Gateway Guide

Hermes Agent + Cloudflare AI Gateway

Q: Can Hermes Agent use Cloudflare AI Gateway?

Yes. Hermes Agent can use Cloudflare AI Gateway through its OpenAI provider endpoint.

Q: Should I use Cloudflare’s Universal endpoint?

New integrations should use Cloudflare AI Gateway provider-specific endpoints instead of the deprecated Universal endpoint.

Q: Does Cloudflare replace my model API key?

Cloudflare AI Gateway normally routes requests that still authenticate to the upstream model provider.

Put Cloudflare AI Gateway between Hermes Agent and OpenAI to centralize request analytics, caching, rate limits, retries, and operational controls without changing the agent loop.

Create the gateway

In Cloudflare, create an AI Gateway and note its account ID and gateway ID.
Choose the current OpenAI provider integration rather than the deprecated Universal endpoint.
Decide whether prompts and responses may be logged for this workload.
Configure caching, rate limits, or retries conservatively; agent tool calls can be unsafe to cache.

Build the OpenAI base URL

Cloudflare documents this provider base:

https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/openai

Replace both placeholders. Store the base only; the OpenAI client adds the request path. Do not append a second /v1 or a full /chat/completions path.

Configure Hermes

# /opt/data/config.yaml
model:
  provider: custom
  base_url: https://gateway.ai.cloudflare.com/v1/ACCOUNT_ID/GATEWAY_ID/openai
  api_key: sk-your-openai-key
  default: gpt-4.1-mini

The API key in this standard example is your upstream OpenAI key. Use a model your OpenAI account can access, then restart Hermes. If you enable a different Cloudflare authentication mode, follow its current header and stored-key documentation instead of mixing the two patterns.

Managed Hermes setup

On OpenClaw Launch, use the Custom API Provider card for the Cloudflare base URL and credential. This keeps the configuration attached to your account rather than baking a key into a container image.

Privacy check: gateway analytics can add another copy of prompts and responses. Disable payload logging or redact sensitive data when your policy requires it.

Good agent-specific defaults

Cache only deterministic, safe requests. Replaying a cached tool-planning answer can be wrong after external state changes.
Rate-limit by key or agent. A looping workflow should not consume the entire account quota.
Retry carefully. Retrying inference is usually safe; retrying an already-executed external action may duplicate it.
Watch latency separately. Gateway overhead, provider time, and Hermes tool execution are different components.

Troubleshooting

404: check the account ID, gateway ID, provider suffix, and doubled path segments.
401 from OpenAI: verify the upstream key and project access.
Gateway sees no traffic: Hermes is still using a built-in provider; set model.provider to custom.
Repeated actions: disable caching for agentic requests and inspect retry behavior.

Hermes and Cloudflare AI Gateway FAQ

Can Hermes Agent use Cloudflare AI Gateway?

Yes. For OpenAI models, point Hermes’s custom OpenAI-compatible provider at Cloudflare’s documented OpenAI gateway base URL.

Should I use Cloudflare’s Universal endpoint?

No for a new setup. Cloudflare marks the Universal endpoint as deprecated; use the current provider-specific or OpenAI-compatible path from its documentation.

Does Cloudflare replace my model API key?

Not automatically. Standard authenticated-provider requests still need the upstream provider credential unless you deliberately configure Cloudflare’s stored-key features.