1# R2 Configuration
2 
3## Workers Binding
4 
5**wrangler.jsonc:**
6```jsonc
7{
8  "r2_buckets": [
9    {
10      "binding": "MY_BUCKET",
11      "bucket_name": "my-bucket-name"
12    }
13  ]
14}
15```
16 
17## TypeScript Types
18 
19```typescript
20interface Env { MY_BUCKET: R2Bucket; }
21 
22export default {
23  async fetch(request: Request, env: Env): Promise<Response> {
24    const object = await env.MY_BUCKET.get('file.txt');
25    return new Response(object?.body);
26  }
27}
28```
29 
30## S3 SDK Setup
31 
32```typescript
33import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
34 
35const s3 = new S3Client({
36  region: 'auto',
37  endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
38  credentials: {
39    accessKeyId: env.R2_ACCESS_KEY_ID,
40    secretAccessKey: env.R2_SECRET_ACCESS_KEY
41  }
42});
43 
44await s3.send(new PutObjectCommand({
45  Bucket: 'my-bucket',
46  Key: 'file.txt',
47  Body: data,
48  StorageClass: 'STANDARD' // or 'STANDARD_IA'
49}));
50```
51 
52## Location Hints
53 
54```bash
55wrangler r2 bucket create my-bucket --location=enam
56 
57# Hints: wnam, enam, weur, eeur, apac, oc
58# Jurisdictions (override hint): --jurisdiction=eu (or fedramp)
59```
60 
61## CORS Configuration
62 
63CORS must be configured via S3 SDK or dashboard (not available in Workers API):
64 
65```typescript
66import { S3Client, PutBucketCorsCommand } from '@aws-sdk/client-s3';
67 
68const s3 = new S3Client({
69  region: 'auto',
70  endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
71  credentials: {
72    accessKeyId: env.R2_ACCESS_KEY_ID,
73    secretAccessKey: env.R2_SECRET_ACCESS_KEY
74  }
75});
76 
77await s3.send(new PutBucketCorsCommand({
78  Bucket: 'my-bucket',
79  CORSConfiguration: {
80    CORSRules: [{
81      AllowedOrigins: ['https://example.com'],
82      AllowedMethods: ['GET', 'PUT', 'HEAD'],
83      AllowedHeaders: ['*'],
84      ExposeHeaders: ['ETag'],
85      MaxAgeSeconds: 3600
86    }]
87  }
88}));
89```
90 
91## Object Lifecycles
92 
93```typescript
94import { PutBucketLifecycleConfigurationCommand } from '@aws-sdk/client-s3';
95 
96await s3.send(new PutBucketLifecycleConfigurationCommand({
97  Bucket: 'my-bucket',
98  LifecycleConfiguration: {
99    Rules: [
100      {
101        ID: 'expire-old-logs',
102        Status: 'Enabled',
103        Prefix: 'logs/',
104        Expiration: { Days: 90 }
105      },
106      {
107        ID: 'transition-to-ia',
108        Status: 'Enabled',
109        Prefix: 'archives/',
110        Transitions: [{ Days: 30, StorageClass: 'STANDARD_IA' }]
111      }
112    ]
113  }
114}));
115```
116 
117## API Token Scopes
118 
119When creating R2 tokens, set minimal permissions:
120 
121| Permission | Use Case |
122|------------|----------|
123| Object Read | Public serving, downloads |
124| Object Write | Uploads only |
125| Object Read & Write | Full object operations |
126| Admin Read & Write | Bucket management, CORS, lifecycles |
127 
128**Best practice:** Separate tokens for Workers (read/write) vs admin tasks (CORS, lifecycles).
129 
130## Event Notifications
131 
132```jsonc
133// wrangler.jsonc
134{
135  "r2_buckets": [
136    {
137      "binding": "MY_BUCKET",
138      "bucket_name": "my-bucket",
139      "event_notifications": [
140        {
141          "queue": "r2-events",
142          "actions": ["PutObject", "DeleteObject", "CompleteMultipartUpload"]
143        }
144      ]
145    }
146  ],
147  "queues": {
148    "producers": [{ "binding": "R2_EVENTS", "queue": "r2-events" }],
149    "consumers": [{ "queue": "r2-events", "max_batch_size": 10 }]
150  }
151}
152```
153 
154## Bucket Management
155 
156```bash
157wrangler r2 bucket create my-bucket --location=enam --storage-class=Standard
158wrangler r2 bucket list
159wrangler r2 bucket info my-bucket
160wrangler r2 bucket delete my-bucket  # Must be empty
161wrangler r2 bucket update-storage-class my-bucket --storage-class=InfrequentAccess
162 
163# Public bucket via dashboard
164wrangler r2 bucket domain add my-bucket --domain=files.example.com
165```
166