Vercel, OpenRouter, Cloudflare and LiteLLM: AI Gateway Fees, BYOK and Failover

Every hosted AI gateway in this comparison passes model tokens through at the provider's list price. The fee shows up somewhere else: 5.5% when you buy OpenRouter credits, 5% on Cloudflare Unified Billing credits, and zero on Vercel tokens. This AI gateway comparison reads the published pricing pages, BYOK terms and failover docs so you can see where each fee lands before your bill does.

The short answer

Which AI gateway is cheapest? On published terms, Vercel AI Gateway and Cloudflare with your own keys add no gateway fee to tokens. OpenRouter adds 5.5% on credits or 5% on BYOK above $25,000 a month. LiteLLM is free to license but you host it. Pick on failover and retention terms, because the fee gaps are small.

The reader this post is written for is the practitioner: the engineer or tech lead who has to wire a gateway in this sprint and needs the fee, key and failover terms in one place.

What an AI gateway does, and why the fee is the wrong first question

An AI gateway is a proxy that sits between your application and the model providers. Your code sends one request format to one endpoint. The gateway decides which provider serves it, retries or falls back when that provider fails, enforces budgets, and records what happened.

That means the gateway sees every prompt you send, holds or forwards your provider keys, and decides what happens at 3am when a provider returns errors.

The four products compared here take different shapes. OpenRouter is a marketplace with its own credit balance. Vercel AI Gateway is a feature of the Vercel platform, billed through Vercel credits. Cloudflare AI Gateway is a proxy layer on the Cloudflare network with an optional billing layer added. LiteLLM is open-source software you run on your own servers.

My position: for most teams the fee should be the tie-breaker, not the filter. The spread between the cheapest and dearest hosted option is single-digit percent of inference spend. A failover rule that silently bills you on the wrong credentials, or a log cap you hit in week two, costs more in an afternoon of incident work.

Third-party gateway summaries disagree with each other and with current docs. So every figure here was read on the vendor's own page on 21 October 2026, with the page date given where one is shown.

The AI gateway fee and feature table

Terms are quoted or closely paraphrased from each vendor's documentation. Where a vendor did not publish a number, the cell says so rather than filling the gap.

Sources: each vendor's pricing, BYOK, retention and fallback documentation, read 21 October 2026. OpenRouter pages carry no update date. Vercel pricing was last updated 8 September 2026 and Cloudflare pricing 15 October 2026. "Not covered" means the pages read did not state the term, not that the feature is absent.

Where the gateway fee lands on your bill

The phrase "no markup" is true for all three hosted gateways and tells you almost nothing about cost. What matters is the point in the money flow where each vendor takes its cut.

OpenRouter takes it on the way in. Its pricing page says the fee "is charged when you buy credits, 5.5% on Standard and 8% on Business, never on individual requests". There are no monthly fees and, per the same page, "no minimums and no lock-in". Every request then draws down the balance at the provider's list price.

The Business plan costs more per dollar of credit than Standard. The higher rate buys features aimed at organisations, so treat 8% as the price of those features rather than a volume tier.

Cloudflare takes it only if you use its billing. Its gateway proxy, analytics, caching and rate limiting are, in its words, "offered for free". The 5% only applies when you buy model credits through Unified Billing so Cloudflare pays the provider on your behalf. Its example is plain: a $100 credit purchase is charged $105.

The same docs warn that "your credit balance may go negative," with the shortfall charged to your card at the start of the month. A prepaid balance that can overdraw is not a spending cap, and you should not treat it as one.

Vercel takes it on the payment rail. Vercel states that AI Gateway "charges no markup and no platform fee on tokens". The cost it does pass on is "any payment processing fees that may apply," which Enterprise teams avoid by paying on invoice. Purchased credits expire one year after purchase, per the gateway FAQ.

Vercel also prices add-ons separately. A team-wide zero data retention setting costs $0.10 per 1,000 requests, and so does a team-wide provider allowlist. The per-request versions of both are free.

BYOK terms: the clause that changes the bill

BYOK, bring your own key, means the gateway calls the provider with your API key instead of its own. You keep your negotiated provider rates and your provider relationship. The gateway still routes, logs and fails over.

