Skip to main content
Guyun
Language 简体 繁體 English

Cloudflare R2

About 10 minutes, and creating the bucket and the token costs nothing: this is how you prepare one bucket and one key pair in Cloudflare R2 for Guyun — whose standout feature is that egress traffic is not charged.

R2's location is not yours to choose (placement is automatic), and the endpoint contains your account ID — the two things that set it apart from other providers.

Step by step

  1. Step 1

    Sign up and open R2

    • Sign up or sign in at the Cloudflare dashboard; skip this if you already have an account.
    • Choose R2 object storage in the sidebar; if this is your first time, follow the prompt to enable R2.

  2. Step 2

    Create the bucket

    • On the R2 overview choose Create bucket and enter a name: lowercase letters, numbers and hyphens only, 3–63 characters.
    • Leave Location at its default (Automatic, which places the bucket in Asia Pacific); leave Specify jurisdiction alone and keep Default Storage Class on Standard; public access is off by default, so keep it off, then choose Create bucket.

  3. Step 3

    Create an API token and copy the key

    • Open the R2 API Tokens page. Tokens come in two kinds: an Account API token is tied to the whole account (Cloudflare marks it recommended), while a User API token is tied to your user and stops working if you leave the organisation — for a personal account they are equivalent, so pick either one and choose Create Account API token or Create User API token.
    • Pick the Object Read & Write permission and scope it to the bucket you just created; the Access Key ID and Secret Access Key are shown once, so save them now.

  4. Step 4

    Note the account ID

    • Copy the Account ID (32 hexadecimal characters) from the same Account Details panel; the account home page (Manage Account) shows it too.
    • The endpoint is built from it: https://<Account ID>.r2.cloudflarestorage.com. Guyun has an extra field for it — like Tencent Cloud COS with its APPID, R2 asks for one more value than most providers.

  5. Step 5

    Fill it in and test

    • In Guyun, Add storage → Cloudflare R2, then enter the bucket name, account ID and key from the table below; the endpoint is already filled in by the app.
    • Then choose Test connection & save.

Choose the right permissions for the token

There is no policy JSON to paste: S3 clients are authorised with an API token. When you create it, choose:

  • Permission Object Read & Write — read, write and list objects, but no creating buckets or editing bucket settings.
  • Under resources, tick only the bucket you just created, so this key pair can touch nothing else.
  • Copy the Access Key ID and Secret Access Key right away: the secret access key is shown once.

R2's S3 API does not implement PutBucketPolicy, so there is no policy JSON here — the token above is the authorisation. That is the biggest difference from AWS S3.

Other cases (skip if not needed)

Console address: https://dash.cloudflare.com/ (straight to R2: https://dash.cloudflare.com/?to=/:account/r2/overview).

r2.dev is not the endpoint

  • A bucket can be given a public r2.dev domain, which is meant for browser access — it is not the endpoint, so do not paste it into Guyun.
  • What Guyun needs is the S3 API endpoint https://<Account ID>.r2.cloudflarestorage.com; it appears on the token confirmation page and on the R2 overview.

Cost

  • R2 has a free tier covering storage and Class A and Class B operations (standard storage only); check the Cloudflare website for the current amounts.
  • Egress is not charged: downloading from R2 adds no traffic fee even beyond the free tier, which is R2's standout feature.
  • Everything else is billed by usage, and rejected requests are not charged.

Official sources

Copy these four values

They go into the matching fields on Guyun's "Add storage" screen (R2 has one extra field, Account ID): Place: R2 has none to pick (placement is automatic); the endpoint is filled in by the app from the account ID, so you do not type it — just enter the bucket name, account ID and key from the table above. (Careful: the dashboard shows two addresses that look like the S3 endpoint — the token confirmation page gives it under "Use jurisdiction-specific endpoints → Default" with no bucket name, and that is the one you want; the bucket's Settings → S3 API row ends with /your-bucket-name, which is a bucket-scoped URL — do not paste that into Guyun.)

This valueWhere it goes in Guyun
Bucket name
The name you just created, e.g. your-bucket-name.		Bucket name
Account ID
The 32-character hexadecimal account ID from the Account Details panel — the endpoint uses it too.		Account ID
Endpoint
https://<Account ID>.r2.cloudflarestorage.com, with no bucket name; the app fills this one in, so leave it as it is.		Endpoint
Key
The Access Key ID and Secret Access Key of that API token.		Access key ID and secret access key

How to tell it worked

  • The connection test passes, which means the key can read this bucket; Guyun only lists the root directory and changes nothing.
  • The storage then appears in Guyun's list, and you can open it to see the files in the bucket.
  • If you test the connection right after enabling R2 and get a TLS / secure-connection error, wait a few minutes and try again — a new account's R2 endpoint takes a little while to come up.
  • If it fails, see common errors.

Go back to Guyun and choose Test connection & save.