AI Gateway setup

Follow-up extraction runs through a Cloudflare AI Gateway using bring-your-own-key (BYOK). The Worker never holds an Anthropic key directly; it authenticates to the gateway, and the gateway holds the upstream key. This step is required before the follow-up pipeline will run.

Steps

1. Create an AI Gateway in the Cloudflare dashboard. Its name becomes AI_GATEWAY_ID.
2. Store an Anthropic API key in it (BYOK / Store Keys).
3. Mint an AI Gateway token with Run permission. That value becomes AI_GATEWAY_TOKEN, which is a secret.
4. Set AI_GATEWAY_ACCOUNT_ID to the owning account id.

The resulting configuration

Name	Kind	Where it goes	Notes
AI_GATEWAY_ID	var	wrangler.jsonc vars	The gateway name.
AI_GATEWAY_ACCOUNT_ID	var	wrangler.jsonc vars	The owning account id.
AI_GATEWAY_TOKEN	secret	deploy secrets	A gateway token with Run permission.
FOLLOW_UP_MODEL	var	wrangler.jsonc vars	The model id used for extraction (default claude-sonnet-4-6).

AI_GATEWAY_ID, AI_GATEWAY_ACCOUNT_ID, and AI_GATEWAY_TOKEN are all required at runtime: the follow-up pipeline reads them through the config layer and fails fast if any is missing or blank. See the full Configuration reference for every variable.

Verify before you deploy

notewright doctor reports any required variable that is declared in the build fragment but missing from wrangler.jsonc, so run it before deploying. See doctor preflight.