Changelog | R2

R2 - 2025-09-23

Tue, 23 Sep 2025 00:00:00 GMT

Fixed a bug where you could attempt to delete objects even if they had a bucket lock rule applied on the dashboard. Previously, they would momentarily vanish from the table but reappear after a page refresh. Now, the delete action is disabled on locked objects in the dashboard.

R2 - 2025-09-22

Mon, 22 Sep 2025 00:00:00 GMT

We’ve updated the R2 dashboard with a cleaner look to make it easier to find what you need and take action. You can find instructions for how you can use R2 with the various API interfaces in the side panel, and easily access documentation at the bottom.

R2 - 2025-07-03

Thu, 03 Jul 2025 00:00:00 GMT

The CRC-64/NVME Checksum algorithm is now supported for both single and multipart objects. This also brings support for the FULL_OBJECT Checksum Type on Multipart Uploads. See Checksum Type Compatibility here.

R2 - 2024-12-03

Tue, 03 Dec 2024 00:00:00 GMT

Server-side Encryption with Customer-Provided Keys is now available to all users via the Workers and S3-compatible APIs.

R2 - 2024-11-21

Thu, 21 Nov 2024 00:00:00 GMT

Sippy can now be enabled on buckets in jurisdictions (e.g., EU, FedRAMP).
Fixed an issue with Sippy where GET/HEAD requests to objects with certain special characters would result in error responses.

R2 - 2024-11-20

Wed, 20 Nov 2024 00:00:00 GMT

Oceania (OC) is now available as an R2 region.
The default maximum number of buckets per account is now 1 million. If you need more than 1 million buckets, contact Cloudflare Support.
Public buckets accessible via custom domain now support Smart Tiered Cache.

R2 - 2024-11-19

Tue, 19 Nov 2024 00:00:00 GMT

R2 bucket lifecycle command added to Wrangler. Supports listing, adding, and removing object lifecycle rules.

R2 - 2024-11-14

Thu, 14 Nov 2024 00:00:00 GMT

R2 bucket info command added to Wrangler. Displays location of bucket and common metrics.

R2 - 2024-11-08

Fri, 08 Nov 2024 00:00:00 GMT

R2 bucket dev-url command added to Wrangler. Supports enabling, disabling, and getting status of bucket's r2.dev public access URL.

R2 - 2024-11-06

Wed, 06 Nov 2024 00:00:00 GMT

R2 bucket domain command added to Wrangler. Supports listing, adding, removing, and updating R2 bucket custom domains.

R2 - 2024-11-01

Fri, 01 Nov 2024 00:00:00 GMT

Add minTLS to response of list custom domains endpoint.

R2 - 2024-10-28

Mon, 28 Oct 2024 00:00:00 GMT

Add get custom domain endpoint.

R2 - 2024-10-21

Mon, 21 Oct 2024 00:00:00 GMT

Event notifications can now be configured for R2 buckets in jurisdictions (e.g., EU, FedRAMP).

R2 - 2024-09-26

Thu, 26 Sep 2024 00:00:00 GMT

Event notifications for R2 is now generally available. Event notifications now support higher throughput (up to 5,000 messages per second per Queue), can be configured in the dashboard and Wrangler, and support for lifecycle deletes.

R2 - 2024-09-18

Wed, 18 Sep 2024 00:00:00 GMT

Add the ability to set and update minimum TLS version for R2 bucket custom domains.

R2 - 2024-08-26

Mon, 26 Aug 2024 00:00:00 GMT

Added support for configuring R2 bucket custom domains via API.

R2 - 2024-08-21

Wed, 21 Aug 2024 00:00:00 GMT

Sippy is now generally available. Metrics for ongoing migrations can now be found in the dashboard or via the GraphQL analytics API.

R2 - 2024-07-08

Mon, 08 Jul 2024 00:00:00 GMT

Added migration log for Super Slurper to the migration summary in the dashboard.

R2 - 2024-06-12

Wed, 12 Jun 2024 00:00:00 GMT

Super Slurper now supports migrating objects up to 1TB in size.

R2 - 2024-06-07

Fri, 07 Jun 2024 00:00:00 GMT

Fixed an issue that prevented Sippy from copying over objects from S3 buckets with SSE set up.

R2 - 2024-06-06

Thu, 06 Jun 2024 00:00:00 GMT

R2 will now ignore the x-purpose request parameter.

R2 - 2024-05-29

Wed, 29 May 2024 00:00:00 GMT

Added support for Infrequent Access storage class (beta).

