Back to Storage Desk

Connect Cloudflare R2 to your Storage Desk

The Storage Desk can sync your encrypted library to a storage bucket you own. Cloudflare R2 is a great choice: a generous free tier and no egress fees. Everything below runs between your browser and your bucket — SafePaper is never in the path.

Bring your own Cloudflare R2 bucket to sync your encrypted library across devices. R2 has a generous free tier and no egress fees. SafePaper never sees your files or keys — requests are signed in your browser and go straight to your bucket.

  1. 1

    Create a Cloudflare account & enable R2

    Sign in at dash.cloudflare.com, open R2, and add a payment method. R2's free tier includes 10 GB storage and generous Class A/B operations — plenty for a personal library, with no egress fees.

  2. 2

    Create a bucket

    In R2 → Create bucket. Pick any name (e.g. safepaper-storage) and a location. You'll use this name as the Bucket below.

  3. 3

    Create an API token (scoped to the bucket)

    R2 → Manage R2 API Tokens → Create API token. Choose 'Object Read & Write', scope it to just this one bucket, and create it. Copy the Access Key ID and Secret Access Key — the secret is shown only once.

  4. 4

    Find your S3 endpoint

    On the API token page (or bucket settings) Cloudflare shows an S3 API endpoint like https://<accountid>.r2.cloudflarestorage.com. Use that as the Endpoint; keep Region as 'auto'.

  5. 5

    Add the CORS policy

    Because SafePaper talks to R2 directly from your browser, the bucket must allow this site's origin. Open your bucket → Settings → CORS policy → Add, and paste the policy below.

  6. 6

    Connect & test

    Enter the endpoint, bucket, and keys in the form, then press Test connection. On success, save it — your library will sync as encrypted objects to your own bucket.

  7. 7

    Open it on another device

    On your other device, add the same bucket and choose 'Restore from your S3/R2 bucket', then enter the SAME passphrase. SafePaper reads the bucket's encrypted vault key so the same passphrase unlocks your synced library — no export/import needed.

CORS policy for your bucket
[
  {
    "AllowedOrigins": ["https://safepaper.app"],
    "AllowedMethods": ["GET", "PUT", "DELETE", "HEAD"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

Keeping your keys safe

  • Because SafePaper signs requests in your browser, your keys live on this device. Use an API token scoped to this single bucket — never your account-wide keys.
  • Keys are stored encrypted with your passphraseand only unlocked in memory — they're never sent to SafePaper. On a shared or public device, uncheck “Save these keys on this device”so they're kept for that session only.
  • If a device is lost or a key leaks, revoke the token in Cloudflare (R2 → Manage R2 API Tokens) and create a new one — your encrypted files stay unreadable without your passphrase anyway.
Cloudflare R2 S3 API docs

Analytics preferences

You have not chosen yet — use the bar at the bottom of the screen, or choose below.

Optional analytics uses Vercel Web Analytics and Speed Insights for aggregated page and performance data only. We do not attach your PDFs or their contents to these tools.

Read the Privacy Policy section