Expose an R2 bucket's contents publicly, choosing between the Cloudflare-managed r2.dev development URL and a custom domain for production.

Documented steps

1. Decide which access mode you need: r2.dev is for non-production/dev traffic only, while a custom domain is required for production, caching, WAF/Access, and Bot Management. See https://developers.cloudflare.com/r2/buckets/public-buckets/
2. To enable r2.dev: in the Cloudflare dashboard go to R2 object storage, select your bucket, go to Settings, under 'Public Development URL' select Enable, then in the confirmation dialog type `allow` and select Allow.
3. Verify r2.dev is live by checking that 'Public URL Access' shows Allowed in the bucket's Settings tab, then access objects at the shown Public Bucket URL.
4. To connect a custom domain instead (or additionally), first ensure the domain is added as a zone in the same Cloudflare account as the bucket (full setup, or partial/CNAME setup if not Cloudflare-managed).
5. In the dashboard, go to R2 object storage > select your bucket > Settings > under 'Custom Domains' select Add, enter the domain name, select Continue, review the DNS record to be created, then select Connect Domain.
6. Wait for the domain status to change from Initializing to Active (a few minutes); if it does not, select the '...' menu next to the bucket and choose Retry connection. If the zone is on an Enterprise plan, release any zone hold first or the custom subdomain will fail to activate.
7. For production, configure caching on the custom domain: enable Smart Tiered Cache, and note that by default only certain file types are cached — add a Cache Everything page rule if you need all files cached.
8. To lock down a custom-domain bucket, apply Cloudflare Zero Trust Access or WAF Token Authentication; if you do this, also disable the r2.dev Public Development URL (Settings > Public Development URL > Disable, type `disallow`) since it bypasses these controls entirely.