Workflow: serving media from R2 with a custom domain and cache

TL;DR: Buckets are private by default, which is the safe starting point. ## 2. # Workflow: R2 media pipeline ## 1. Two buckets One bucket for public assets, one for private originals.

Fix

1. Buckets are private by default, which is the safe starting point. ## 2. Expected: this specific failure stops.

2. subdomain is for non-production use only. Expected: this specific failure stops.

3. Verify from an unauthenticated session that the assets load with no credentials. ## 3. Expected: the value or setting is exactly right, nothing ambiguous.

4. Upload pipeline Uploads go through your app (or a Worker with the R2 binding) with content types set correctly: a missing. Expected: this specific failure stops.

5. Verify. Expected: the value or setting is exactly right, nothing ambiguous.

6. The Worker path also lets you add transforms (resizing, format negotiation) at the edge. ## Checklist - Public and private buckets separated from day one. - Custom domain in production, content types correct, cache HIT verified. - No sensitive file ever lands in the public bucket. Expected: this specific failure stops.

Details

Workflow: R2 media pipeline ## 1. Two buckets One bucket for public assets, one for private originals. assets.example.com ). The r2.dev Content-Type serves downloads instead of images. Fingerprint filenames for immutable caching. ## 4. CF-Cache-Status: HIT on repeat loads from multiple regions. ## 5. Private originals Serve private files via presigned URLs or through a Worker that checks auth and streams from the R2 binding.

When to use

You hit exactly this: Workflow: serving media from R2 with a custom domain and cache in Workflow.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Workflow.

Root cause

Public means public, including future objects: never mix.

Edge cases

• Custom domain for production Expose the public bucket on a custom domain (.
• Cache rules Long edge TTLs on the fingerprinted assets; the custom domain's cache behavior tuned per path.

Composite workflow grounded in verified docs: R2 buckets private by default, custom domain vs r2.dev (non-production), Cache Rules, R2 Workers binding for private serving. Refs: https://developers.cloudflare.com/r2/buckets/public-buckets/ , https://developers.cloudflare.com/cache/how-to/cache-rules/