Powered by Cloudflare R2
Introduction
Laravel Cloud allows you to create S3-compatible object storage buckets and attach them to your application’s environments directly from the Laravel Cloud dashboard. Laravel Cloud Object Storage is offered in partnership with Cloudflare R2. Laravel Cloud Object Storage may be used as your Laravel application’s file storage backend, allowing you to interact with the bucket via Laravel’sStorage
facade.
Prerequisites
Before utilizing Laravel Object Storage, you should ensure your application includes theleague/flysystem-aws-s3-v3
package in its composer.json
dependencies:
Creating buckets

Bucket disk names
When creating a bucket, you will also be prompted to provide a “disk name”. This name corresponds to the name you will use when accessing the bucket / disk via Laravel’sStorage
facade:
Storage
facade:
Bucket file visibility
When creating a bucket, you will be prompted to select the bucket’s file visibility. All files added to the bucket will receive the specified visibility, and Laravel Cloud Object Storage buckets do not support mixing file visibility settings within a single bucket.- Private buckets: all files within the bucket are private and are not publicly accessible via the Internet. However, temporary public URLs may be generated to files within these buckets using the
Storage::temporaryUrl
method offered by Laravel. These buckets are typically used for private assets like personal documents uploaded by your application’s users. - Public buckets: all files within the bucket are public and are publicly accessible via the Internet via a Laravel Cloud provided URL. These buckets are typically used for publicly viewable assets like user avatars.
CORS policy
Laravel Cloud automatically manages CORS (Cross-Origin Resource Sharing) policies for your object storage buckets to ensure browsers will permit cross-origin requests.Automatic domain inclusion
When you attach a bucket to an environment, all of the environment’s custom and Cloud domains are automatically included in the bucket’s CORS policy. This happens automatically without any configuration required on your part.Custom allowed origins
In addition to your environment’s domains, you may specify additional origins that should be allowed to access your bucket. This is particularly useful for:- Local development environments (e.g.,
http://example.test
) - External domains that need access to your bucket
- Testing from non-production environments
- Navigate to your organization’s resources page by clicking Org > Resources > Object storage from the main dashboard.
- Click the ”…” menu next to the bucket you want to configure.
- Select “Edit settings”.
- In the “Allowed origins” field (only visible for public buckets), enter the origins you want to allow, separated by new lines.
- Each origin must be prefixed with the protocol (
https://
orhttp://
).

Local development
To connect to your object storage buckets from your local Laravel application, add your local development domain (e.g.,http://example.test
) to the bucket’s allowed origins. This makes it easy to test file uploads and storage operations during development.
Technical details
The CORS policy applied to your buckets allows the following:- Methods: GET, POST, PUT, DELETE, HEAD
- Headers: All headers (
*
) are permitted - Origins: All environment domains plus any custom origins you’ve configured
Connecting to buckets
From your application
When a bucket is attached to an environment, Laravel Cloud will automatically inject the environment variables needed by the Laravel application to interact with the bucket via theStorage
facade, including the FILESYSTEM_DISK
and AWS S3-compatible bucket related variables. You may view these environment variables in your environment’s General Settings.
From your local machine
To connect to your bucket from your local machine using a Cloudflare R2 compatible bucket management client like Cyberduck:- Navigate to your bucket by going to
Resources > Object storage
from the main dashboard. Then click the ”…” icon next to the bucket and then click “View credentials”.

- The bucket credentials modal window will provide you with the name, endpoint, access key ID, and access key secret needed to connect to your bucket.

- When connecting to the bucket via Cyberduck:
- Open Cyberduck, select ”+” in the bottom left-hand corner to create a new bookmark, and select “Cloudflare R2 Storage (S3)” as the connection type. If this is your first time using the Cloudflare R2 Storage connection, you may need to add it from
Settings > Profiles
. Learn more - Enter the “Endpoint” bucket credentials value into the Cyberduck “Server” field
- Enter the “Access key ID” bucket credentials value into the Cyberduck “Access Key ID” field
- Enter the “Access key secret” bucket credentials value into the Cyberduck “Access Key Secret” field
- Enter the “Name” bucket credentials value into the Cyberduck “Path” field (under “More Options”).
- If you do not see “More Options”, you likely clicked “Open Connection” instead of creating a new bookmark from the first step.
- Optional: Give your Bookmark a “Nickname”
- Open Cyberduck, select ”+” in the bottom left-hand corner to create a new bookmark, and select “Cloudflare R2 Storage (S3)” as the connection type. If this is your first time using the Cloudflare R2 Storage connection, you may need to add it from
- Your new Cyberduck connection should look like this when completed. You can now close the “Open connection” modal and connect to your bucket.
