Cloudflare R2 Setup: Zero-Egress Storage

Cloudflare R2 is S3-compatible object storage with zero egress fees. Blober connects via the S3-compatible API.

Path format:

bucket-name/path/to/file.ext

Capabilities

✅ Browse buckets and objects
✅ Upload files (including large files)
✅ Download files
✅ Delete objects
✅ Copy/move objects
✅ S3-compatible API
✅ Zero egress fees

Prerequisites

A Cloudflare account (create one)
R2 enabled on your account
At least one R2 bucket
API credentials with an Admin scope (see Token Permissions)

Required Credentials

Account ID

Where to find: Cloudflare dashboard => Overview => right sidebar
Format: 32-character hex string
Example: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4

Access Key ID

Format: 32 alphanumeric characters
Example: abc123def456ghi789jkl012mno345pq

Secret Access Key

Format: 64-character string
Example: abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOP

API Token (Optional)

Where to find: Shown alongside Access Key ID and Secret Access Key when creating an R2 API token
Format: Cloudflare API Bearer token string
Why use it: Enables faster bucket listing. Recommended if you have more than 100 buckets.
Required permissions: Workers R2 Storage Read (or Workers R2 Storage Write)

Token Permissions

Blober lists the buckets in your account before showing their contents, and listing buckets is an account-level action. Your R2 API token must therefore use an Admin scope:

Admin Read & Write - full access (browse, upload, download, copy, move, delete).
Admin Read only - browse and download only.

The Object Read & Write and Object Read only scopes will not work: they can list objects inside a bucket you name, but not the buckets themselves, so Blober gets Access Denied and shows no buckets.

Setup (Cloudflare Dashboard)

1. Create an R2 Bucket

Go to Cloudflare Dashboard
Select R2 from the sidebar
Click Create bucket
Enter a bucket name (lowercase, unique within your account)
Click Create bucket

2. Create API Credentials

In R2 settings, click Manage R2 API Tokens
Click Create API token
Configure the token:
- Token name: Give it a descriptive name (e.g., blober-access)
- Permissions: Admin Read & Write (or Admin Read only) - an Object scope won't work, see Token Permissions
- Bucket scope: Apply to all buckets in this account
Click Create API Token
Copy Access Key ID and Secret Access Key immediately (secret shown only once!)

3. Find Your Account ID

Go to the Cloudflare dashboard
Click on any domain or go to Overview
The Account ID is in the right sidebar under "API"
Copy the Account ID

4. Configure in Blober

In Blober, go to Workflows => New Workflow
Select Cloudflare R2 as source or destination
Enter:
- Account ID
- Access Key ID
- Secret Access Key
- API Token (optional - recommended for accounts with 100+ buckets)
Test by browsing your buckets

Troubleshooting

"Access Denied" error

Double-check your Account ID - it's found in the Cloudflare dashboard sidebar, not in R2 settings
Verify your R2 API token uses an Admin scope - Object scopes cannot list buckets (see Token Permissions)

"Invalid Account ID"

The Account ID is a 32-character hex string found on the Cloudflare dashboard overview page
Don't confuse it with Zone ID or API token

Buckets not listing

Your token is likely an Object scope, which cannot list buckets - recreate it with an Admin scope, or use the S3-Compatible connector scoped to a single bucket (see Token Permissions)

Best Practices

Zero egress fees make R2 ideal as a destination for frequently downloaded data
Use R2 for serving assets or as a CDN origin - pair with Cloudflare's CDN for global delivery
Create separate API tokens per application for better security and easy revocation