cache_control, we forward it and add nothing of our own. A request too short to cache runs uncached.
On Bedrock we only follow your explicit markers, because Bedrock has no automatic caching. OpenAI and Gemini cache repeated prefixes themselves, so there is nothing to set.
Each provider runs its own cache, and none of them share. So a backup route starts with an empty cache, and its first request pays the full input price.
On Managed Keys we replace user, safety_identifier, and prompt_cache_key with a hash of your organization id before the provider sees them, because the identity on our credential has to come from us. Provider-side cache affinity is per organization there. On your own keys all three pass through unchanged.
The response reports cached_tokens and cache_write_tokens in its usage block.