Cloudflare R2
Cloudflare R2 node reference - all 26 operations, the credential it needs, and a worked example.
Calls Cloudflare R2 through its S3-compatible API at ACCOUNT_ID.r2.cloudflarestorage.com with an R2 API token, across 26 operations signed with SigV4 against the auto region and addressed path-style. Runs on the same engine as the AWS S3 node, so the object surface matches: upload from text or base64 with content type, cache headers, storage class and custom metadata; download as text or base64 with byte ranges and conditional requests; server-side copy, including Cloudflare's MERGE metadata directive, which keeps the source's metadata while adding new keys and has no S3 equivalent; delete one key or up to 1000 in a single batch; list a prefix with delimiters and continuation tokens; the full multipart family for large files; and bucket create/delete/list/head/location plus CORS, lifecycle and default-encryption configuration. Presigned URLs perform GET, PUT, HEAD or DELETE for 1 second to 7 days, so a workflow can hand someone an UPLOAD link, not only a download link - and Set CORS rules is the other half of that, because a browser cannot use a presigned PUT until a rule allows its origin. An object key containing a . or .. segment is refused rather than silently normalized: because R2 is addressed path-style, such a key reached a DIFFERENT BUCKET under the same credential, not merely a different prefix. R2 implements a subset of S3 - no ACLs, no object tagging, no versioning, no Object Lock, no SSE-KMS and no archive tier - so those operations are declined by name rather than offered and left to fail at run time. No trigger node: R2 event notifications are delivered to a queue or a Worker, not to an arbitrary HTTPS callback.
Credential: Cloudflare R2 API token (accountId, accessKeyId, secretAccessKey, bucket) - see Credentials.
API token permission groups
Each operation below lists the API token permission group it needs. API token permission groups are attached to the Cloudflare R2 API token behind the access key. R2 has NO IAM and no OAuth scopes - the equivalent question is which of Cloudflare's four permission groups the token carries, which is what a 403 from R2 is asking for. The distinction that catches people out is bucket-scoped versus account-level: the two Workers R2 Storage Bucket Item groups cover objects inside the buckets the token was made for, so a token with those can upload and download all day and still cannot list buckets, create one, or read a bucket's CORS or lifecycle configuration - those need the account-level Workers R2 Storage Read or Workers R2 Storage Write. If a run fails with a permission error, the node names the missing API token permission group in the error - grant it and re-run; you do not need to rebuild the workflow.
Operations (26)
Objects — read
| Operation | What it does | API token permission group |
|---|---|---|
getObject | Download an object | Workers R2 Storage Bucket Item Read (or any wider group) |
headObject | Get object metadata | Workers R2 Storage Bucket Item Read (or any wider group) |
listObjects | List objects | Workers R2 Storage Bucket Item Read (or any wider group) |
getSignedUrl | Create a presigned URL | the group the link's own operation needs — Bucket Item Read to presign a download, Bucket Item Write to presign an upload. The link carries the signing token's permissions, so it cannot outlive or exceed them |
Objects — write
| Operation | What it does | API token permission group |
|---|---|---|
putObject | Upload an object | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
copyObject | Copy an object | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
deleteObject | Delete an object | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
deleteObjects | Delete many objects | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
Large uploads (multipart)
| Operation | What it does | API token permission group |
|---|---|---|
createMultipartUpload | Start a multipart upload | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
uploadPart | Upload a part | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
uploadPartCopy | Copy a range into a part | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
completeMultipartUpload | Finish a multipart upload | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
abortMultipartUpload | Abort a multipart upload | Workers R2 Storage Bucket Item Write (or Workers R2 Storage Write) |
listMultipartUploads | List multipart uploads | Workers R2 Storage Bucket Item Read (or any wider group) |
listParts | List uploaded parts | Workers R2 Storage Bucket Item Read (or any wider group) |
Buckets
| Operation | What it does | API token permission group |
|---|---|---|
listBuckets | List buckets | Workers R2 Storage Read — an account-level group, because listing buckets and reading bucket configuration are not object operations |
headBucket | Check a bucket exists | Workers R2 Storage Read — an account-level group, because listing buckets and reading bucket configuration are not object operations |
createBucket | Create a bucket | Workers R2 Storage Write — an account-level group, because creating, deleting and configuring buckets are not object operations |
deleteBucket | Delete an empty bucket | Workers R2 Storage Write — an account-level group, because creating, deleting and configuring buckets are not object operations |
getBucketLocation | Get a bucket's location | Workers R2 Storage Read — an account-level group, because listing buckets and reading bucket configuration are not object operations |
Bucket CORS, lifecycle and encryption
| Operation | What it does | API token permission group |
|---|---|---|
getBucketCors | Get CORS rules | Workers R2 Storage Read — an account-level group, because listing buckets and reading bucket configuration are not object operations |
putBucketCors | Set CORS rules | Workers R2 Storage Write — an account-level group, because creating, deleting and configuring buckets are not object operations |
deleteBucketCors | Remove CORS rules | Workers R2 Storage Write — an account-level group, because creating, deleting and configuring buckets are not object operations |
getBucketLifecycleConfiguration | Get lifecycle rules | Workers R2 Storage Read — an account-level group, because listing buckets and reading bucket configuration are not object operations |
putBucketLifecycleConfiguration | Set lifecycle rules | Workers R2 Storage Write — an account-level group, because creating, deleting and configuring buckets are not object operations |
getBucketEncryption | Get default encryption | Workers R2 Storage Read — an account-level group, because listing buckets and reading bucket configuration are not object operations |
Example
Hand someone an upload link instead of taking the bytes yourself
A workflow needs a customer to send in a large file. Routing the bytes through the workflow is slow and size-capped; a presigned PUT link lets the browser upload straight to R2 with no Cloudflare account at the other end. Note the browser cannot use that link until a CORS rule allows the page's origin — that failure appears only as a browser CORS error with nothing in R2's logs, which is why putBucketCors ships on this node too.
Set Operation to getSignedUrl, then fill in:
| Field | Value | Notes |
|---|---|---|
bucket | customer-uploads | Overrides the credential's default bucket, so one API token can address many buckets |
key | inbox/{{ myTrigger.ticketId }}/{{ myTrigger.filename }} | A . or .. segment is refused — R2 shared the S3 traversal bug until SW20c.1, where .. addressed a DIFFERENT bucket under the same credential |
presignMethod | PUT | PUT for an upload link. The node could only ever presign GET before SW20c.1 |
expiresIn | 3600 | Seconds, capped at SigV4's 604800 ceiling rather than producing a link that 403s when clicked |
Sets {{upload.url}} (the presigned link), {{upload.expiresIn}} and {{upload.key}}. Hand {{upload.url}} to the customer; nothing else is needed to authorise the upload.