R2 - 2024-05-24

Fri, 24 May 2024 00:00:00 GMT

Added create temporary access tokens endpoint.

R2 - 2024-04-03

Wed, 03 Apr 2024 00:00:00 GMT

Event notifications for R2 is now available as an open beta.
Super Slurper now supports migration from Google Cloud Storage.

R2 - 2024-02-20

Tue, 20 Feb 2024 00:00:00 GMT

When an OPTIONS request against the public entrypoint does not include an origin header, an HTTP 400 instead of an HTTP 401 is returned.

R2 - 2024-02-06

Tue, 06 Feb 2024 00:00:00 GMT

The response shape of GET /buckets/:bucket/sippy has changed.
The /buckets/:bucket/sippy/validate endpoint is exposed over APIGW to validate Sippy's configuration.
The shape of the configuration object when modifying Sippy's configuration has changed.

R2 - 2024-02-02

Fri, 02 Feb 2024 00:00:00 GMT

Updated GetBucket endpoint: Now fetches by bucket_name instead of bucket_id.

R2 - 2024-01-30

Tue, 30 Jan 2024 00:00:00 GMT

Fixed a bug where the API would accept empty strings in the AllowedHeaders property of PutBucketCors actions.

R2 - 2024-01-26

Fri, 26 Jan 2024 00:00:00 GMT

Parts are now automatically sorted in ascending order regardless of input during CompleteMultipartUpload.

R2 - 2024-01-11

Thu, 11 Jan 2024 00:00:00 GMT

Sippy is available for Google Cloud Storage (GCS) beta.

R2 - 2023-12-11

Mon, 11 Dec 2023 00:00:00 GMT

The x-id query param for S3 ListBuckets action is now ignored.
The x-id query param is now ignored for all S3 actions.

R2 - 2023-10-23

Mon, 23 Oct 2023 00:00:00 GMT

PutBucketCors now only accepts valid origins.

R2 - 2023-09-01

Fri, 01 Sep 2023 00:00:00 GMT

Fixed an issue with ListBuckets where the name_contains parameter would also search over the jurisdiction name.

R2 - 2023-08-23

Wed, 23 Aug 2023 00:00:00 GMT

Config Audit Logs GA.

R2 - 2023-08-11

Fri, 11 Aug 2023 00:00:00 GMT

Users can now complete conditional multipart publish operations. When a condition failure occurs when publishing an upload, the upload is no longer available and is treated as aborted.

R2 - 2023-07-05

Wed, 05 Jul 2023 00:00:00 GMT

Improved performance for ranged reads on very large files. Previously ranged reads near the end of very large files would be noticeably slower than ranged reads on smaller files. Performance should now be consistently good independent of filesize.

R2 - 2023-06-21

Wed, 21 Jun 2023 00:00:00 GMT

Multipart ETags are now MD5 hashes.

R2 - 2023-06-16

Fri, 16 Jun 2023 00:00:00 GMT

Fixed a bug where calling GetBucket on a non-existent bucket would return a 500 instead of a 404.
Improved S3 compatibility for ListObjectsV1, now nextmarker is only set when truncated is true.
The R2 worker bindings now support parsing conditional headers with multiple etags. These etags can now be strong, weak or a wildcard. Previously the bindings only accepted headers containing a single strong etag.
S3 putObject now supports sha256 and sha1 checksums. These were already supported by the R2 worker bindings.
CopyObject in the S3 compatible api now supports Cloudflare specific headers which allow the copy operation to be conditional on the state of the destination object.

R2 - 2023-04-01

Sat, 01 Apr 2023 00:00:00 GMT

GetBucket is now available for use through the Cloudflare API.
Location hints can now be set when creating a bucket, both through the S3 API, and the dashboard.

R2 - 2023-03-16

Thu, 16 Mar 2023 00:00:00 GMT

The ListParts API has been implemented and is available for use.
HTTP2 is now enabled by default for new custom domains linked to R2 buckets.
Object Lifecycles are now available for use.
Bug fix: Requests to public buckets will now return the Content-Encoding header for gzip files when Accept-Encoding: gzip is used.

R2 - 2023-01-27

Fri, 27 Jan 2023 00:00:00 GMT

R2 authentication tokens created via the R2 token page are now scoped to a single account by default.

R2 - 2022-12-07

Wed, 07 Dec 2022 00:00:00 GMT

Fix CORS preflight requests for the S3 API, which allows using the S3 SDK in the browser.
Passing a range header to the get operation in the R2 bindings API should now work as expected.

