asset, not the one that forwarded the request.

A provenance witness

An append-only ledgerof every generation, with lineage across providers, is a different artifact from a proxy's request logs. Config audit logs don't answer "which model made this asset."

A place C2PA marks are defended

A provider-embedded Content Credential survives only where nothing re-encodes the bytes. Defending it is a custody responsibility, not a routing one.

Neutral, once the cloud owns the host

Cloudflare now owns Replicate and is assembling a single AI cloud. A gateway inside that cloud is a fine proxy — but neutral custody is precisely the hedge against any one cloud owning the whole stack.

Side by side, honestly

Capability	Wakemark	AI gateways
Caching, rate-limiting, spend limits, analytics	Spend caps and observability, yes; edge caching in front of calls isn't our job.	The core of what a gateway is for. Cloudflare's and Vercel's are excellent here.
Cross-provider fallback / routing	Capability routing with cross-provider failover, media-native.	Automatic fallback across providers — a headline gateway feature.
Routes generative image + video	The whole media pipeline is the product.	Both Vercel and Cloudflare route image and video models now.
Inference pricing	BYOK + a free job allowance, then a per-job fee; no markup on routed spend.	Pass-through, no inference markup (Cloudflare core free; Vercel add-on surcharges).
Byte-exact custody in your bucket	Outputs streamed byte-exact into your bucket, your keys, sha256 at ingestion.	Output handed back (bytes/base64) for you to save; no gateway-side custody.
Media provenance & audit ledger	Append-only ledger, per-asset sha256, lineage, a /verify receipt per job.	Cloudflare 'audit logs' = config changes only; no media lineage.
Article 50 marking workflow	Designed to support it: preserve, detect, log. We don't yet sign or watermark.	Out of scope for a routing/observability proxy.

Gateway capabilities from Cloudflare's and Vercel's own docs, checked 2026-07-10. Cloudflare Images (a separate product) does handle C2PA on transforms — that's a different product from the Gateway. A “partial” for us marks an honest boundary.

The routing a gateway does, and the custody it doesn't: three real renders from three different providers (Runware, EvoLink, PiAPI), each streamed into byte-exact custody with its own job id and sha256 — not handed back as bytes for you to file somewhere. The full one-prompt-through-five-providers proof is on the comparison overview.

A dark container ship glides into a foggy harbor at night, its long wake glowing bioluminescent teal — RunwareKling 3.0 Turbo

A lone rower crosses black night water, the boat wrapped in glowing teal bioluminescence — EvoLinkZ-Image Turbo

A school of small silver fish turns together through pitch-black water, trailing faint teal streaks — PiAPIKling 2.6

Real pipeline outputs — model + provider named per tile; job ids and sha256 live in the showcase manifest, not in a caption.

The strongest argument against this page

The strongest argument from the gateway side: "we already route media with automatic fallback, we're free or near-free, and saving the output to R2 or your bucket is one line of code — you're adding a whole layer to solve a one-liner." For the routing and the ops layer, that's right, and we'd point teams who only need that straight at a gateway.

The one-liner is where the gap hides, though. "Save the output" isn't custody with a hash recorded at ingestion, a ledger that can't be quietly revised, lineage across providers, and a verification receipt — it's a file in a bucket with no record of how it got there. To be fair to Cloudflare: its separate Imagesproduct does handle C2PA on transforms, so the company isn't indifferent to provenance. But the Gateway isn't that, and stitching custody, lineage, and marking together across providers is the layer we are, and a proxy isn't.

Keep your provider. Stop depending on it.

Wakemark is one API above the providers you already use — capability routing with cross-provider failover, byte-exact custody in your own bucket, and an append-only audit ledger with a provenance receipt under every job. Designed to support Article 50 workflows; it does not, by itself, make any system meet any regulation.

Get started free See a provenance receipt

Sources

Links verified 2026-07-10

Cloudflare AI Gateway — docs & features — caching, rate-limiting, spend limits, analytics, logging, fallback, guardrails, BYOK
Cloudflare AI Gateway — audit logs (config changes only) — logs gateway create/delete/update — not media provenance
Vercel AI Gateway — video generation (output handed back to caller) — returns bytes/base64 for the developer to save; no gateway-side custody
Vercel AI Gateway — pricing (pass-through, no token markup)
Cloudflare — press release: acquiring Replicate (Nov 2025) — the single-AI-cloud direction