Connect a Cloudflare R2 bucket

Connect a Cloudflare R2 bucket so jobs can read files from it and write outputs back to it. For how connections work across providers, see storage connections.

Rendobar reading inputs from and delivering outputs to a Cloudflare R2 bucket, alongside the other storage kinds it connects to — Rendobar reading inputs from an R2 bucket and writing outputs back.

Prerequisites

You need a Cloudflare account with an R2 bucket. R2 accepts two kinds of credential. Choose one with Key type in the connect dialog:

Key type	Use when	You enter
API token	You have no credentials for the bucket yet	API token, bucket name
Access key and secret	You already have an S3 key pair	Account ID, bucket name, access key ID, secret access key

This page uses an API token. To use a key pair instead, see Connect with an access key and secret.

1. Create an R2 API token

In the Cloudflare dashboard, go to R2 Object Storage > Manage API tokens.
Select Create Account API token.
Under Permissions, select Object Read & Write.
Under Specify bucket(s), select Apply to specific buckets only, then select your bucket.
Select Create Account API Token.

Rendobar reads, writes, lists, and deletes objects. It never creates or deletes buckets, so Admin Read & Write is more access than it needs.

Cloudflare's Create Account API Token page with Object Read and Write selected and a single bucket chosen — Object Read and Write, applied to one bucket.

Cloudflare shows the token only once. Copy it before you leave the page, or you will need to create a new one.

The created token page in Cloudflare, with the token value shown once — The created token.

2. Connect the bucket

In Storage, select Connect Storage, then Cloudflare R2.
In API token, paste the token. In Bucket, enter the bucket name.
(Optional) Under More options, change the ID. Jobs use it to reference the bucket.
Select Connect.

You can paste the whole Cloudflare token page into API token. Rendobar finds the token in the text.

The Cloudflare R2 connect dialog with the API token masked and the bucket name filled in — The R2 connect dialog with a token and bucket name entered.

Rendobar runs its access checks and saves the connection only if they pass. If the bucket does not exist, the dialog offers Create the bucket and connect.

The finish screen showing write, read, list and delete all passing, with copyable source and destinations snippets — A connected bucket, with the access checks passed and the storage URIs to use in jobs.

3. Use the bucket in a job

Put an object in inputs to read it, and the connection in destinations to write the output:

import { createClient, outputUrl } from "@rendobar/sdk";

const client = createClient({
  apiKey: process.env.RENDOBAR_API_KEY,
});

const job = await client.jobs.run({
  type: "ffmpeg",
  inputs: { source: "storage://demo-bucket/raw/clip.mp4" },
  params: {
    command: "ffmpeg -i source -vf scale=1280:-2 out.mp4",
  },
  destinations: ["storage://demo-bucket/exports"],
});

console.log(outputUrl(job));
console.log(job.deliveries);

curl https://api.rendobar.com/jobs \
  -H "Authorization: Bearer $RENDOBAR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "ffmpeg",
    "inputs": { "source": "storage://demo-bucket/raw/clip.mp4" },
    "params": {
      "command": "ffmpeg -i source -vf scale=1280:-2 out.mp4"
    },
    "destinations": ["storage://demo-bucket/exports"]
  }'

With the default output path, this writes exports/clip.mp4. Delivery finishes after the job, so job.deliveries can still show pending when run returns. To change how outputs are named, see delivery settings. If a delivery fails, see delivery errors.

How do I revoke access?

In the Cloudflare dashboard, go to R2 Object Storage > Manage API tokens.
Delete the token used by the connection.

The connection stops working immediately. To replace the credential without changing job payloads, rotate it instead.

Deleting a bucket does not revoke its token. A token scoped to all buckets still reaches every other bucket in the account, so scope tokens to one bucket.

Connect with an access key and secret

If you already have an S3 key pair for the bucket, set Key type to Access key and secret, then enter:

Account ID: 32 hexadecimal characters, shown on the R2 overview page
Access Key ID and Secret Access Key: from the key pair

Rendobar builds the endpoint from the account ID: https://<account-id>.r2.cloudflarestorage.com.

The Cloudflare R2 connect dialog on the access key and secret tab, with the account ID, access key ID and secret masked — The R2 connect dialog on the Access key and secret tab.

R2-specific behavior

Jurisdictions. Buckets in the EU or FedRAMP jurisdiction use a different endpoint. Set the jurisdiction under More options when you connect. Public URLs. Use the bucket’s r2.dev domain or a custom domain as the connection’s public URL. Egress. R2 does not charge for egress. See R2 pricing, and running FFmpeg on files in R2 for how that compares with S3.

Next steps

Storage connections

Connection ids, delivery settings, credentials, and error codes.

Jobs

Where inputs and destinations appear in the job payload.

SDK

Submit the job above in TypeScript.

Webhooks

Receive an event when a job completes.

Getting Started

Concepts

Storage

Jobs

Automation

Developer tools

Support

Connect a Cloudflare R2 bucket

Prerequisites

1. Create an R2 API token

2. Connect the bucket

3. Use the bucket in a job

How do I revoke access?

Connect with an access key and secret

R2-specific behavior

Next steps

Storage connections

Jobs

SDK

Webhooks

​Prerequisites

​1. Create an R2 API token

​2. Connect the bucket

​3. Use the bucket in a job

​How do I revoke access?

​Connect with an access key and secret

​R2-specific behavior

​Next steps

Storage connections

Jobs

SDK

Webhooks

Prerequisites

1. Create an R2 API token

2. Connect the bucket

3. Use the bucket in a job

How do I revoke access?

Connect with an access key and secret

R2-specific behavior

Next steps