Skip to content

Commit 8ec22d3

Browse files
smellercfsmellercf
committed
update docs for R2 Account level and User level API tokens
1 parent 2422c65 commit 8ec22d3

File tree

1 file changed

+85
-91
lines changed

1 file changed

+85
-91
lines changed

‎src/content/docs/r2/api/s3/tokens.mdx‎ renamed to ‎src/content/docs/r2/api/tokens.mdx‎

Lines changed: 85 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ title: Authentication
33
pcx_content_type: how-to
44
sidebar:
55
order: 2
6-
76
---
87

98
You can generate an API token to serve as the Access Key for usage with existing S3-compatible SDKs or XML APIs.
@@ -13,38 +12,35 @@ You must purchase R2 before you can generate an API token.
1312
To create an API token:
1413

1514
1. In **Account Home**, select **R2**.
16-
2. Under **Account details**, select **Manage R2 API tokens**.
17-
3. Select [**Create API token**](https://dash.cloudflare.com/?to=/:account/r2/api-tokens).
18-
4. Select the **R2 Token** text to edit your API token name.
19-
5. Under **Permissions**, choose a permission types for your token. Refer to [Permissions](#permissions) for information about each option.
20-
6. (Optional) If you select the **Object Read and Write** or **Object Read** permissions, you can scope your token to a set of buckets.
21-
7. Select **Create API Token**.
15+
2. Under the **API** dropdown, select [**Manage API tokens**](https://dash.cloudflare.com/?to=/:account/r2/api-tokens).
16+
3. Choose to create either:
17+
- **Create Account API token** - These tokens are tied to the Cloudflare account itself and can be used by any authorized system or user. Only users with the Super Administrator role can view or create them. These tokens remain valid until manually revoked.
18+
- **Create User API token** - These tokens are tied to your individual Cloudflare user. They inherit your personal permissions and become inactive if your user is removed from the account.
19+
4. Under **Permissions**, choose a permission types for your token. Refer to [Permissions](#permissions) for information about each option.
20+
5. (Optional) If you select the **Object Read and Write** or **Object Read** permissions, you can scope your token to a set of buckets.
21+
6. Select **Create Account API token** or **Create User API token**.
2222

2323
After your token has been successfully created, review your **Secret Access Key** and **Access Key ID** values. These may often be referred to as Client Secret and Client ID, respectively.
2424

2525
:::caution
2626

27-
2827
You will not be able to access your **Secret Access Key** again after this step. Copy and record both values to avoid losing them.
2928

30-
3129
:::
3230

3331
You will also need to configure the `endpoint` in your S3 client to `https://<ACCOUNT_ID>.r2.cloudflarestorage.com`.
3432

3533
Find your [account ID in the Cloudflare dashboard](/fundamentals/setup/find-account-and-zone-ids/).
3634

37-
Buckets created with jurisdictions must be accessed via jurisdiction-specific `endpoint`s:
35+
Buckets created with jurisdictions must be accessed via jurisdiction-specific endpoints:
3836

39-
* European Union (EU): `https://<ACCOUNT_ID>.eu.r2.cloudflarestorage.com`
40-
* FedRAMP: `https://<ACCOUNT_ID>.fedramp.r2.cloudflarestorage.com`
37+
- European Union (EU): `https://<ACCOUNT_ID>.eu.r2.cloudflarestorage.com`
38+
- FedRAMP: `https://<ACCOUNT_ID>.fedramp.r2.cloudflarestorage.com`
4139

4240
:::caution
4341

44-
4542
Jurisdictional buckets can only be accessed via the corresponding jurisdictional endpoint. Most S3 clients will not let you configure multiple `endpoints`, so you'll generally have to initialize one client per jurisdiction.
4643

47-
4844
:::
4945

5046
## Permissions
@@ -78,9 +74,9 @@ A specific bucket is represented as:
7874
"com.cloudflare.edge.r2.bucket.<ACCOUNT_ID>_<JURISDICTION>_<BUCKET_NAME>": "*"
7975
```
8076

81-
* `ACCOUNT_ID`: Refer to [Find zone and account IDs](/fundamentals/setup/find-account-and-zone-ids/#find-account-id-workers-and-pages).
82-
* `JURISDICTION`: The [jurisdiction](/r2/reference/data-location/#available-jurisdictions) where the R2 bucket lives. For buckets not created in a specific jurisdiction this value will be `default`.
83-
* `BUCKET_NAME`: The name of the bucket your Access Policy applies to.
77+
- `ACCOUNT_ID`: Refer to [Find zone and account IDs](/fundamentals/setup/find-account-and-zone-ids/#find-account-id-workers-and-pages).
78+
- `JURISDICTION`: The [jurisdiction](/r2/reference/data-location/#available-jurisdictions) where the R2 bucket lives. For buckets not created in a specific jurisdiction this value will be `default`.
79+
- `BUCKET_NAME`: The name of the bucket your Access Policy applies to.
8480

8581
All buckets in an account are represented as:
8682

@@ -90,97 +86,97 @@ All buckets in an account are represented as:
9086
}
9187
```
9288

93-
* `ACCOUNT_ID`: Refer to [Find zone and account IDs](/fundamentals/setup/find-account-and-zone-ids/#find-account-id-workers-and-pages).
89+
- `ACCOUNT_ID`: Refer to [Find zone and account IDs](/fundamentals/setup/find-account-and-zone-ids/#find-account-id-workers-and-pages).
9490

9591
#### Permission groups
9692

9793
Determine what [permission groups](/fundamentals/api/how-to/create-via-api/#permission-groups) should be applied. There are four relevant permission groups for R2.
9894

