# Atlas: Cloudflare AI Gateway token or gateway id missing > Export CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_GATEWAY_ID, then CLOUDFLARE_API_TOKEN or CF_AIG_TOKEN, or run `atlas auth cloudflare-ai-gateway` as the error suggests. Atlas throws "CLOUDFLARE_API_TOKEN (or CF_AIG_TOKEN) is required for Cloudflare AI Gateway", or a message naming the exports you still need, because the cloudflare-ai-gateway loader requires an account id and a gateway id and then separately requires an API token. The fix is to export CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_GATEWAY_ID, then export CLOUDFLARE_API_TOKEN or CF_AIG_TOKEN, or run atlas auth cloudflare-ai-gateway as the error message suggests. ## Symptom The gateway provider throws either ` and missing. Set with: export ...`, or: CLOUDFLARE_API_TOKEN (or CF_AIG_TOKEN) is required for Cloudflare AI Gateway. ## Cause The cloudflare-ai-gateway loader in Atlas requires an account id and a gateway id, then separately requires an API token. It builds the missing-variable list dynamically and throws a message that names the exports you still need. ## Fix 1. Export CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_GATEWAY_ID. The auth prompt stores the latter as gatewayId metadata. 2. Export CLOUDFLARE_API_TOKEN or CF_AIG_TOKEN for an authenticated gateway. Either variable satisfies the token check. 3. Or run `atlas auth cloudflare-ai-gateway` as the error message suggests, and let Atlas collect the values. 4. If a corporate config already sets `baseURL` on the provider, the id checks are skipped, so verify which path you are on before you start exporting variables. ## Why does Atlas say Cloudflare AI Gateway is missing a token or gateway id Atlas raises the Cloudflare AI Gateway error because the cloudflare-ai-gateway loader runs 2 separate checks: it requires an account id and a gateway id, then separately requires an API token. Failing either check produces a message naming the exports you still need, built dynamically from what is absent. The two-stage check explains why the wording of the error changes between people. If you are missing identifiers, the cloudflare-ai-gateway loader assembles the missing-variable list and throws ` and missing. Set with: export ...`, naming the specific variables. If the identifiers are present but no token is, it throws "CLOUDFLARE_API_TOKEN (or CF_AIG_TOKEN) is required for Cloudflare AI Gateway" instead. Read the message you actually got rather than the one you expected. The variable names in it are the shortest possible list of what Atlas still needs from you. ## How to fix the Cloudflare AI Gateway token error in Atlas Fix the Cloudflare AI Gateway error in Atlas by exporting CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_GATEWAY_ID, then exporting CLOUDFLARE_API_TOKEN or CF_AIG_TOKEN for an authenticated gateway. Either token variable satisfies the check, so 1 of the 2 is enough, and Atlas accepts whichever one it finds. Work through the loader's order. Identifiers first: CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_GATEWAY_ID together tell Atlas which gateway on which account to address. Token second: CLOUDFLARE_API_TOKEN or CF_AIG_TOKEN authenticates against it. Because the cloudflare-ai-gateway loader checks identifiers and token separately, satisfying only one half moves the error to the other half, which reads like the fix did nothing. It did. The message simply advanced to the next unmet requirement, and finishing the second export clears it. ## Using atlas auth cloudflare-ai-gateway instead of exports Run `atlas auth cloudflare-ai-gateway` instead of exporting variables, which is exactly what the Atlas error message suggests. In 2026 the auth prompt collects the values and stores the gateway id as gatewayId metadata, so the loader reads it without CLOUDFLARE_GATEWAY_ID being present in your shell. The auth path suits anyone who does not want Cloudflare identifiers living in dotfiles or shell history. `atlas auth cloudflare-ai-gateway` walks you through the values the loader needs and persists them, with the gateway id kept as gatewayId metadata rather than as an environment variable. Choose the auth path or the export path, not both, so that when something breaks later you know exactly where the values came from. Mixing them is not an error, but it makes the next debugging session slower than it needs to be. ## When baseURL makes the Cloudflare AI Gateway id checks disappear If a corporate config already sets `baseURL` on the Cloudflare AI Gateway provider in Atlas, the id checks are skipped entirely. Verify which path you are on before exporting anything, because a provider with a baseURL will not ask for either of the 2 identifiers, CLOUDFLARE_ACCOUNT_ID or CLOUDFLARE_GATEWAY_ID. A `baseURL` already encodes the endpoint, so the cloudflare-ai-gateway loader does not need the account id and gateway id to construct it. On machines managed by a corporate config, that baseURL may already be set without you knowing, and exporting identifiers there will have no visible effect, which is confusing if you assume the exports are being ignored. Check the provider entry first. If a baseURL is present, the identifiers are irrelevant and your remaining problem, if any, is the token. If no baseURL is present, the identifier exports are required and the loader will keep naming the ones it cannot find. ## How to verify the Cloudflare AI Gateway fix worked Verify the Cloudflare AI Gateway fix in Atlas by restarting Atlas, selecting the gateway model, and sending a message. A completion with no missing-variable list and no CLOUDFLARE_API_TOKEN message means the loader passed both of its 2 checks and resolved every value it needs. Restart before you judge the fix, because the cloudflare-ai-gateway loader reads the environment and the provider config when it loads, not continuously. Then look carefully at what the error becomes. Silence means both checks passed. A different message, naming a different variable, means one check passed and the next one is now reporting, which is progress rather than failure. Atlas builds that missing-variable list dynamically for exactly this reason: each run tells you precisely what is still absent. ## FAQ ### What environment variables does Cloudflare AI Gateway need in Atlas Export CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_GATEWAY_ID for the identifiers, then CLOUDFLARE_API_TOKEN or CF_AIG_TOKEN for an authenticated gateway. The cloudflare-ai-gateway loader checks the identifiers and the token separately. ### What is the difference between CLOUDFLARE_API_TOKEN and CF_AIG_TOKEN in Atlas Either satisfies the Cloudflare AI Gateway token requirement. Atlas throws "CLOUDFLARE_API_TOKEN (or CF_AIG_TOKEN) is required for Cloudflare AI Gateway" when neither is set, so setting one is enough. ### How do I run atlas auth for Cloudflare AI Gateway Run `atlas auth cloudflare-ai-gateway`, which the error message itself suggests. The auth prompt stores the gateway id as gatewayId metadata, so CLOUDFLARE_GATEWAY_ID does not need to be in the shell. ### Why did fixing one Cloudflare AI Gateway variable produce a different error The cloudflare-ai-gateway loader checks the account id and gateway id first and the API token separately. Satisfying the identifiers moves the failure to the token check, which is progress rather than a new problem. ### Does setting baseURL skip the Cloudflare AI Gateway id checks in Atlas Yes. If a corporate config already sets baseURL on the provider, the id checks are skipped. Verify which path you are on, since exporting identifiers on a baseURL setup changes nothing. ### Where does Atlas store the Cloudflare gateway id The Atlas auth prompt stores the gateway id as gatewayId metadata. You can instead export CLOUDFLARE_GATEWAY_ID in the shell that launches Atlas. --- Canonical HTML: https://runatlas.sh/resources/troubleshooting/cloudflare-ai-gateway-token-required Source of truth: aeo_pages row `/resources/troubleshooting/cloudflare-ai-gateway-token-required` (segment: Troubleshooting) (this file is generated from it, never hand-edited). Licence: Atlas is proprietary with a free core. It is not open source and there is no public source repository.