R2 File Sharing Worker

A Cloudflare Worker for secure, time-limited file sharing via R2 object storage.

Features

• 🔒 Token-based access with HMAC-SHA256 signing
• ⏱ Configurable link expiry
• 📁 Folder structure support
• ▶ In-browser video and audio playback with range request support
• 🖼 Image preview
• ⬇ File download
• 📄 Supports files of any size via chunked streaming

Setup

Prerequisites

• Cloudflare account
• Node.js
• Wrangler CLI

1. Clone the repo

git clone https://github.com/itoschum/r2-share-worker.git
cd r2-share-worker
npm install

2. Configure Wrangler

Edit wrangler.jsonc and set your R2 bucket name:

{
  "r2_buckets": [{ "binding": "MY_BUCKET", "bucket_name": "your-bucket-name" }],
}

3. Set the secret key

Generate a secret:

openssl rand -hex 32

Set it in Cloudflare:

wrangler secret put SECRET_KEY

For local development, create .dev.vars:

SECRET_KEY=your-secret-here
WORKER_URL=https://your-worker.workers.dev

4. Upload files to R2

rclone copy ./your-folder your-r2-remote:your-bucket --progress

5. Deploy

wrangler deploy

Generating a share link

node scripts/generate-sharing-link.js

Outputs a time-limited URL to share with recipients. Default expiry is 24 hours — edit the script to change this.

Project structure

├── src/
│   └── worker.ts                 # Cloudflare Worker
├── scripts/
│   └── generate-sharing-link.js  # Share link generator
├── .dev.vars                     # Local secrets (never commit)
├── wrangler.jsonc                # Cloudflare Worker config
└── package.json

Security

• Links expire after a configurable time period
• HMAC-SHA256 tokens prevent link forgery
• R2 bucket is private — all access goes through the Worker
• Rotating SECRET_KEY immediately invalidates all existing links

Deployment

Pushes to master automatically deploy via Cloudflare's GitHub integration.