How to Configure Cloudflare R2 CDN
This guide follows Cloudflare’s official R2 dashboard steps to create a bucket and S3-compatible API credentials, then paste them into XFile Ultra.
Sources: R2 Authentication / API tokens · Create buckets · Get started with S3 · Dashboard deep link: R2 Overview
---
Where this goes in XFile Ultra
Admin → Servers → Servers management → Add new CDN (or edit an existing CDN)
Provider: Cloudflare R2
---
What to paste into XFile Ultra
| XFile Ultra field | Copy from Cloudflare |
|---|---|
| Access key ID | R2 token Access Key ID |
| Secret access key | R2 token Secret Access Key (shown once) |
| Bucket name | Exact R2 bucket name |
| Cloudflare account ID | Account ID from R2 Account details |
| Public / custom domain URL | Optional (R2 custom domain) |
You do not paste an endpoint URL. XFile Ultra builds:
https://<ACCOUNT_ID>.r2.cloudflarestorage.com
(If your bucket uses the EU jurisdiction, Cloudflare’s docs use https://<ACCOUNT_ID>.eu.r2.cloudflarestorage.com — for XFile Ultra, use a default-jurisdiction bucket unless you know you need EU.)
---
Step 1 — Open R2 and copy your Account ID
1. Sign in to the Cloudflare dashboard
2. In the left sidebar go to Storage & databases → R2 → Overview
(Cloudflare also labels this R2 object storage. Direct link pattern: dash.cloudflare.com → R2 Overview)
3. If Cloudflare asks you to add an R2 subscription, complete checkout first — you must have R2 before API tokens work
4. On the Overview page, find Account details
5. Copy the Account ID (32-character id)
---
Step 2 — Create an R2 bucket
Per Cloudflare’s dashboard create-bucket steps:
1. Stay on R2 object storage / Overview
2. Select Create bucket
3. Enter a name for your bucket
4. Select a location (and default storage class if asked)
5. Select Create bucket
Copy the exact bucket name.
---
Step 3 — Create the R2 API token (Access Key ID + Secret Access Key)
Per Cloudflare R2: Authentication:
1. On R2 → Overview, under Account details, select Manage next to API Tokens
2. Choose one:
- Create Account API token — tied to the Cloudflare account (only Super Administrators can create/view these; stays valid until revoked)
- Create User API token — tied to your Cloudflare user (inherits your permissions; stops working if you are removed from the account)
3. Under Permissions, choose a permission type:
| Permission | When to use |
|---|---|
| Admin Read & Write | Best for XFile Ultra: can manage bucket config including CORS, plus read/write objects |
| Object Read & Write | Enough for file upload/download; you may need to paste CORS manually if auto-setup fails |
| Object Read only | Not enough for uploads |
4. If you chose Object Read & Write / Object Read, optionally scope the token to specific buckets (select your bucket)
5. Select Create Account API token or Create User API token (whichever you started)
6. On the success screen, copy:
- Access Key ID (Cloudflare may also call this Client ID)
- Secret Access Key (may also be called Client Secret)
Store them securely — the secret is shown once.
---
Step 4 — Map values into XFile Ultra
| Field | Value |
|---|---|
| Access key ID | Access Key ID from Step 3 |
| Secret access key | Secret Access Key from Step 3 |
| Bucket name | Bucket from Step 2 |
| Cloudflare account ID | Account ID from Step 1 |
Finish in XFile Ultra
1. Open Admin → Servers → Servers management → Add new CDN (or edit an existing CDN)
2. Choose the matching CDN provider
3. Paste every value from the “What to paste” table
4. Leave Performance mode on unless you want uploads to proxy through your VPS
5. Set the server status to ON when ready
6. Click Test connection
7. Click Save
If Test connection succeeds but says Performance mode requires bucket CORS, open Performance mode requires bucket CORS and paste the rule for your provider.
---
Common problems
Bucket not found / wrong region or endpoint
The bucket name must match exactly. The region (or Contabo / IDrive endpoint, or Cloudflare Account ID) must be the one for that bucket.
Access denied / bad credentials
Wrong Access Key ID or Secret Access Key, or the key cannot read/write that bucket. Create a new key with the right permissions and paste again.
Secret key lost
Almost every provider shows the secret once. You cannot look it up later — create or regenerate a key, update XFile Ultra, and stop using the old key.
Test connection OK, browser upload fails
Usually CORS. Use the Performance mode CORS article, or turn Performance mode off temporarily while you fix it.
R2 CORS note
R2 rejects CORS policies that use AllowedHeaders: ["*"]. Use the exact JSON from Performance mode requires bucket CORS. Prefer Admin Read & Write so Test connection can push CORS for you.