---
title: Connect Cloudflare R2
description: "Find your Cloudflare account ID, create an R2 account API token with the smallest permission that works, and connect your R2 buckets to quickS3."
section: Connections
order: 70
audience: [owner]
status: published
lastVerified: 2026-09-15
sources:
  - web/src/content/blog/configuring-cloudflare-r2.mdx
  - web/src/components/app/provider-connections/ConnectionFormCard.tsx
  - web/src/components/app/provider-connections/provider-utils.ts
  - src/objects/routes/providers.cors.ts
---

You need two things from Cloudflare: your account ID, and an R2 API token's access key pair.

## 1. Find your account ID

In the Cloudflare dashboard, open **R2 Object Storage**. Your **Account ID** is shown on the R2 overview page. It's a 32-character string of letters and numbers.

## 2. Create an R2 API token

1. On the R2 page, select **Manage API tokens** and create an **Account API token**. Unlike a user token, it keeps working if the person who created it leaves your Cloudflare account.
2. Under **Permissions**, pick the smallest one that works:
   - **Object Read & Write** to browse, upload, and delete in chosen buckets.
   - **Object Read only** for a read-only connection.
   - **Admin Read & Write** only if you want to create buckets from quickS3. It gives full control of every bucket in the account.
3. With an Object permission, pick the buckets the token applies to.
4. Leave **Client IP Address Filtering** empty. quickS3's requests don't come from a fixed IP address, so a filter blocks them.
5. Create the token and copy the **Access Key ID** and **Secret Access Key** from the S3 section. Cloudflare shows the secret once.

Cloudflare also shows a **Token value**. That's for Cloudflare's own API. quickS3 doesn't use it.

## 3. Add the connection

1. In quickS3, open **Connections**, select **New connection**, and pick **Cloudflare R2**.
2. Enter a **Name** and your **Account ID**.
3. Leave **Jurisdiction** on **Standard (No Jurisdiction)** unless your buckets were created in the EU or FedRAMP jurisdiction. Check the endpoint quickS3 shows below it.
4. With an Object token, type your bucket names into **Bucket scopes**, separated by commas. Object tokens can't list buckets, so quickS3 can't find them on its own.
5. Paste the **Access key ID** and **Secret access key**.
6. Keep CORS updates on and select **Connect provider**.

Then select **Test connection**. You want **Connection verified** with "CORS allows direct uploads".

A connection reaches one jurisdiction. If you have buckets in both Standard and EU, add a connection for each.

## If uploads are blocked by CORS

If the test warns that CORS doesn't allow quickS3, your token may not be allowed to change bucket settings. Add the rule by hand: open the bucket in the Cloudflare dashboard, go to **Settings → CORS Policy**, and add this JSON, keeping any rules already there.

```json
[
  {
    "AllowedOrigins": ["https://quicks3.com"],
    "AllowedMethods": ["GET", "HEAD", "PUT"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]
```

R2 can take about 30 seconds to apply a CORS change. If the next test still warns, wait a moment and run it again before changing anything else.

## Creating buckets

The **Create bucket** button on Overview needs an **Admin Read & Write** token. If you don't want to hand quickS3 that much access, create buckets in the Cloudflare dashboard, keep the narrower Object token, and add the new bucket to **Bucket scopes**.