OpenRouter's BYOK allowance

OpenRouter's BYOK doc sets the fee at "5% of what the same model/provider would cost normally on OpenRouter," deducted from your credits. Standard and Business include $25,000 of list-price inference a month before that fee starts. The allowance is measured in list-price dollars, not requests.

One detail compounds. The BYOK fee comes out of credits, and those credits were bought with a 5.5% fee on Standard. So 5% of list price effectively costs about 5.3% in cash terms. That is my arithmetic on OpenRouter's published rates, not a figure OpenRouter publishes.

OpenRouter also says that when no provider order is set, it "prioritizes BYOK endpoints first," and if every BYOK key fails it "will fall back to using shared OpenRouter endpoints". That fallback is billed from credits at list price.

Vercel's BYOK fallback and budget gap

Vercel charges no fee for BYOK, which is available on the paid tier. Two lines in its docs deserve your attention before you rely on it. First, "when a request with your credentials fails, AI Gateway retries it with system credentials for reliability, and that fallback usage is charged against your credits balance".

Second, Vercel's BYOK page says spend through your own credentials "isn't counted in budgets," so "a budget can't be used to cap BYOK spend". Together, they let a team believe its budget is the safety net while most of its traffic sits outside it. I would set a provider-side spend limit on every BYOK key for that reason alone.

Cloudflare's credential order

Cloudflare documents a strict precedence. A provider key on the request is forwarded unchanged. If none is present, a stored BYOK key under the default alias is used. Only if neither exists does Unified Billing pay, and its 5% fee applies.

The useful control is a gateway setting that makes requests without credentials "return an HTTP 400 response instead of using Cloudflare-managed credentials". If your finance team wants zero spend through Unified Billing, that setting enforces it in configuration rather than in policy.

Arithmetic on published rates only. Excludes payment processing fees, Vercel add-ons such as team-wide ZDR, Vercel fallback charges on failed BYOK calls, and the cost of running LiteLLM. Enterprise rates on every product are negotiated and not shown.

Model failover rules compared

Model failover is the reason most teams install a gateway at all. All four products support it. They differ on what triggers a fallback, how you configure it, and who pays for the attempt that failed.

OpenRouter: a models array

OpenRouter takes "an array of model IDs in priority order. If the first model returns an error, OpenRouter will automatically try the next model in the list". By default any error triggers it, including context length errors, moderation flags, rate limiting and downtime. Requests are "priced using the model that was ultimately used," and an attempt that errors "is not charged for its model tokens".

Vercel: models plus provider order

Vercel's model fallbacks doc layers two controls. A models array lists fallback models, and for each model the order or only provider rules apply first. Only "if all providers for a model fail" does the gateway move to the next model. A modelAttempts array in the response metadata shows every model tried.

Cloudflare: an array of full requests

Cloudflare's fallback is the most literal. You send a JSON array of complete request objects, each with its own provider, endpoint and headers, and the docs say "you can add as many fallbacks as you need". Fallback triggers on an error or a configured request timeout. A cf-aig-step response header tells you which step served the answer, where 0 is the primary.

LiteLLM: typed fallbacks with retries and cooldowns

LiteLLM's reliability doc splits fallbacks by cause: context_window_fallbacks for oversized prompts, content_policy_fallbacks for policy refusals, and plain fallbacks for everything else, such as rate limits. A call retries num_retries times before falling back, and failing deployments are put into cooldown. This is the most granular control of the four, and you own every outage it does not catch.

Model failover has a quality cost no gateway can fix. A fallback model is usually a different model, and the answer it produces may be worse in ways your error rate will not show. That gap is measured in the analysis of what model routing does to output quality. It is the reason I would cap fallback chains at one or two models you have actually evaluated.

Logging and data retention terms

A gateway is a natural place to log every prompt. That is useful for debugging and a liability for compliance. The four products start from different defaults.

OpenRouter says it has a zero data retention policy of its own, and "your prompts are not retained unless you specifically opt in to prompt logging". Zero data retention routing, which restricts traffic to providers that store nothing, is available "on every plan" and can be enforced globally or per request.

Vercel says the gateway "does not log the prompts or responses in your requests". It logs metadata, and "routing attempt details are kept for 30 days". ZDR routing is available on Pro and Enterprise. Vercel notes that by default it "does not route based on the data retention policy of providers," so ZDR is something you switch on.

