Step 1Create a Cloudflare account

Create a Cloudflare account at dash.cloudflare.com/sign-up, then open R2 object storage in the dashboard and turn it on.

Cloudflare may ask for a payment method before you can use R2.

Cloudflare bills you directly for storage; Dropbucket doesn't charge for it. Prices change, so check Cloudflare's pricing page for current rates.

Still choosing a provider? We recommend iDrive e2. See how to set up iDrive e2.

Step 2Create a private bucket and pick a region

  1. In the Cloudflare dashboard, open R2 object storage and select Create bucket.
  2. Enter a name using lowercase letters, numbers and dashes, for example agency-transfers. Dropbucket won't accept capitals or underscores.
  3. Location: Automatic is fine. You can choose a location hint (such as Oceania) to keep files near you and your clients. If you choose the EU jurisdiction, note it: your endpoint is slightly different (see Step 4).
  4. Select Create bucket.

R2 buckets are private unless you turn on public access. Leave it off: Dropbucket uses short-lived signed links.

Step 3Create an access key for that bucket only

  1. On the R2 object storage page, find Account Details and select Manage next to API Tokens.
  2. Choose Create Account API token. (A User API token also works, but it stops working if your user is ever removed from the account.)
  3. Give it a name, like dropbucket.
  4. Under Permissions, choose Object Read & Write.
  5. Under the bucket scope, choose Apply to specific buckets only and pick the bucket from Step 2.
  6. Leave the TTL on forever. A token that expires breaks your links when it does.
  7. Create the token.

Cloudflare shows an Access Key ID and a Secret Access Key. Copy both somewhere safe. The secret is shown once only.

The exact menus may differ slightly as Cloudflare updates its dashboard.

Step 4Find your endpoint and region

Your R2 endpoint uses your Cloudflare account ID:

https://<ACCOUNT_ID>.r2.cloudflarestorage.com

Your account ID is on the R2 object storage overview page under Account Details, and on the token screen. For a bucket in the EU jurisdiction, the endpoint is https://<ACCOUNT_ID>.eu.r2.cloudflarestorage.com.

The bucket's settings page shows an S3 API address with the bucket name on the end. Dropbucket wants the address without it, so leave off everything after .com.

The region for R2 is always auto.

Step 5Enter the details in Dropbucket

  1. In Dropbucket, go to Settings → Storage.
  2. Provider: choose Cloudflare R2. Dropbucket fills in the endpoint https://<ACCOUNT_ID>.r2.cloudflarestorage.com and region auto for you.
  3. Endpoint: replace <ACCOUNT_ID> with your account ID from Step 4.
  4. Bucket: the bucket name from Step 2.
  5. Region: leave it as auto.
  6. Access key ID and Secret access key: the Access Key ID and Secret Access Key from Step 3.
  7. Folder inside the bucket (optional): leave it blank, or enter a folder such as client-files if the bucket holds other things too.
  8. Path-style URLs: leave it ticked. That's the right setting for Cloudflare R2.

Read Step 6 before you press Test and save. Your keys are encrypted before they're stored, and Dropbucket only uses them to sign uploads and downloads. Files never pass through Dropbucket's servers.

Step 6Add the CORS rule

Files travel from your client's browser straight into your bucket. The browser only allows that if the bucket says Dropbucket's pages may upload to it. That permission is a CORS rule.

The Storage page in Dropbucket shows the exact rule under CORS rule, and tries to apply it for you when you save.

An Object Read & Write token can't change bucket settings, so on R2 Dropbucket can't add this rule for you. Paste it once:

  1. In the R2 dashboard, open your bucket and select Settings.
  2. Under CORS Policy, select Add CORS policy.
  3. Open the JSON tab, paste the rule below and select Save.
[
  {
    "AllowedOrigins": [
      "https://app.dropbucket.io"
    ],
    "AllowedMethods": [
      "GET",
      "PUT",
      "HEAD"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "ETag"
    ],
    "MaxAgeSeconds": 3600
  }
]

Using your own domain for download and upload pages? Add it as a second origin, for example "https://files.youragency.com", with a comma after the first. No trailing slash. The Storage page in Dropbucket shows the rule with your verified domains already filled in, so copying it from there is safest. See Put your download pages on your own domain.

Keep ETag in ExposeHeaders. Dropbucket reads it after every chunk of a large upload, and uploads stop without it.

Step 7Run the connection check

  1. Press Test and save.
  2. Dropbucket writes a tiny test file to the bucket, reads it back and deletes it. When that works, the Status card shows a tick next to Keys work.
  3. It then tries to add the CORS rule and runs a real test upload from your browser. When that works, Browser uploads allowed (CORS) shows a tick.

On R2 you'll usually see "We couldn't set this automatically on your provider." That's expected with a bucket-limited token. If you pasted the rule in Step 6, Browser uploads allowed (CORS) will tick. If it doesn't, wait a minute and press Check again.

Two ticks means you're connected. Send a small test transfer to yourself to see the whole thing working.

Step 8Fix common errors

The messages below are exactly what Dropbucket shows on the Storage page.

Permissions

“The storage provider refused these keys. Check the access key, secret and bucket permissions.”Check you copied the full secret with no spaces. Check the token has Object Read & Write, not read only, and that it includes this bucket.

“Wrote a test file but could not read it back”The key can write but not read. Give it read and write access to the bucket, then press Test and save again.

Keys work, but uploads fail with a 403 errorUsually CORS. If CORS is fine, the token may have expired or been rolled. Create a new one and enter it under Settings → Storage.

Region and endpoint

“That bucket was not found at this endpoint.”The bucket name is wrong, or the account ID in the endpoint belongs to a different account. EU jurisdiction buckets need the .eu. endpoint.

“Wrong region or endpoint for this bucket.”Set Region back to auto.

“We couldn't reach your storage with these settings. Check the endpoint and region.”The endpoint has a typo or the region code is wrong. Copy the endpoint again from your provider's console.

“Endpoint should be just the address, with no path”You pasted the bucket's S3 API address, which has the bucket name on the end. Remove everything after .com.

“Custom S3 endpoints come with a lifetime plan. Pick one of the listed providers, or upgrade.”On the free plan the endpoint has to be one of the listed providers' own addresses. This usually means a typo in the domain part of the endpoint.

CORS

Keys work, but Browser uploads allowed (CORS) doesn't tickThe rule is missing, saved on a different bucket, or the origin has a typo. It must be exactly https://app.dropbucket.io, with no slash at the end. Cloudflare says changes can take up to 30 seconds to apply, then press Check again.

“Your storage didn't return an ETag. Check its CORS settings (expose ETag).”Your CORS rule is missing ETag under ExposeHeaders. Add it back and save the rule.

Still stuck? Email support@dropbucket.io with the message you see. Never send us your secret key.