R2 - 2022-11-30

Wed, 30 Nov 2022 00:00:00 GMT

Requests with the header x-amz-acl: public-read are no longer rejected.
Fixed issues with wildcard CORS rules and presigned URLs.
Fixed an issue where ListObjects would time out during delimited listing of unicode-normalized keys.
S3 API's PutBucketCors now rejects requests with unknown keys in the XML body.
Signing additional headers no longer breaks CORS preflight requests for presigned URLs.

R2 - 2022-11-21

Mon, 21 Nov 2022 00:00:00 GMT

Fixed a bug in ListObjects where startAfter would skip over objects with keys that have numbers right after the startAfter prefix.
Add worker bindings for multipart uploads.

R2 - 2022-11-17

Thu, 17 Nov 2022 00:00:00 GMT

Unconditionally return HTTP 206 on ranged requests to match behavior of other S3 compatible implementations.
Fixed a CORS bug where AllowedHeaders in the CORS config were being treated case-sensitively.

R2 - 2022-11-08

Tue, 08 Nov 2022 00:00:00 GMT

Copying multipart objects via CopyObject is re-enabled.
UploadPartCopy is re-enabled.

R2 - 2022-10-28

Fri, 28 Oct 2022 00:00:00 GMT

Multipart upload part sizes are always expected to be of the same size, but this enforcement is now done when you complete an upload instead of being done very time you upload a part.
Fixed a performance issue where concurrent multipart part uploads would get rejected.

R2 - 2022-10-26

Wed, 26 Oct 2022 00:00:00 GMT

Fixed ranged reads for multipart objects with part sizes unaligned to 64KiB.

R2 - 2022-10-19

Wed, 19 Oct 2022 00:00:00 GMT

HeadBucket now sets x-amz-bucket-region to auto in the response.

R2 - 2022-10-06

Thu, 06 Oct 2022 00:00:00 GMT

Temporarily disabled UploadPartCopy while we investigate an issue.

R2 - 2022-09-29

Thu, 29 Sep 2022 00:00:00 GMT

Fixed a CORS issue where Access-Control-Allow-Headers was not being set for preflight requests.

R2 - 2022-09-28

Wed, 28 Sep 2022 00:00:00 GMT

Fixed a bug where CORS configuration was not being applied to S3 endpoint.
No-longer render the Access-Control-Expose-Headers response header if ExposeHeader is not defined.
Public buckets will no-longer return the Content-Range response header unless the response is partial.
Fixed CORS rendering for the S3 HeadObject operation.
Fixed a bug where no matching CORS configuration could result in a 403 response.
Temporarily disable copying objects that were created with multipart uploads.
Fixed a bug in the Workers bindings where an internal error was being returned for malformed ranged .get requests.

R2 - 2022-09-27

Tue, 27 Sep 2022 00:00:00 GMT

CORS preflight responses and adding CORS headers for other responses is now implemented for S3 and public buckets. Currently, the only way to configure CORS is via the S3 API.
Fixup for bindings list truncation to work more correctly when listing keys with custom metadata that have " or when some keys/values contain certain multi-byte UTF-8 values.
The S3 GetObject operation now only returns Content-Range in response to a ranged request.

R2 - 2022-09-19

Mon, 19 Sep 2022 00:00:00 GMT

The R2 put() binding options can now be given an onlyIf field, similar to get(), that performs a conditional upload.
The R2 delete() binding now supports deleting multiple keys at once.
The R2 put() binding now supports user-specified SHA-1, SHA-256, SHA-384, SHA-512 checksums in options.
User-specified object checksums will now be available in the R2 get() and head() bindings response. MD5 is included by default for non-multipart uploaded objects.

R2 - 2022-09-06

Tue, 06 Sep 2022 00:00:00 GMT

The S3 CopyObject operation now includes x-amz-version-id and x-amz-copy-source-version-id in the response headers for consistency with other methods.
The ETag for multipart files uploaded until shortly after Open Beta uploaded now include the number of parts as a suffix.

R2 - 2022-08-17

Wed, 17 Aug 2022 00:00:00 GMT

The S3 DeleteObjects operation no longer trims the space from around the keys before deleting. This would result in files with leading / trailing spaces not being able to be deleted. Additionally, if there was an object with the trimmed key that existed it would be deleted instead. The S3 DeleteObject operation was not affected by this.
Fixed presigned URL support for the S3 ListBuckets and ListObjects operations.

R2 - 2022-08-06

Sat, 06 Aug 2022 00:00:00 GMT

Uploads will automatically infer the Content-Type based on file body if one is not explicitly set in the PutObject request. This functionality will come to multipart operations in the future.

