Cloudflare R2

Cap Pro can use Cloudflare R2 through its S3-compatible API. New shareable-link uploads use the active R2 configuration; existing recordings remain on their current provider.

Prepare R2

1. Create or choose an R2 bucket.
2. Create a dedicated R2 API token with read and write access to that bucket.
3. Copy the access-key ID, secret access key, bucket name, and S3 endpoint shown by Cloudflare.
4. Configure CORS for every Cap web origin that will upload directly to the bucket.

Multipart browser uploads need PUT requests and access to the ETag response header. A representative CORS policy is:

[
  {
    "AllowedOrigins": ["https://cap.so"],
    "AllowedMethods": ["GET", "HEAD", "PUT"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3000
  }
]

Add your custom or self-hosted Cap origin when applicable. Do not add unrelated origins.

Connect Cap Desktop

1. Open Settings > Integrations > S3 Config.
2. Select Cloudflare R2.
3. Enter the R2 access-key ID and secret access key.
4. Enter the account endpoint, usually https://<account-id>.r2.cloudflarestorage.com.
5. Enter the bucket name and the region value required by your R2 credentials, commonly auto.
6. Click Test Connection.
7. Save after the test succeeds.

The connection test confirms Cap can reach the bucket. Verify a real upload as well because object operations and browser CORS use additional permissions.

Organization-managed storage

Organization owners and admins can manage an S3-compatible provider centrally. Members cannot override an organization-managed configuration from Cap Desktop.

Switching from R2 to Google Drive, another S3 provider, or Cap-managed storage changes future uploads only. Existing files are not automatically copied.

Verify before rollout

1. Upload a non-sensitive sample.
2. Confirm it is stored in the expected R2 bucket.
3. Play it through its Cap link as an allowed viewer.
4. Confirm the browser reports no CORS failure.
5. Keep the previous storage provider available until the sample succeeds.

Never paste R2 credentials into an agent chat. An agent may guide and verify the configuration, but secret entry belongs in Cap's protected settings UI or another approved secret channel.