Setting up a Cloudflare R2 bucket for Shareboxed

Shareboxed uploads straight into an R2 bucket you own. Files keep their own names and stay visible in your dashboard. R2 is addressed per account instead of per region, so the connection asks for an account id rather than an endpoint.

1. Create the bucket

npx wrangler r2 bucket create my-uploads

Or in the dashboard: R2 → Create bucket. Leave public access off (the default).

2. Create an API token

R2 → API → Manage API tokens → Create API Token, permission Object Read & Write, scoped to the bucket you just made. The Access Key ID and Secret Access Key are shown once.

Paste them into the connection in Shareboxed:

Field	Value
Account ID	R2 → Overview, in the Account details panel
Bucket name	`my-uploads`
Credentials	the token's Access Key ID and Secret Access Key
Folder	optional, a prefix inside the bucket

Pasting the token's whole S3 endpoint into the Account ID field works too; the app takes the account id out of it.

3. Optional: abort incomplete uploads

Your bucket → Settings → Object lifecycle rules → Add rule, enable Abort incomplete multipart uploads after 1 day.

4. Optional: delete uploads after 7 days

A second lifecycle rule: Delete objects after 7 days, scoped to the prefix you gave Shareboxed under Folder.

Turning on Shareboxed download links

Off by default. With the switch on (connection settings → Sharing), finishing an upload also copies a shareboxed.app link anyone can download from. A link lives seven days, like every Shareboxed share; switching the setting off deletes the stored key and ends every live link from this connection at once.

The bucket needs two things for those links to work.

1. The token must be allowed to read back what it wrote. Object Read & Write covers it. A write-only token signs uploads fine and fails every download.

2. Allow the download page to read the bytes (CORS). Your bucket → Settings → CORS policy → Edit:

[
    {
        "AllowedOrigins": ["https://shareboxed.app"],
        "AllowedMethods": ["GET", "HEAD"],
        "AllowedHeaders": ["*"],
        "MaxAgeSeconds": 3600
    }
]

When something does not work

Press Test Connection first. What it can say:

Test Connection says	Fix
Missing credentials	The Credentials fields are empty or were not saved. Enter the key and secret again.
Invalid credentials	The secret is wrong, the token was deleted, or the Account ID is not this token's account.
Insufficient permissions	The token is scoped to a different bucket.
Bucket not found	Typo in the bucket name. R2 bucket names are case-sensitive.
Not reachable	The Account ID is malformed, or nothing answered. Copy it from R2 → Overview.
Missing CORS rule	Download links are on but the bucket has no CORS rule for `https://shareboxed.app`.
Server errored	Cloudflare itself failed. Try again, and check the Cloudflare status page.

One more that only shows up later:

A recipient sees "Connection refused, please ask the sender to check on the permissions": the CORS rule is missing, or the token was created write-only and cannot read back what it wrote. Object Read & Write fixes both halves.

Using S3 elsewhere as well? The S3 guide covers AWS, Backblaze B2 and MinIO, and R2 through the same S3 connection type.