Your first FTP/SFTP to Cloudflare R2 service

This guide walks you through creating a Simple FTP Service (SFS) backed by Cloudflare R2. When you are done you will have an FTP/FTPS/SFTP hostname and a user account whose uploads and downloads go straight to an R2 bucket in your own Cloudflare account. DocEvent connects through R2's S3-compatible API, so you need three things from Cloudflare: the bucket, your account's S3 endpoint, and an R2 API token.

Before you start - in Cloudflare

1. Pick or create an R2 bucket and note its name.

2. Create an R2 API token. On the R2 object storage overview page, select Manage next to API Tokens under Account Details, then Create Account API token:

   • Permissions: Object Read & Write
   • Buckets: limit the token to just this bucket, rather than all buckets in the account

3. Copy three values before you leave the confirmation page. Cloudflare shows an Access Key ID and a Secret Access Key - the secret is shown only once - and, at the bottom of the page, your account's S3 endpoint:

   https://<account-id>.r2.cloudflarestorage.com
   

   The endpoint is also on the R2 Overview page if you need it later. If the bucket was created under the EU jurisdiction, use the EU endpoint instead:

   https://<account-id>.eu.r2.cloudflarestorage.com
   

An account API token is the better choice for a service: it stays valid until it is revoked or reaches its expiry date, while a user API token stops working if the person who created it is removed from your Cloudflare account. Limiting it to one bucket means DocEvent can reach nothing else in the account. See Cloudflare's R2 API tokens.

Step 1 - Create a new service

Sign in to the DocEvent console, open Simple FTP Service in the top menu and click Create new. Choose S3 Compatible Storage as the backend.

Step 2 - Provide access to your bucket

Fill in the S3 Compatible Credentials with the values from Cloudflare:

Type auto into Bucket region rather than leaving it empty. R2's region is always auto; Cloudflare also accepts an empty value or us-east-1 as auto, but an empty DocEvent field is not sent empty - DocEvent signs its requests for its own hosting region instead, and R2 refuses AWS region names such as eu-west-1.

Leave Use path style URLs unticked; R2 works with the default.

Click Verify Access. DocEvent round-trips a small test file to prove the token really can read and write the bucket before anything is saved.

Step 3 - Name the service and add the first user

Give the service a name, then set up its first user - you can add more later.

1. Service name - how the service appears in your console
2. Username - the first FTP/SFTP user. It gets the service ID as a prefix once created, e.g. abcd1234/ftpuser
3. Password - the user's password
4. Home directory - where this user lands inside the bucket. / is the bucket root; a path like /acme confines them to that folder. See Home directories and keeping each user isolated

Click Create Service.

Step 4 - Done: your login details

The final screen has everything you need to connect: the username with its service-ID prefix, the FTP/FTPS and SFTP hostnames, ready-to-paste command-line examples, and the SSH host keys for verifying the SFTP server - see SSH host keys for SFTP and SCP.

Every file uploaded over FTP, FTPS or SFTP lands in your R2 bucket, and every file already in the bucket is available to download. You can also browse it from a browser with SFS Drive.

Worth knowing on R2

• No egress charge from Cloudflare. Partner downloads cost nothing per gigabyte on the Cloudflare side. Your DocEvent plan's data allowance still applies.
• No file restore. DocEvent's file restore brings back earlier versions kept by your bucket, and R2 does not support bucket versioning. On an R2 backend, a deleted or overwritten file cannot be restored from DocEvent.
• Uploads can trigger your own code. Files arrive as ordinary R2 objects, so R2 event notifications fire on each upload and a Worker can pick them up. More on that, and on R2 pricing, in SFTP for Cloudflare R2.

If Verify Access fails

• "Please enter a valid HTTP URL" - the endpoint needs https:// in front.
• InvalidRegionName - R2 refuses AWS region names such as eu-west-1. Set Bucket region to auto.
• A signature or authorization error - check that the endpoint holds your account ID, and that an EU-jurisdiction bucket uses the .eu. endpoint.
• An error about the bucket - the endpoint ends at cloudflarestorage.com. Put the bucket name in Bucket, not on the end of the endpoint.
• Access denied writing the test file - the token may be Object Read only, or scoped to a different bucket. Create an Object Read & Write token for this bucket.

Other storage providers

The S3 Compatible Storage tile also covers Backblaze B2, Wasabi, MinIO, Hetzner Object Storage and Supabase - see Your first FTP/SFTP to Backblaze B2 service and Your first FTP/SFTP to Wasabi service. For Amazon S3 itself, follow Your first FTP/SFTP to Amazon S3 service.