Connect Cloudflare R2

You need two things from Cloudflare: your account ID, and an R2 API token’s access key pair.

1. Find your account ID

In the Cloudflare dashboard, open R2 Object Storage. Your Account ID is shown on the R2 overview page. It’s a 32-character string of letters and numbers.

2. Create an R2 API token

1. On the R2 page, select Manage API tokens and create an Account API token. Unlike a user token, it keeps working if the person who created it leaves your Cloudflare account.
2. Under Permissions, pick the smallest one that works:
   • Object Read & Write to browse, upload, and delete in chosen buckets.
   • Object Read only for a read-only connection.
   • Admin Read & Write only if you want to create buckets from quickS3. It gives full control of every bucket in the account.
3. With an Object permission, pick the buckets the token applies to.
4. Leave Client IP Address Filtering empty. quickS3’s requests don’t come from a fixed IP address, so a filter blocks them.
5. Create the token and copy the Access Key ID and Secret Access Key from the S3 section. Cloudflare shows the secret once.

Cloudflare also shows a Token value. That’s for Cloudflare’s own API. quickS3 doesn’t use it.

3. Add the connection

1. In quickS3, open Connections, select New connection, and pick Cloudflare R2.
2. Enter a Name and your Account ID.
3. Leave Jurisdiction on Standard (No Jurisdiction) unless your buckets were created in the EU or FedRAMP jurisdiction. Check the endpoint quickS3 shows below it.
4. With an Object token, type your bucket names into Bucket scopes, separated by commas. Object tokens can’t list buckets, so quickS3 can’t find them on its own.
5. Paste the Access key ID and Secret access key.
6. Keep CORS updates on and select Connect provider.

Then select Test connection. You want Connection verified with “CORS allows direct uploads”.

A connection reaches one jurisdiction. If you have buckets in both Standard and EU, add a connection for each.

If uploads are blocked by CORS

If the test warns that CORS doesn’t allow quickS3, your token may not be allowed to change bucket settings. Add the rule by hand: open the bucket in the Cloudflare dashboard, go to Settings → CORS Policy, and add this JSON, keeping any rules already there.

[
  {
    "AllowedOrigins": ["https://quicks3.com"],
    "AllowedMethods": ["GET", "HEAD", "PUT"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

R2 can take about 30 seconds to apply a CORS change. If the next test still warns, wait a moment and run it again before changing anything else.

Creating buckets

The Create bucket button on Overview needs an Admin Read & Write token. If you don’t want to hand quickS3 that much access, create buckets in the Cloudflare dashboard, keep the narrower Object token, and add the new bucket to Bucket scopes.