Cloudflare has turned three web-search providers into one API surface. That simplifies integration, but it doesn’t make provider quality, retention policy, or cost interchangeable.
Cloudflare introduced Web Search API in open beta on October 2. The service currently exposes Ceramic.ai, Exa, and Linkup through a normalized REST interface or a Workers AI binding. Developers can change providers without rebuilding the entire request pipeline.
What the common interface actually covers
The usage documentation accepts a search query of up to 1,024 characters and returns 1 to 10 results. The response shape includes common fields such as title, URL, and text, while provider-specific options remain available where supported.
That design is useful for an agent or research product that wants a fallback provider. It also tempts users to treat the services as equivalent. They may differ in index coverage, freshness, ranking, extracted text, latency, and source diversity. A provider switch should therefore be measured against the same held-out query set, not judged from a few successful searches.
AI Gateway is part of the architecture.
Cloudflare says Web Search API requires AI Gateway. Teams can use a named gateway or the default gateway, and requests appear in Gateway logs. The provider documentation says charges follow the provider’s list price through Gateway credits without an added Cloudflare markup. Bring Your Own Key is also supported.
Logging can help diagnose empty results, latency, and spend. It can also retain query material that a product owner did not intend to store. Before sending customer prompts, inspect which request and response fields are logged, who can read them, and how long the records remain available.
Zero retention is a service claim, not a blanket guarantee
Cloudflare describes the default service as supporting Zero Data Retention and verified-bot access. Those statements define how Cloudflare presents the product. They do not independently prove that every upstream publisher, provider option, account setting, or downstream application meets a particular regulatory requirement.
For sensitive research, remove personal data before the query, restrict log access, and document which provider processed each request. If BYOK changes the contractual path, review that provider agreement separately.
A practical provider test
- Build a fixed set of navigational, factual, recent-news, and niche technical queries.
- Score source relevance, date freshness, duplication, and unsupported snippets.
- Record provider, latency, result count, and cost for every request.
- Test failover without silently changing the evidence standard.
- Keep citations attached to the answer instead of copying search text without attribution.
Our WebMCP permission-boundary guide makes the same broader point: a convenient tool surface still needs explicit authority and evidence boundaries. Cloudflare Web Search API can reduce integration work. The production decision remains which provider, logs, and data path are acceptable for each task.
