Guides /

Set up R2 storage and your Cloudflare token

Where your songs are stored, the read-only usage token for your admin page, and the free limits to watch.

Your personal site keeps songs in Cloudflare R2, a storage space inside your own Cloudflare account. Nobody else — not meshmelo, not aimusiclist — holds your files.

Screens on Cloudflare change from time to time. If a button name is a little different, look for the closest one.

1. Turn on R2

  1. Log in to Cloudflare.
  2. In the left menu, open R2 Object Storage.
  3. If Cloudflare asks you to add a payment method, add one. Inside the free limits you pay nothing.

2. The bucket (song folder)

If you installed with the Deploy to Cloudflare button, the bucket aml-music was created for you. You don't need to do anything.

To make it by hand:

  1. R2 Object Storage → Create bucket.
  2. Name: aml-music. Location: leave it on automatic.
  3. Press Create bucket.
  4. Keep it private. Do not turn on the public r2.dev address — your site plays songs through its own address.

3. The usage token (needed when you create your admin account)

Your admin page shows how much of the free plan you have used. For that it needs a read-only token.

Easiest way: on the Create admin screen of your site, press the token link. It opens Cloudflare with the right permission already selected. Press Continue to summary → Create Token, copy it, and paste it back.

By hand:

  1. Cloudflare → your profile icon (top right) → My Profile → API Tokens → Create Token.
  2. Choose Create Custom Token → Get started.
  3. Token name: aml-usage (anything is fine).
  4. Permissions: Account · Account Analytics · Read.
  5. Account Resources: Include · your account.
  6. Continue to summary → Create Token.
  7. Copy the token right away. Cloudflare shows it only once.

This token can only read usage numbers. It cannot change or delete anything.

4. Free limits

WhatFree limitIf you go over
R2 storage10 GBYou are charged
R2 writes (uploads, changes)1 million per monthYou are charged
R2 reads (plays, images)10 million per monthYou are charged
Workers requests (site visits)100,000 per dayThe site stops for the rest of the day (no charge)

Limits checked on 2026-10-27. The bars at the top of your admin page show where you are.

5. For meshmelo free hosting (coming soon)

When meshmelo free hosting opens, you will connect your bucket with an R2 API token that can only touch that one bucket:

  • R2 → Manage R2 API Tokens → Create API token
  • Permission: Object Read & Write
  • Specify bucket: only your bucket

You don't need this yet. Never share your Global API Key with anyone.