The Storage Desk can sync your encrypted library to a storage bucket you own. Cloudflare R2 is a great choice: a generous free tier and no egress fees. Everything below runs between your browser and your bucket — SafePaper is never in the path.
Bring your own Cloudflare R2 bucket to sync your encrypted library across devices. R2 has a generous free tier and no egress fees. SafePaper never sees your files or keys — requests are signed in your browser and go straight to your bucket.
Create a Cloudflare account & enable R2
Sign in at dash.cloudflare.com, open R2, and add a payment method. R2's free tier includes 10 GB storage and generous Class A/B operations — plenty for a personal library, with no egress fees.
Create a bucket
In R2 → Create bucket. Pick any name (e.g. safepaper-storage) and a location. You'll use this name as the Bucket below.
Create an API token (scoped to the bucket)
R2 → Manage R2 API Tokens → Create API token. Choose 'Object Read & Write', scope it to just this one bucket, and create it. Copy the Access Key ID and Secret Access Key — the secret is shown only once.
Find your S3 endpoint
On the API token page (or bucket settings) Cloudflare shows an S3 API endpoint like https://<accountid>.r2.cloudflarestorage.com. Use that as the Endpoint; keep Region as 'auto'.
Add the CORS policy
Because SafePaper talks to R2 directly from your browser, the bucket must allow this site's origin. Open your bucket → Settings → CORS policy → Add, and paste the policy below.
Connect & test
Enter the endpoint, bucket, and keys in the form, then press Test connection. On success, save it — your library will sync as encrypted objects to your own bucket.
Open it on another device
On your other device, add the same bucket and choose 'Restore from your S3/R2 bucket', then enter the SAME passphrase. SafePaper reads the bucket's encrypted vault key so the same passphrase unlocks your synced library — no export/import needed.
[
{
"AllowedOrigins": ["https://safepaper.app"],
"AllowedMethods": ["GET", "PUT", "DELETE", "HEAD"],
"AllowedHeaders": ["*"],
"ExposeHeaders": ["ETag"],
"MaxAgeSeconds": 3600
}
]Keeping your keys safe