If you run several small projects, API keys tend to pile up: one per provider, copied into env files, CI secrets and old branches. Every copy is one more place a key can leak.

One way out is to keep inference inside Cloudflare. Workers AI runs models from a Worker binding, so there's no external key in the code at all, and AI Gateway sits in front of external providers so the provider key lives in one place, with caching, rate limits and logs on top.

I wrote up how I set this up across my projects, with the trade-offs I hit along the way (in Portuguese):
https://kevinbk.com/blog/evitar-acumulo-de-chaves-api-em-projetos-ia