# Cloudflare R2 Setup: Zero-Egress Storage

> How to connect Blober to Cloudflare R2. S3-compatible object storage with zero egress fees. Browse, upload, download, and transfer files.

Cloudflare R2 is S3-compatible object storage with **zero egress fees**. Blober connects via the S3-compatible API.

Path format:

```plaintext
bucket-name/path/to/file.ext
```

## Capabilities

* ✅ Browse buckets and objects
* ✅ Upload files (including large files)
* ✅ Download files
* ✅ Delete objects
* ✅ Copy/move objects
* ✅ S3-compatible API
* ✅ Zero egress fees

## Prerequisites

* A Cloudflare account ([create one](https://dash.cloudflare.com/sign-up))
* R2 enabled on your account
* At least one R2 bucket
* API credentials with an **Admin** scope (see [Token Permissions](#token-permissions))

## Required Credentials

[]()

### Account ID

* **Where to find:** Cloudflare dashboard => Overview => right sidebar
* **Format:** 32-character hex string
* **Example:** `a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4`

[]()

### Access Key ID

* **Format:** 32 alphanumeric characters
* **Example:** `abc123def456ghi789jkl012mno345pq`

[]()

### Secret Access Key

* **Format:** 64-character string
* **Example:** `abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOP`

[]()

### API Token (Optional)

* **Where to find:** Shown alongside Access Key ID and Secret Access Key when creating an R2 API token
* **Format:** Cloudflare API Bearer token string
* **Why use it:** Enables faster bucket listing. Recommended if you have more than 100 buckets.
* **Required permissions:** `Workers R2 Storage Read` (or `Workers R2 Storage Write`)

[]()

## Token Permissions

Blober lists the buckets in your account before showing their contents, and **listing buckets is an account-level action**. Your R2 API token must therefore use an **Admin** scope:

* **Admin Read & Write** - full access (browse, upload, download, copy, move, delete).
* **Admin Read only** - browse and download only.

The **Object Read & Write** and **Object Read only** scopes **will not work**: they can list objects *inside a bucket you name*, but not the buckets themselves, so Blober gets `Access Denied` and shows no buckets.

> **Stuck with an Object-scoped token?**
>
> Use the [**S3-Compatible**](/kb/docs/providers/s3-compatible/) connector instead: point it at your R2 endpoint and set its **Bucket** option to the bucket you want. That scopes Blober to one bucket and skips bucket listing, so an Object-scoped token works.

## Setup (Cloudflare Dashboard)

### 1. Create an R2 Bucket

1. Go to [Cloudflare Dashboard](https://dash.cloudflare.com)
2. Select **R2** from the sidebar
3. Click **Create bucket**
4. Enter a bucket name (lowercase, unique within your account)
5. Click **Create bucket**

### 2. Create API Credentials

1. In R2 settings, click **Manage R2 API Tokens**

2. Click **Create API token**

3. Configure the token:

   * **Token name:** Give it a descriptive name (e.g., `blober-access`)
   * **Permissions:** **Admin Read & Write** (or **Admin Read only**) - an *Object* scope won't work, see [Token Permissions](#token-permissions)
   * **Bucket scope:** Apply to all buckets in this account

4. Click **Create API Token**

5. **Copy Access Key ID and Secret Access Key immediately** (secret shown only once!)

### 3. Find Your Account ID

1. Go to the Cloudflare dashboard
2. Click on any domain or go to **Overview**
3. The Account ID is in the right sidebar under "API"
4. Copy the Account ID

### 4. Configure in Blober

1. In Blober, go to **Workflows** => **New Workflow**

2. Select **Cloudflare R2** as source or destination

3. Enter:

   * Account ID
   * Access Key ID
   * Secret Access Key
   * API Token *(optional - recommended for accounts with 100+ buckets)*

4. Test by browsing your buckets

## Troubleshooting

### "Access Denied" error

* Double-check your Account ID - it's found in the Cloudflare dashboard sidebar, not in R2 settings
* Verify your R2 API token uses an **Admin** scope - **Object** scopes cannot list buckets (see [Token Permissions](#token-permissions))

### "Invalid Account ID"

* The Account ID is a 32-character hex string found on the Cloudflare dashboard overview page
* Don't confuse it with Zone ID or API token

### Buckets not listing

* Your token is likely an **Object** scope, which cannot list buckets - recreate it with an **Admin** scope, or use the [**S3-Compatible**](/kb/docs/providers/s3-compatible/) connector scoped to a single bucket (see [Token Permissions](#token-permissions))

## Best Practices

* **Zero egress fees** make R2 ideal as a destination for frequently downloaded data
* Use R2 for serving assets or as a CDN origin - pair with Cloudflare's CDN for global delivery
* Create separate API tokens per application for better security and easy revocation

> **Terms Compliance**
>
> Your use of Cloudflare R2 through Blober is subject to [Cloudflare's Terms of Service](https://www.cloudflare.com/terms/). See our [Terms of Service](/kb/docs/terms-and-privacy/terms-of-service/) for details.

## External References

* [R2 Documentation](https://developers.cloudflare.com/r2/)
* [Creating API Tokens](https://developers.cloudflare.com/r2/api/s3/tokens/)
* [S3 API Compatibility](https://developers.cloudflare.com/r2/api/s3/)
* [Cloudflare R2 Pricing](https://developers.cloudflare.com/r2/pricing/)