R2 - 2022-07-30

Sat, 30 Jul 2022 00:00:00 GMT

Fixed S3 conditionals to work properly when provided the LastModified date of the last upload, bindings fixes will come in the next release.
If-Match / If-None-Match headers now support arrays of ETags, Weak ETags and wildcard (*) as per the HTTP standard and undocumented AWS S3 behavior.

R2 - 2022-07-21

Thu, 21 Jul 2022 00:00:00 GMT

Added dummy implementation of the following operation that mimics the response that a basic AWS S3 bucket will return when first created: GetBucketAcl.

R2 - 2022-07-20

Wed, 20 Jul 2022 00:00:00 GMT

Added dummy implementations of the following operations that mimic the response that a basic AWS S3 bucket will return when first created:
- GetBucketVersioning
- GetBucketLifecycleConfiguration
- GetBucketReplication
- GetBucketTagging
- GetObjectLockConfiguration

R2 - 2022-07-19

Tue, 19 Jul 2022 00:00:00 GMT

Fixed an S3 compatibility issue for error responses with MinIO .NET SDK and any other tooling that expects no xmlns namespace attribute on the top-level Error tag.
List continuation tokens prior to 2022-07-01 are no longer accepted and must be obtained again through a new list operation.
The list() binding will now correctly return a smaller limit if too much data would otherwise be returned (previously would return an Internal Error).

R2 - 2022-07-14

Thu, 14 Jul 2022 00:00:00 GMT

Improvements to 500s: we now convert errors, so things that were previously concurrency problems for some operations should now be TooMuchConcurrency instead of InternalError. We've also reduced the rate of 500s through internal improvements.
ListMultipartUpload correctly encodes the returned Key if the encoding-type is specified.

R2 - 2022-07-13

Wed, 13 Jul 2022 00:00:00 GMT

S3 XML documents sent to R2 that have an XML declaration are not rejected with 400 Bad Request / MalformedXML.
Minor S3 XML compatibility fix impacting Arq Backup on Windows only (not the Mac version). Response now contains XML declaration tag prefix and the xmlns attribute is present on all top-level tags in the response.
Beta ListMultipartUploads support.

R2 - 2022-07-06

Wed, 06 Jul 2022 00:00:00 GMT

Support the r2_list_honor_include compat flag coming up in an upcoming runtime release (default behavior as of 2022-07-14 compat date). Without that compat flag/date, list will continue to function implicitly as include: ['httpMetadata', 'customMetadata'] regardless of what you specify.
cf-create-bucket-if-missing can be set on a PutObject/CreateMultipartUpload request to implicitly create the bucket if it does not exist.
Fix S3 compatibility with MinIO client spec non-compliant XML for publishing multipart uploads. Any leading and trailing quotes in CompleteMultipartUpload are now optional and ignored as it seems to be the actual non-standard behavior AWS implements.

R2 - 2022-07-01

Fri, 01 Jul 2022 00:00:00 GMT

Unsupported search parameters to ListObjects/ListObjectsV2 are now rejected with 501 Not Implemented.
Fixes for Listing:
- Fix listing behavior when the number of files within a folder exceeds the limit (you'd end up seeing a CommonPrefix for that large folder N times where N = number of children within the CommonPrefix / limit).
- Fix corner case where listing could cause objects with sharing the base name of a "folder" to be skipped.
- Fix listing over some files that shared a certain common prefix.
DeleteObjects can now handle 1000 objects at a time.
S3 CreateBucket request can specify x-amz-bucket-object-lock-enabled with a value of false and not have the requested rejected with a NotImplemented error. A value of true will continue to be rejected as R2 does not yet support object locks.

R2 - 2022-06-17

Fri, 17 Jun 2022 00:00:00 GMT

Fixed a regression for some clients when using an empty delimiter.
Added support for S3 pre-signed URLs.

R2 - 2022-06-16

Thu, 16 Jun 2022 00:00:00 GMT

Fixed a regression in the S3 API UploadPart operation where TooMuchConcurrency & NoSuchUpload errors were being returned as NoSuchBucket.

R2 - 2022-06-13

Mon, 13 Jun 2022 00:00:00 GMT

Fixed a bug with the S3 API ListObjectsV2 operation not returning empty folder/s as common prefixes when using delimiters.
The S3 API ListObjectsV2 KeyCount parameter now correctly returns the sum of keys and common prefixes rather than just the keys.
Invalid cursors for list operations no longer fail with an InternalError and now return the appropriate error message.