Cloudflare logs by default, per gateway, and lets you set a request header to keep metadata but drop the payload. On legacy accounts the free plan stores 100,000 logs across all gateways and the paid plan 10 million per gateway. Accounts whose first gateway was created on or after 24 September 2026 use Workers Logs pricing instead.

The default that matters is the provider's. None of these gateway policies changes what the model provider retains. That is set by the provider's own terms, which vary widely, and is ranked in the comparison of AI vendor data retention defaults. The gateway's ZDR switch only helps if it actually restricts routing, which OpenRouter and Vercel document and the Cloudflare pages read for this post do not address.

Self-hosting LiteLLM: what free actually costs

LiteLLM is software, not a service. Its site describes the open-source gateway as "MIT-licensed and production-grade" and prices it at "$0 / Free forever". You run it in your own environment and call providers with your own keys.

No vendor sits in your data path, and its data security page says "no data or telemetry is stored on LiteLLM Servers when you self-host," with usage telemetry off by default. In return you own uptime, upgrades, the database that stores spend logs, and the on-call rota.

The open-source tier includes virtual keys, budgets and rate limits, spend tracking, load balancing and fallbacks. LiteLLM's Enterprise page lists what a licence adds: SSO beyond the free allowance, audit logs, delegated admin roles, secret managers, IP allowlists and support. Code in the repository's enterprise folder sits under a commercial licence, not MIT.

LiteLLM publishes no Enterprise price. Its docs say "pricing depends on your deployment size" and offer a 30-day trial. They also say SSO is free for up to 5 users, which is generous for a pilot and a hard ceiling for a platform team.

My view: self-hosting a gateway is the right call only if you already run stateful services on call. If you do not, a hosted gateway with a published fee is cheaper than the engineering hours you will spend learning what LiteLLM's cooldown settings do during an outage.

Where this comparison is weakest

This post compares published terms. That is its strength and its main limitation.

No measured latency or uptime. I have not measured gateway latency, failover speed or uptime. Those numbers could reverse the recommendation for a latency-sensitive product. A gateway that adds noticeable time to every call costs more than a 5% fee for a voice or autocomplete feature.

List prices are moving targets. Every figure is a list price on a given day. OpenRouter's pages carried no update date at all, and Cloudflare changed its logging model for new accounts on 24 September 2026. Enterprise terms on all four products are negotiated and invisible to this comparison. Treat the table as a dated snapshot.

The fairest case for paying the fee. The strongest argument against my framing is that the fee buys something real. One OpenRouter balance replaces separate contracts, keys and invoices with dozens of providers. For a small team, that saving in procurement time can exceed 5.5% of a modest inference bill. If your spend is under a few thousand dollars a month, the fee is close to irrelevant and convenience should win.

Which AI gateway fits which team

Pick OpenRouter if you want the widest hosted catalogue behind one balance and your BYOK spend sits under $25,000 a month. Its stated coverage of 500+ models and 80+ providers is the largest of the hosted three.

Pick Vercel AI Gateway if you already deploy on Vercel and want the lowest published fee with per-model provider ordering. Set provider-side limits on your BYOK keys, because its budgets do not count that spend.

Pick Cloudflare AI Gateway if you want a free proxy layer for caching, rate limiting and logs over your own provider keys. Turn on the setting that rejects requests without credentials if you never want to pay the 5%.

Pick LiteLLM if data must not pass through a third party and your team already runs production infrastructure on call. Budget for the Enterprise licence the day SSO passes 5 users.

Whichever you pick, the gateway reduces the cost of switching models, not of switching gateways. The lock-in moves to the gateway's config format and SDK, a trade examined in the breakdown of model switching costs and lock-in. If your problem is per-token price rather than routing, the inference provider rate card is the better starting point.

To start, write down last month's list-price inference spend from your provider invoices. That one number tells you whether the fee differences in this post amount to lunch money or a salary. Then read the BYOK fallback clause of whichever gateway you shortlist, and test it. Revoke one provider key in a staging environment, send traffic, and check which credentials served the request and where the charge landed. Tracing tools for these calls are compared in the LLM observability tools comparison.

Frequently asked questions

Related reading