Cloudflare R2

Connect Cloudflare R2 to store and reuse Drip Drop attachments and images in an R2 bucket you manage. This guide explains the required credentials, connection settings, and verification steps.

  • You already use Cloudflare and want Drip Drop’s attachments and images in a bucket on the same account.
  • You want S3-compatible storage without per-region endpoints. R2 derives its endpoint from your Account ID.
  • Confirm you have a Cloudflare R2 bucket.
  • Have an R2 Access Key ID and Secret Access Key for the account that owns the bucket.
  • Have your Cloudflare Account ID. It is the first part of your R2 endpoint, shown on the R2 page of your Cloudflare dashboard.
  • Confirm the key pair allows the bucket operations Drip Drop needs: upload, read, delete, and list.
  • Confirm your role can create integrations. Without that permission, New Integration is not shown.
  • Optionally decide on a Key Prefix to keep Drip Drop’s attachments and images under a dedicated path.
  1. Open Integrations → Storage.
  2. Select New Integration.
  3. On Choose, select Cloudflare R2.
Choose Cloudflare R2 in the integration wizard.
  1. Review or change the Name.
  2. Enter the Access Key ID and Secret Access Key.
  3. Enter the Bucket Name.
  4. Enter your Cloudflare Account ID.
  5. Optionally enter a Key Prefix to keep Drip Drop attachments and images under a dedicated path.
  6. Select Save & Continue. This saves the integration in Drip Drop but does not validate the bucket.
Enter the Cloudflare R2 connection settings, then select Save & Continue. The EXAMPLE_INVALID_BUCKET bucket and the account ID beginning docsreviewonly are deliberately nonfunctional. The docs-example-only value is an illustrative key prefix.

Drip Drop derives the R2 endpoint from your Account ID at https://<account-id>.r2.cloudflarestorage.com and signs with the fixed region auto, so the form does not ask for a Region, Endpoint URL, Addressing Style, or Encryption setting.

The Account ID supplies the R2 endpoint, so it must belong to the account that owns the bucket. Drip Drop reads and writes only beneath the configured Key Prefix, and uploaded files are stored there under automatically generated keys. Changing the prefix later does not move existing objects; it changes the boundary that Drip Drop can browse and attach from.

  1. On Verify, select Check credentials.
  2. After the check passes, select Done.
  3. Confirm that Cloudflare R2 appears as Active on the Storage page.
  4. Open a message template, find Attachments, then select Browse files → Connected storage.
  5. Choose the integration you named, select an object beneath the configured Key Prefix, then select Attach.

When Drip Drop validates the connection, it confirms bucket access by creating, reading, and deleting a temporary object beneath the configured Key Prefix. A successful result means the credentials can reach the bucket and perform the operations Drip Drop needs.

Use the r2.dev URL from the bucket’s Settings tab, or a connected custom domain, as the Public Base URL. Do not use the S3 API endpoint. R2 buckets are private until you enable public access.

Images embedded in emails must remain publicly readable without signing in. Keep public access limited to a folder that is separate from the private attachment prefix.

  1. Open the saved integration and expand Serve email images from this bucket.
  2. Enter the Public Base URL and a separate Public Folder.
  3. Configure your storage service to allow anonymous read access to the Public Folder.
  4. Select Verify public access.
  5. After Publicly readable appears, enable Available as a public media location.
  6. Return to Storage. Under Email image location, choose the verified bucket.

If connection or public-media settings change, verification becomes stale. Select Verify public access again before using the bucket.

Changing Email image location affects only newly published images. Existing published images stay at their original location.

Invalid account or endpoint
  • Confirm the Account ID belongs to the Cloudflare account that owns the bucket.
  • Drip Drop derives the endpoint from it and signs with the region auto; a custom region or endpoint is not used for this connection.
Access denied
  • Recheck the Access Key ID, Secret Access Key, Account ID, and Bucket Name.
  • Confirm the R2 API token still exists and has not been rolled in the Cloudflare dashboard.
  • Confirm the token allows upload, read, delete, and list on the bucket; validation writes and deletes a temporary object, so read-only access fails.
A file is not visible under the Key Prefix
  • Confirm the object is beneath the configured Key Prefix. Drip Drop cannot browse or attach anything outside it.
  • Changing the prefix does not move existing objects; files stored under an earlier prefix stop appearing.
Uploads succeed but attachments fail to send
  • Confirm the bucket still exists and the token has not been scoped away from it since the integration was saved.
  • Storage: choose and manage storage for Drip Drop attachments and images.
  • Message Templates: add stored files as attachments or use them as images in email designs.