Cloudflare R2 CDN (upload failed)
If members cannot upload when your CDN is Cloudflare R2, or the admin form shows a connection / Performance mode problem after setup, check two things in order:
1. Bucket CORS
2. R2 API token permission
Either one (or both) can cause uploads to fail even when the Access Key ID and Secret Access Key look correct.
---
Where this shows up
- Member / guest upload fails while using an R2 CDN
- Admin → Servers → Servers management → edit your Cloudflare R2 CDN → Test connection warns about CORS or uploads still fail afterward
---
1 — Check CORS
With Performance mode on, the browser uploads directly to the R2 bucket. The bucket must allow your site domain (CORS).
Paste this CORS policy
1. Open the Cloudflare dashboard
2. Go to R2 Object Storage → open your bucket
3. Open Settings → CORS policy → Add (or Edit)
4. Paste the JSON below (replace YOUR-DOMAIN.com with your real site domain; include www if you use it)
5. Save
[
{
"AllowedOrigins": [
"https://YOUR-DOMAIN.com",
"https://www.YOUR-DOMAIN.com"
],
"AllowedMethods": ["GET", "PUT", "HEAD"],
"AllowedHeaders": ["content-type", "content-length"],
"ExposeHeaders": ["ETag"],
"MaxAgeSeconds": 86400
}
]| Field | Value | Why |
|---|---|---|
| AllowedOrigins | Your site HTTPS URLs | Only your site may talk to the bucket from the browser |
| AllowedMethods | GET, PUT, HEAD | Download, upload, and checks |
| AllowedHeaders | content-type, content-length | Required for uploads — do not use * on R2 |
| ExposeHeaders | ETag | Browser can see upload confirmation |
| MaxAgeSeconds | 86400 | Cache CORS answer for 24 hours |
More detail for every CDN: Performance mode requires bucket CORS.
Then in XFile Ultra: edit the R2 CDN → Test connection → try a small upload again.
---
2 — Check the API token permission
If CORS is correct and uploads still fail (or XFile Ultra cannot push CORS for you), the R2 token often has a permission that is too weak.
Exact clicks in Cloudflare
1. Open the Cloudflare dashboard
2. Go to R2 Object Storage → Overview
3. Under Account details, click Manage (next to API Tokens)
4. Find your Account API token (the one whose Access Key ID you pasted into XFile Ultra)
5. Click the ⋯ (three dots) on that token → Edit
6. Under Permissions, choose one of these:
| Permission | What it does for XFile Ultra |
|---|---|
| Object Read & Write | Allows reading and writing objects (uploads / downloads) |
| Admin Read & Write | Same object access, plus bucket configuration (including CORS). Prefer this if auto CORS push failed |
7. Save the token changes
8. Back in XFile Ultra, edit the Cloudflare R2 CDN → Test connection → try uploading again
You do not need to create a brand-new Access Key ID / Secret Access Key if you can Edit the existing Account API token and raise its permission. If Edit is not available for that token type, create a new token with Object Read & Write or Admin Read & Write, paste the new Access Key ID and Secret Access Key into XFile Ultra, and save.
---
Quick checklist
1. CORS pasted on the bucket (origins match your real domain; headers are not *)
2. Token permission is Object Read & Write or Admin Read & Write
3. Cloudflare account ID, bucket name, Access Key ID, and Secret Access Key in XFile Ultra still match this token / bucket
4. CDN Performance mode is on (or turn it off temporarily to confirm the rest of the CDN works via proxy)
---