9995
<table>
100-
<tbody>
101-
<th colspan="5" rowspan="1">
102-
Permission group
103-
</th>
104-
<th colspan="5" rowspan="1">
105-
Resource
106-
</th>
107-
<th colspan="5" rowspan="1">
108-
Permission
109-
</th>
110-
<tr>
111-
<td colspan="5" rowspan="1">
112-
<code>Workers R2 Storage Write</code>
113-
</td>
114-
<td colspan="5" rowspan="1">
115-
Account
116-
</td>
117-
<td colspan="5" rowspan="1">
118-
Admin Read & Write
119-
</td>
120-
</tr>
121-
<tr>
122-
<td colspan="5" rowspan="1">
123-
<code>Workers R2 Storage Read</code>
124-
</td>
125-
<td colspan="5" rowspan="1">
126-
Account
127-
</td>
128-
<td colspan="5" rowspan="1">
129-
Admin Read only
130-
</td>
131-
</tr>
132-
<tr>
133-
<td colspan="5" rowspan="1">
134-
<code>Workers R2 Storage Bucket Item Write</code>
135-
</td>
136-
<td colspan="5" rowspan="1">
137-
Bucket
138-
</td>
139-
<td colspan="5" rowspan="1">
140-
Object Read & Write
141-
</td>
142-
</tr>
143-
<tr>
144-
<td colspan="5" rowspan="1">
145-
<code>Workers R2 Storage Bucket Item Read</code>
146-
</td>
147-
<td colspan="5" rowspan="1">
148-
Bucket
149-
</td>
150-
<td colspan="5" rowspan="1">
151-
Object Read only
152-
</td>
153-
</tr>
154-
</tbody>
96+
<tbody>
97+
<th colspan="5" rowspan="1">
98+
Permission group
99+
</th>
100+
<th colspan="5" rowspan="1">
101+
Resource
102+
</th>
103+
<th colspan="5" rowspan="1">
104+
Permission
105+
</th>
106+
<tr>
107+
<td colspan="5" rowspan="1">
108+
<code>Workers R2 Storage Write</code>
109+
</td>
110+
<td colspan="5" rowspan="1">
111+
Account
112+
</td>
113+
<td colspan="5" rowspan="1">
114+
Admin Read & Write
115+
</td>
116+
</tr>
117+
<tr>
118+
<td colspan="5" rowspan="1">
119+
<code>Workers R2 Storage Read</code>
120+
</td>
121+
<td colspan="5" rowspan="1">
122+
Account
123+
</td>
124+
<td colspan="5" rowspan="1">
125+
Admin Read only
126+
</td>
127+
</tr>
128+
<tr>
129+
<td colspan="5" rowspan="1">
130+
<code>Workers R2 Storage Bucket Item Write</code>
131+
</td>
132+
<td colspan="5" rowspan="1">
133+
Bucket
134+
</td>
135+
<td colspan="5" rowspan="1">
136+
Object Read & Write
137+
</td>
138+
</tr>
139+
<tr>
140+
<td colspan="5" rowspan="1">
141+
<code>Workers R2 Storage Bucket Item Read</code>
142+
</td>
143+
<td colspan="5" rowspan="1">
144+
Bucket
145+
</td>
146+
<td colspan="5" rowspan="1">
147+
Object Read only
148+
</td>
149+
</tr>
150+
</tbody>
155151
</table>
156152

157153
#### Example Access Policy
158154

159155
```json
160156
[
161-
{
162-
"id": "f267e341f3dd4697bd3b9f71dd96247f",
163-
"effect": "allow",
164-
"resources": {
165-
"com.cloudflare.edge.r2.bucket.4793d734c0b8e484dfc37ec392b5fa8a_default_my-bucket": "*",
166-
"com.cloudflare.edge.r2.bucket.4793d734c0b8e484dfc37ec392b5fa8a_eu_my-eu-bucket": "*"
167-
},
168-
"permission_groups": [
169-
{
170-
"id": "6a018a9f2fc74eb6b293b0c548f38b39",
171-
"name": "Workers R2 Storage Bucket Item Read"
172-
}
173-
]
174-
}
157+
{
158+
"id": "f267e341f3dd4697bd3b9f71dd96247f",
159+
"effect": "allow",
160+
"resources": {
161+
"com.cloudflare.edge.r2.bucket.4793d734c0b8e484dfc37ec392b5fa8a_default_my-bucket": "*",
162+
"com.cloudflare.edge.r2.bucket.4793d734c0b8e484dfc37ec392b5fa8a_eu_my-eu-bucket": "*"
163+
},
164+
"permission_groups": [
165+
{
166+
"id": "6a018a9f2fc74eb6b293b0c548f38b39",
167+
"name": "Workers R2 Storage Bucket Item Read"
168+
}
169+
]
170+
}
175171
]
176172
```
177173

178174
### Get S3 API credentials from an API token
179175

180176
You can get the Access Key ID and Secret Access Key values from the response of the [Create Token](/api/resources/user/subresources/tokens/methods/create/) API:
181177

182-
* Access Key ID: The `id` of the API token.
183-
* Secret Access Key: The SHA-256 hash of the API token `value`.
178+
- Access Key ID: The `id` of the API token.
179+
- Secret Access Key: The SHA-256 hash of the API token `value`.
184180

185181
Refer to [Authenticate against R2 API using auth tokens](/r2/examples/authenticate-r2-auth-tokens/) for a tutorial with JavaScript, Python, and Go examples.
186182

@@ -196,8 +192,6 @@ AWS_SESSION_TOKEN = <sessionToken>
196192

197193
:::note
198194

199-
200195
The temporary access key cannot have a permission that is higher than the parent access key. e.g. if the parent key is set to `Object Read Write`, the temporary access key could only have `Object Read Write` or `Object Read Only` permissions.
201196

202-
203197
:::

0 commit comments

Comments
 (0)