Skip to main content
Rotation Type: Dual-PhaseThis rotation maintains two active credential sets with overlapping validity, ensuring zero-downtime during rotation cycles.
An R2 access key is a Cloudflare API token viewed through R2’s S3-compatible API: the Access Key ID is the token’s ID, and the Secret Access Key is the SHA-256 hash of the token’s value. This rotation creates that token scoped to the buckets you select, then hands you both values as secrets.

​
Prerequisites

  • Create a Cloudflare Connection. That connection is used to create and delete API tokens on your behalf during rotation.
  • The connection’s API token must include:
    • Account - API Tokens - Edit, to create and revoke the generated tokens.
    • Account - Workers R2 Storage - Read, so Infisical can list your buckets for the bucket picker.
    • Account - Account Settings - Read, so Infisical can validate the connection.
    See the Secret Rotation tab under Configure API Token and Account ID for Infisical for the exact configuration.

​
Create a Cloudflare R2 Access Key Rotation in Infisical

  1. Navigate to your Secret Manager Project’s Dashboard and select Add Secret Rotation from the actions dropdown. Secret Manager Dashboard
  2. Select the Cloudflare R2 Access Key option. Select Cloudflare R2 Access Key
  3. Configure the rotation behavior, then click Next.
  • Cloudflare Connection - The connection that will create and delete access keys during rotation.
  • Rotation Interval - The interval, in days, after which a rotation is triggered.
  • Rotate At - The local time of day when rotation runs once the interval has elapsed.
  • Auto-Rotation Enabled - Whether to rotate automatically on the interval. Turn off to rotate only manually or pause rotation. Rotation Configuration
  1. Set the R2 access key parameters, then click Next.
The General tab defines the key Infisical generates:
  • Token Name - The name for the generated Cloudflare API token, up to 100 characters. A timestamp is appended to each generated token so every rotation produces a distinct name in Cloudflare.
  • Buckets - The R2 buckets the generated key can act on. The list is fetched through your Cloudflare Connection and covers every jurisdiction your account has enabled; buckets outside the default jurisdiction are labelled with theirs.
  • Access Level - What the generated key can do on the selected buckets:
    • Object Read only - Read and list objects.
    • Object Read & Write - Read, list, write, and delete objects. Rotation Parameters
The Restrictions tab optionally limits where the generated key can be used:
  • Allowed IPs (optional) - The generated key can only be used from these IP addresses or CIDR blocks, one entry per line. Leave empty to allow any IP.
  • Disallowed IPs (optional) - The generated key cannot be used from these IP addresses or CIDR blocks, one entry per line. Restrictions
  1. Specify the secret names that the rotated credentials will be mapped to. Then click Next.
  • Access Key ID - The name of the secret in Infisical where the generated access key ID will be stored.
  • Secret Access Key - The name of the secret in Infisical where the generated secret access key will be stored. Rotation Secrets Mapping
  1. Give your rotation a name and description (optional). Then click Next.
  • Name - A slug-friendly name for this rotation configuration.
  • Description (optional) - Notes about this rotation. Rotation Details
  1. Review your configuration, then click Create Secret Rotation. Rotation Review
  2. Your Cloudflare R2 Access Key rotation is created. Rotations will create a new key, switch the active secrets to it, then revoke the previous key for zero-downtime rotation. Rotation Created
Infisical sets an expiration on every token it generates, calculated as twice the rotation interval plus one day, with a minimum of 7 days. This guarantees a key can never expire while it is still the active or previous credential.
Buckets are granted by name. The token’s policy references each bucket by its name and jurisdiction, so renaming or recreating a bucket in Cloudflare breaks the grant. Cloudflare does not reject unknown bucket names, so a stale name produces a key that silently grants nothing on it. Update the rotation’s parameters after renaming a bucket.Parameter changes apply on the next rotation. Editing the buckets or access level does not re-scope the key that is currently active; the change takes effect when the next key is generated. Trigger a manual rotation if you need it applied immediately.