Cloudflare R2 Setup: Zero-Egress Storage

Cloudflare R2 is S3-compatible object storage with zero egress fees. Blober connects via the S3-compatible API.

Path format:

bucket-name/path/to/file.ext

• ✅ Browse buckets and objects
• ✅ Upload files (including large files)
• ✅ Download files
• ✅ Delete objects
• ✅ Copy/move objects
• ✅ S3-compatible API
• ✅ Zero egress fees

• A Cloudflare account (create one)
• R2 enabled on your account
• At least one R2 bucket
• API credentials with an Admin scope (see Token permissions)

• Where to find: Cloudflare dashboard => Overview => right sidebar
• Example: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4

• Example: abc123def456ghi789jkl012mno345pq

• Example: abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOP

• Where to find: shown alongside the Access Key ID and Secret Access Key when you create an R2 API token
• Why use it: faster bucket listing. Recommended if you have more than 100 buckets.
• Required permissions: Workers R2 Storage Read (or Workers R2 Storage Write)

Blober lists the buckets in your account before showing their contents, and listing buckets is an account-level action. Your R2 API token therefore needs an Admin scope:

• Admin Read & Write gives full access (browse, upload, download, copy, move, delete).
• Admin Read only allows browsing and downloading only.

The Object Read & Write and Object Read only scopes don't work. They can list objects inside a bucket you name but not the buckets themselves, so Blober gets Access Denied and shows no buckets.

1. Go to Cloudflare Dashboard
2. Select R2 from the sidebar
3. Click Create bucket
4. Enter a bucket name (lowercase, unique within your account)
5. Click Create bucket

1. In R2 settings, click Manage R2 API Tokens
2. Click Create API token
3. Configure the token:
   • Token name: Give it a descriptive name (e.g., blober-access)
   • Permissions: Admin Read & Write (or Admin Read only). An Object scope won't work; see Token permissions
   • Bucket scope: Apply to all buckets in this account
4. Click Create API Token
5. Copy the Access Key ID and Secret Access Key now, because Cloudflare shows the secret only once

1. Go to the Cloudflare dashboard
2. Click on any domain or go to Overview
3. The Account ID is in the right sidebar under "API"
4. Copy the Account ID

1. In Blober, go to Workflows => New Workflow
2. Select Cloudflare R2 as source or destination
3. Enter:
   • Account ID
   • Access Key ID
   • Secret Access Key
   • API Token (optional, recommended for accounts with 100+ buckets)
4. Test by browsing your buckets

• Double-check your Account ID. It's in the Cloudflare dashboard sidebar, not in R2 settings
• Verify your R2 API token uses an Admin scope. Object scopes cannot list buckets (see Token permissions)

• The Account ID is a 32-character hex string found on the Cloudflare dashboard overview page
• Don't confuse it with Zone ID or API token

• Your token probably has an Object scope, which cannot list buckets. Recreate it with an Admin scope, or use the S3-Compatible provider scoped to a single bucket (see Token permissions)

• With zero egress fees, R2 is a good destination for data that gets downloaded often
• Use R2 to serve assets or as a CDN origin, paired with Cloudflare's CDN for global delivery
• Create separate API tokens per application for better security and easy revocation

• R2 Documentation
• Creating API Tokens
• S3 API Compatibility
• Cloudflare R2 Pricing