1. CLOUDFLARE SETUP a) In the Cloudflare dashboard open R2 and create a bucket.
b) R2 > Manage API tokens > Create token. Permission: Object Read & Write. Limit it to your bucket. Copy the Access Key ID and Secret Access Key.
c) Copy your Account ID (shown on the R2 overview page).
d) Bucket > Settings > CORS policy. Paste this, using your own app addresses (include your bubbleapps.io address for testing):
[
 {
   "AllowedOrigins": ["https://yourapp.bubbleapps.io", "https://www.yourdomain.com"],
   "AllowedMethods": ["PUT", "GET"],
   "AllowedHeaders": ["content-type"],
   "MaxAgeSeconds": 3600
 }
]
e) Optional, for public files: Bucket > Settings > connect a custom domain (for example files.yourdomain.com).

2. PLUGIN KEYS (Plugins tab)
- Account ID
- Access Key ID
- Secret Access Key
- Bucket name
- Public base URL: optional. Your public bucket address, for example https://files.yourdomain.com. Leave empty for private buckets.
- Jurisdiction: optional. Leave empty, or enter eu if your bucket was created in the EU jurisdiction.

3. UPLOAD WORKFLOW
a) Place the R2 Uploader element on your page.
b) Add a workflow: When R2 Uploader A File selected
  Step 1: Create R2 upload URL
          File name = R2 Uploader A's File name
          Content type = R2 Uploader A's File type
          Folder = optional, for example Current User's unique id
  Step 2: Upload to URL (R2 Uploader A)
          Upload URL = Result of step 1's upload_url
          File key = Result of step 1's file_key
          Public URL = Result of step 1's public_url
c) Add a workflow: When R2 Uploader A Upload complete
  Save R2 Uploader A's File key (and File URL for public buckets) to your database.
d) Optional: When R2 Uploader A Upload failed or File rejected, show R2 Uploader A's Error message.

With "Allow multiple files" ticked, the same workflows run once per file, one after another.

4. PRIVATE FILES
Use Create R2 download URL with the saved File key to get a link that expires. Generate it when the user clicks download, not on page load.

5. DELETING
Use Delete R2 file with the saved File key.

6. SECURITY
Anyone who can trigger your upload workflow can upload to your bucket. Add "Only when" conditions (for example Current User is logged in) to the File selected workflow, and never run Delete R2 file with a key taken straight from user input without checking the file belongs to that user.

TROUBLESHOOTING
- "Upload blocked": the bucket CORS policy does not list the address you are on, or PUT is missing.
- "Upload refused (403)": the keys are wrong, the token cannot write to this bucket, the link expired, or Content type in step 1 was not set to the uploader's File type.