Cloudflare R2 connection

Verify public media and private downloads buckets without exposing credentials.

Bucket policy

Media assets use the public media bucket. Download files stay private and are served through expiring signed URLs.

Public mediaPrivate downloadsSigned URLs expire

Runs a server-side bucket check using R2 environment variables. Secrets never render in the browser.