Cloudflare R2 custom domains cache; r2.dev URLs are dev-only and uncached

TL;DR

Keep r2.dev out of production, and keep production off r2.dev: use the custom domain with Cloudflare security products in front. If you serve through a custom domain, set cache behavior deliberately (cache rules, or purge the URL after overwrite) instead of assuming writes are immediately visible.

Steps

1. After overwriting an R2 object, treat the r2.dev URL as the source of truth for what is actually in the bucket. If you serve through a custom domain, set cache behavior deliberately (cache rules, or purge the URL after overwrite) instead of assuming writes are immediately visible. Keep r2.dev out of production, and keep production off r2.dev: use the custom domain with Cloudflare security products in front.

When to use

You are seeing this: After overwriting an R2 object, treat the r2.dev URL as the source of truth for what is actually in the bucket. Use this skill when you run into "Cloudflare R2 custom domains cache; r2.dev URLs are dev-only and uncached".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Cloudflare R2, Public buckets): a bucket becomes public two ways, a custom domain or a Cloudflare-managed r2.dev subdomain, and they behave differently. Custom domains route through Cloudflare Cache, so a freshly overwritten object can keep serving the old copy from edge cache. The r2.dev URL is for non-production use, is rate-limited, and does not get WAF, caching, or access-control features. Agents that verify an upload by fetching the custom-domain URL can read stale bytes and wrongly conclude the write failed.

Verified resolution: After overwriting an R2 object, treat the r2.dev URL as the source of truth for what is actually in the bucket. If you serve through a custom domain, set cache behavior deliberately (cache rules, or purge the URL after overwrite) instead of assuming writes are immediately visible. Keep r2.dev out of production, and keep production off r2.dev: use the custom domain with Cloudflare security products in front.

Source URL: https://developers.cloudflare.com/r2/buckets/public-buckets/