Set up your backup bucket

Full walkthrough with pricing, lifecycle rules, and a scheduled workflow: back up Supabase to Cloudflare R2.

Six clicks, one screenshot each. Values that are yours alone (account id, keys) are blurred in the pictures.

1. In the Cloudflare dashboard open Storage & databases → R2 Object Storage and click Create bucket.

   

2. Name the bucket (any name, e.g. my-backups). Leave Location on Automatic and Default Storage Class on Standard, then click Create bucket.

   

3. Back on the R2 overview, scroll down to Account Details and click Manage API Tokens. This is the entrance people miss — it sits under the usage panel, not in the top bar.

   

4. Under Account API Tokens click Create Account API token. Account tokens keep working if a team member leaves; user tokens don’t. Creating an account token needs the Super Administrator role on the Cloudflare account — if the button is missing for you, ask an admin, or use Create User API token further down: the remaining steps are identical, the token just stops working if you leave the account.

   

5. Name the token, choose Object Read & Write, choose Apply to specific buckets only and pick the bucket from step 2, keep TTL on Forever, then click Create Account API Token (or Create User API Token on the user-token path — the form is the same).

   

6. On the success page, scroll past the “Token value” at the top — that is Cloudflare’s own API token, not what you need. Copy the three values under Use the following credentials for S3 clients: Access Key ID, Secret Access Key, and the endpoint below them. They are shown only once.

   

7. Open BackupDrill → Add project, finish step 1 (connect your Supabase project), and in step 2 click the Cloudflare R2 chip. Then fill the four fields exactly like this:

   

   BackupDrill field	Paste
   Endpoint	③ from step 6 — the whole https://… address
   Bucket name	the name you typed in step 2 (e.g. my-backups)
   Access key ID	① from step 6
   Secret access key	② from step 6

   There is no Region box for R2 — BackupDrill sets it to auto for you, and path-style addressing is switched on automatically whenever an endpoint is given, so leave Advanced closed. Click Add project; the first backup starts within a few minutes and lands in the bucket from step 2.

Full walkthrough with IAM policy, lifecycle ladder, and a scheduled workflow: back up Supabase to AWS S3.

1. S3 console → Create bucket (Block Public Access ON — the default).
2. IAM → Users → create a dedicated user (no console access) with a least-privilege inline policy on that bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::my-backups/*" },
    { "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::my-backups" }
  ]
}

3. That user → Security credentials → Create access key → copy Access Key ID + Secret Access Key.

Endpoint: (leave blank — AWS S3 is the default)
Region:   your bucket's region, e.g. us-east-1

Full walkthrough with pricing, key mapping, and lifecycle rules: back up Supabase to Backblaze B2.

1. B2 console → Buckets → Create a Bucket (files private).
2. Application Keys → Add a New Application Key, scoped to that bucket with read and write.
3. Map the values: keyID → Access Key ID, applicationKey → Secret Access Key. The endpoint is shown on the bucket page.

Endpoint: https://s3.<region>.backblazeb2.com
Region:   the <region> part, e.g. us-west-004