R2 - 2022-06-10

Fri, 10 Jun 2022 00:00:00 GMT

The ContinuationToken field is now correctly returned in the response if provided in a S3 API ListObjectsV2 request.
Fixed a bug where the S3 API AbortMultipartUpload operation threw an error when called multiple times.

R2 - 2022-05-27

Fri, 27 May 2022 00:00:00 GMT

Fixed a bug where the S3 API's PutObject or the .put() binding could fail but still show the bucket upload as successful.
If conditional headers are provided to S3 API UploadObject or CreateMultipartUpload operations, and the object exists, a 412 Precondition Failed status code will be returned if these checks are not met.

R2 - 2022-05-20

Fri, 20 May 2022 00:00:00 GMT

Fixed a bug when Accept-Encoding was being used in SignedHeaders when sending requests to the S3 API would result in a SignatureDoesNotMatch response.

R2 - 2022-05-17

Tue, 17 May 2022 00:00:00 GMT

Fixed a bug where requests to the S3 API were not handling non-encoded parameters used for the authorization signature.
Fixed a bug where requests to the S3 API where number-like keys were being parsed as numbers instead of strings.

R2 - 2022-05-16

Mon, 16 May 2022 00:00:00 GMT

Add support for S3 virtual-hosted style paths, such as <BUCKET>.<ACCOUNT_ID>.r2.cloudflarestorage.com instead of path-based routing (<ACCOUNT_ID>.r2.cloudflarestorage.com/<BUCKET>).
Implemented GetBucketLocation for compatibility with external tools, this will always return a LocationConstraint of auto.

R2 - 2022-05-06

Fri, 06 May 2022 00:00:00 GMT

S3 API GetObject ranges are now inclusive (bytes=0-0 will correctly return the first byte).
S3 API GetObject partial reads return the proper 206 Partial Content response code.
Copying from a non-existent key (or from a non-existent bucket) to another bucket now returns the proper NoSuchKey / NoSuchBucket response.
The S3 API now returns the proper Content-Type: application/xml response header on relevant endpoints.
Multipart uploads now have a -N suffix on the etag representing the number of parts the file was published with.
UploadPart and UploadPartCopy now return proper error messages, such as TooMuchConcurrency or NoSuchUpload, instead of 'internal error'.
UploadPart can now be sent a 0-length part.

R2 - 2022-05-05

Thu, 05 May 2022 00:00:00 GMT

When using the S3 API, an empty string and us-east-1 will now alias to the auto region for compatibility with external tools.
GetBucketEncryption, PutBucketEncryption and DeleteBucketEncrypotion are now supported (the only supported value currently is AES256).
Unsupported operations are explicitly rejected as unimplemented rather than implicitly converting them into ListObjectsV2/PutBucket/DeleteBucket respectively.
S3 API CompleteMultipartUploads requests are now properly escaped.

R2 - 2022-05-03

Tue, 03 May 2022 00:00:00 GMT

Pagination cursors are no longer returned when the keys in a bucket is the same as the MaxKeys argument.
The S3 API ListBuckets operation now accepts cf-max-keys, cf-start-after and cf-continuation-token headers behave the same as the respective URL parameters.
The S3 API ListBuckets and ListObjects endpoints now allow per_page to be 0.
The S3 API CopyObject source parameter now requires a leading slash.
The S3 API CopyObject operation now returns a NoSuchBucket error when copying to a non-existent bucket instead of an internal error.
Enforce the requirement for auto in SigV4 signing and the CreateBucket LocationConstraint parameter.
The S3 API CreateBucket operation now returns the proper location response header.

R2 - 2022-04-14

Thu, 14 Apr 2022 00:00:00 GMT

The S3 API now supports unchunked signed payloads.
Fixed .put() for the Workers R2 bindings.
Fixed a regression where key names were not properly decoded when using the S3 API.
Fixed a bug where deleting an object and then another object which is a prefix of the first could result in errors.
The S3 API DeleteObjects operation no longer returns an error even though an object has been deleted in some cases.
Fixed a bug where startAfter and continuationToken were not working in list operations.
The S3 API ListObjects operation now correctly renders Prefix, Delimiter, StartAfter and MaxKeys in the response.
The S3 API ListObjectsV2 now correctly honors the encoding-type parameter.
The S3 API PutObject operation now works with POST requests for s3cmd compatibility.

R2 - 2022-04-04

Mon, 04 Apr 2022 00:00:00 GMT

The S3 API DeleteObjects request now properly returns a MalformedXML error instead of InternalError when provided with more than 128 keys.