Cloudflare R2

InstallationCopy Anchor Link

Install package

npm i @uplo/service-r2

Add service to Uplo

import { createR2Service } from '@uplo/service-r2'

const uplo = createUplo({
  services: {
    r2: createR2Service({
      accountId: process.env.R2_ACCOUNT_ID,
      bucket: process.env.R2_BUCKET,
      accessKeyId: '*****',
      secretAccessKey: '*****',
    }),
  },
})

The service works in Node.js and Cloudflare Workers. No extra Workers config is needed.

OptionsCopy Anchor Link

• accountId (required): Your Cloudflare account ID. Used to build the endpoint https://<accountId>.r2.cloudflarestorage.com.
• bucket (required): Your bucket name where to store objects.
• accessKeyId (required): Access Key ID from your R2 API token.
• secretAccessKey (required): Secret Access Key from your R2 API token.
• jurisdiction: 'eu' or 'fedramp', if the bucket was created with a jurisdiction.
• endpoint: Full S3 API endpoint. Overrides accountId and jurisdiction.
• isPublic = false: Serve files from a public bucket URL. Requires publicUrl. See Public bucket
• publicUrl: Public bucket URL (r2.dev subdomain or custom domain).
• storagePath: Default file path in the bucket for attachments without their own storagePath. See Storage path

Public bucketCopy Anchor Link

R2 has no per-file ACLs. To serve files publicly, enable public access on the bucket (r2.dev subdomain or custom domain) in the Cloudflare dashboard and pass its URL:

createR2Service({
  accountId: process.env.R2_ACCOUNT_ID,
  bucket: process.env.R2_BUCKET,
  accessKeyId: '*****',
  secretAccessKey: '*****',
  isPublic: true,
  publicUrl: 'https://files.example.com',
})

Private buckets use signed URLs instead.

Direct UploadCopy Anchor Link

CORSCopy Anchor Link

This is example CORS configuration for direct uploads. Add it in the bucket Settings → CORS Policy.

[
  {
    "AllowedOrigins": ["https://www.example.com"],
    "AllowedMethods": ["PUT"],
    "AllowedHeaders": ["Content-Type", "Content-MD5"],
    "MaxAgeSeconds": 3600
  }
]