Cloudflare R2 is a good first choice for Dropbucket. R2 doesn’t charge for downloads (egress), so sending a 200 GB rushes folder to a client costs the same as sending a 2 MB PDF. You pay for storage and requests only. Check Cloudflare’s R2 pricing page for current rates.

This guide takes about ten minutes.

What you need

  • A Cloudflare account with R2 turned on. Cloudflare may ask for a payment method before you can use R2, even on the free allowance.
  • A Dropbucket account. The free plan works with R2.

Step 1: Create a bucket

  1. Sign in to the Cloudflare dashboard and open R2 object storage.
  2. Select Create bucket.
  3. Enter a name. Use lowercase letters, numbers and dashes only, for example agency-transfers. Dropbucket won’t accept capitals or underscores.
  4. Leave the location on automatic unless you have a reason to pin it. If you choose an EU jurisdiction, note it: your endpoint will be slightly different (see Step 3).
  5. Select Create bucket.

Keep the bucket private. Dropbucket uses short-lived signed links, so the bucket never needs public access.

Step 2: Create an API token

  1. On the R2 object storage page, find Account Details and select Manage next to API Tokens.
  2. Choose Create Account API token. (A User API token also works, but it stops working if your user is ever removed from the account.)
  3. Give it a name, like dropbucket.
  4. Under Permissions, choose Object Read & Write.
  5. Under the bucket scope, choose Apply to specific buckets only and pick the bucket from Step 1.
  6. Leave the TTL on forever. A token that expires will break your links when it does.
  7. Create the token.

Cloudflare now shows an Access Key ID and a Secret Access Key. Copy both somewhere safe. The secret is shown once only.

The exact menu may differ slightly as Cloudflare updates its dashboard.

Step 3: Find your endpoint

Your R2 endpoint uses your Cloudflare account ID:

https://<ACCOUNT_ID>.r2.cloudflarestorage.com

Your account ID is on the R2 object storage overview page under Account Details. It’s also on the token screen.

For a bucket in the EU jurisdiction, the endpoint is https://<ACCOUNT_ID>.eu.r2.cloudflarestorage.com.

One common mistake: the bucket’s settings page shows an S3 API address with the bucket name on the end. Dropbucket wants the address without the bucket name. Leave off everything after .com.

Step 4: Add the CORS rule

Files travel from your client’s browser straight into R2. The browser only allows that if the bucket says Dropbucket’s pages may upload to it. That permission is a CORS rule.

An Object Read & Write token can’t change bucket settings, so Dropbucket can’t add this rule for you on R2. You paste it once:

  1. In the R2 dashboard, open your bucket and select Settings.
  2. Under CORS Policy, select Add CORS policy.
  3. Open the JSON tab and paste this:
[
  {
    "AllowedOrigins": [
      "https://app.dropbucket.io"
    ],
    "AllowedMethods": [
      "GET",
      "PUT",
      "HEAD"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "ETag"
    ],
    "MaxAgeSeconds": 3600
  }
]
  1. Select Save.

If you use your own domain for download and upload pages, such as files.youragency.com, add it as a second origin: "https://files.youragency.com", with a comma after the first one. No trailing slash. The Storage page in Dropbucket shows the same rule with your verified domains already filled in, so copying it from there is the safest option. See Put your download pages on your own domain.

Don’t remove ETag from ExposeHeaders. Dropbucket reads it after every chunk of a large upload. Without it, uploads stop with an ETag error.

Step 5: Connect R2 in Dropbucket

  1. In Dropbucket, go to Settings → Storage.
  2. Under Provider, choose Cloudflare R2. Dropbucket fills in the endpoint pattern and sets Region to auto.
  3. Endpoint: replace <ACCOUNT_ID> with your account ID.
  4. Bucket: the bucket name from Step 1.
  5. Region: leave it as auto.
  6. Access key ID and Secret access key: paste the values from Step 2.
  7. Folder inside the bucket (optional): leave blank, or enter a folder name like client-files if the bucket holds other things too.
  8. Leave Path-style URLs ticked.

Test the connection

Press Test and save.

Dropbucket writes a tiny test file to the bucket, reads it back and deletes it. When that works, the Status card shows a tick next to Keys work.

It then tries to set the CORS rule and runs a real upload from your browser. On R2 you’ll usually see “We couldn’t set this automatically on your provider.” That’s expected with a bucket-scoped token. If you pasted the rule in Step 4, Browser uploads allowed (CORS) will tick over. If it doesn’t, wait a minute and press Check again.

Your keys are encrypted before they’re stored. Dropbucket only uses them to sign uploads and downloads. Files never pass through Dropbucket’s servers.

Troubleshooting

“The storage provider refused these keys.” Check you copied the full secret with no spaces. Check the token has Object Read & Write, not Read only, and that it includes this bucket.

“That bucket was not found at this endpoint.” The bucket name is wrong, or the account ID in the endpoint belongs to a different account. EU jurisdiction buckets need the .eu. endpoint.

“Endpoint should be just the address, with no path.” You pasted the S3 API address with the bucket name on the end. Remove it.

Keys work, but the CORS check fails. The CORS rule is missing, saved on a different bucket, or has a typo in the origin. Origins must match exactly: https://app.dropbucket.io, no slash at the end. Cloudflare says changes can take up to 30 seconds to apply.

Uploads fail with 403. Usually CORS (see above). If CORS is fine, the token may have expired or been rolled. Create a new one and enter it in Settings → Storage. Leaving the key fields blank keeps the saved keys.

“Your storage didn’t return an ETag.” ETag is missing from ExposeHeaders in your CORS rule. Add it back and save.

Path-style. R2 works with path-style URLs ticked. If you’ve unticked it and things fail, tick it again.

Next steps

Add your logo under Settings → Branding, then send your first transfer or create a request link so clients can upload straight into R2.

Ready to try it? Create a free Dropbucket account and connect your bucket.