strapi-plugin-cloudflare-r2-assets

Strapi 5 upload provider and plugin that stores media assets in Cloudflare R2. Drop it into any Strapi 5 project for S3-compatible object storage backed by Cloudflare R2. Strapi handles all image variants natively.

Features

• Upload provider for Strapi's Upload plugin backed by Cloudflare R2
• Built-in admin diagnostics page (provider status, effective config, bucket connectivity)
• Secrets stay in environment variables only — never persisted in the database

Requirements

• Node.js 20, 22, or 24 (Node 21 is not supported)
• Strapi 5.37.1 or newer
• Cloudflare R2 bucket

Installation

npm install strapi-plugin-cloudflare-r2-assets

Cloudflare setup

1. Create an R2 bucket.
2. Create an R2 API token with least privilege for the bucket.
3. Configure a public domain (proxied through Cloudflare) that points to your bucket assets.

Environment variables

Required:

Optional:

Strapi configuration

Create or update config/plugins.ts:

export default () => ({
  // Upload provider — stores files in R2 and serves Cloudflare edge URLs
  upload: {
    config: {
      provider: 'strapi-plugin-cloudflare-r2-assets',
      providerOptions: {},
    },
  },
  // Admin diagnostics page (Settings > Cloudflare R2 Assets)
  'cloudflare-r2-assets': {
    enabled: true,
  },
});

All settings are resolved from environment variables by default. You can optionally override defaults in providerOptions:

providerOptions: {
  basePath: 'uploads',       // default: 'uploads'
},

Set CF_R2_ENV_PREFIX to resolve prefixed values. For example, with CF_R2_ENV_PREFIX=CMS_, the plugin resolves CMS_CF_R2_ACCOUNT_ID, CMS_CF_R2_BUCKET, etc., and then falls back to unprefixed keys when needed.

Admin diagnostics page

After installation, navigate to Settings > Cloudflare R2 Assets in the Strapi admin panel.

The page is read-only and shows:

• Upload provider activation status
• Effective (non-secret) configuration
• R2 bucket connectivity check

Access requires the plugin read permission: plugin::cloudflare-r2-assets.read

Security

• API keys are read only from environment variables — no credential persistence
• Config validation fails fast on missing or invalid values
• CF_PUBLIC_BASE_URL and CF_R2_ENDPOINT must be valid http(s) URLs
• Admin diagnostics redact account identity and never expose secrets
• Diagnostics route is gated by explicit plugin read permission

Contributing

Contributions are welcome! See AGENTS.md for development setup, commands, release workflow, and contribution guidelines.

License

MIT