Create an R2 bucket in the Cloudflare dashboard; generate an R2 API token with read/write permissions — the token provides an Access Key ID and Secret Access Key usable with S3-compatible clients
Configure your S3 client or SDK with the R2 endpoint: https://<account-id>.r2.cloudflarestorage.com, your Access Key ID, and your Secret Access Key; set the region to auto (R2 ignores region but the SDK requires a non-empty value)
Use standard S3 API calls (PutObject, GetObject, DeleteObject, ListObjectsV2, multipart upload) against the R2 endpoint — the API is broadly S3-compatible with known exceptions (no object tagging API, no ACLs, no Torrent)
Generate presigned URLs using your S3 client's presign method targeting the R2 endpoint; presigned URLs allow time-limited unauthenticated access to private objects; set expiration appropriately (R2 supports up to 7 days)
For public read access without presigned URLs, enable the R2 bucket's public URL feature in the dashboard or attach a custom domain via a Cloudflare Worker; the public URL serves objects over Cloudflare's CDN at no egress cost
For Worker-side access, bind the R2 bucket to the Worker in wrangler.toml and use the env.BUCKET.get(), put(), delete() methods — this path uses R2's native API (not S3-compatible) and has no egress fees
Known gotchas
R2 does not charge egress fees when data is accessed via Cloudflare Workers, the public bucket URL, or a custom Cloudflare-proxied domain — but egress from the S3-compatible API to non-Cloudflare destinations is billed; design access patterns accordingly
The S3 multipart upload API requires all parts except the last to be at least 5 MiB; parts smaller than this cause a 400 error on CompleteMultipartUpload
R2 presigned URLs require the signature to be computed against the R2 endpoint hostname, not s3.amazonaws.com — if your SDK hardcodes the endpoint, presigned URLs will be signed for the wrong host and return 403 errors
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp