If you run several small projects, API keys tend to pile up: one per provider, copied into env files, CI secrets and old branches. Every copy is one more place a key can leak. One way out is to keep inference inside Cloudflare. Workers AI runs models from a Worker binding, so there's no external key in the code at all, and AI Gateway sits in front of external providers so the provider key lives in one place, with caching, rate limits and logs on top.
I wrote up how I set this up across my projects, with the trade-offs I hit along the way (in Portuguese):
https://kevinbk.com/blog/evitar-acumulo-de-chaves-api-em-projetos-ia
source & further reading
dev.to — original article
Your AI Assistant Remembered the Fact. It Still Got the Answer Wrong
Making a 166,000-neuron brain bit-exact on any GPU
magpie (Content Desk): How I Built an Offline AI Work Journal to Manage My Side Hustles, Societies, & Applications