ST-2026-139 · Authentication & identity
Cloudflare R2 Data Catalog adds read-only API-token permissions
Cloudflare split R2 Data Catalog API access so Admin Read tokens can perform read operations while writes require Admin Read & Write.
Cloudflare R2Data CatalogAPI tokenread onlyleast privilege
Previous state
Data Catalog API tokens relied on the broader read-write permission boundary for operational access.
Current state
Read operations can use Admin Read tokens; write operations continue to require Admin Read & Write.
Affected users
Who needs to care
Teams issuing service tokens for R2 Data Catalog discovery, query and administration.
Required response
What to do
Reduce read-only integrations to Admin Read and retain write permission only where mutation is required.
Evidence boundary
What the source does not prove
The change introduces a least-privilege permission split; it does not automatically rotate or downgrade existing tokens.
Lifecycle history
Dated event sequence
- Read-only permissions released
Cloudflare documented the read versus write token boundary.
Evidence ledger
First-party sources
- 01Cloudflare Developers — R2 Data Catalog read-only API tokens
Official authentication changelog · 2026-07-13
Open official source ↗