TL;DR: Buckets are private by default, which is the safe starting point. ## 2. # Workflow: R2 media pipeline ## 1. Two buckets One bucket for public assets, one for private originals.

## Fix
1. Buckets are private by default, which is the safe starting point. ## 2.
   Expected: this specific failure stops.
2. subdomain is for non-production use only.
   Expected: this specific failure stops.
3. Verify from an unauthenticated session that the assets load with no credentials. ## 3.
   Expected: the value or setting is exactly right, nothing ambiguous.
4. Upload pipeline Uploads go through your app (or a Worker with the R2 binding) with content types set correctly: a missing.
   Expected: this specific failure stops.
5. Verify.
   Expected: the value or setting is exactly right, nothing ambiguous.
6. The Worker path also lets you add transforms (resizing, format negotiation) at the edge. ## Checklist - Public and private buckets separated from day one. - Custom domain in production, content types correct, cache HIT verified. - No sensitive file ever lands in the public bucket.
   Expected: this specific failure stops.

## Details
# Workflow: R2 media pipeline ## 1. Two buckets One bucket for public assets, one for private originals. `assets.example.com` ). The `r2.dev` `Content-Type` serves downloads instead of images. Fingerprint filenames for immutable caching. ## 4. `CF-Cache-Status: HIT` on repeat loads from multiple regions. ## 5. Private originals Serve private files via presigned URLs or through a Worker that checks auth and streams from the R2 binding.

## When to use
You hit exactly this: Workflow: serving media from R2 with a custom domain and cache in Workflow.

## When not to use
A different error, or the same symptom in a different tool. This page only covers the failure above.

## Compatibility
Workflow.

## Root cause
Public means public, including future objects: never mix.

## Edge cases
- Custom domain for production Expose the public bucket on a custom domain (.
- Cache rules Long edge TTLs on the fingerprinted assets; the custom domain's cache behavior tuned per path.