Set up your backup bucket

Full walkthrough with pricing, lifecycle rules, and a scheduled workflow: back up Supabase to Cloudflare R2.

1. Cloudflare dashboard → R2 Object Storage → Create bucket (any name, e.g. my-backups).
2. R2 overview → Manage R2 API Tokens → Create API token. Permissions: Object Read & Write, scoped to your bucket.
3. On the success page, scroll past the “Token value” at the top— that is Cloudflare’s own API token, not what you need. Copy the credentials for S3 clients at the bottom: Access Key ID and Secret Access Key. The secret is shown only once.
4. The same page shows your endpoint.

Endpoint:   https://<account-id>.r2.cloudflarestorage.com
Region:     auto
Path-style: check "Force path-style addressing"

Full walkthrough with IAM policy, lifecycle ladder, and a scheduled workflow: back up Supabase to AWS S3.

1. S3 console → Create bucket (Block Public Access ON — the default).
2. IAM → Users → create a dedicated user (no console access) with a least-privilege inline policy on that bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::my-backups/*" },
    { "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::my-backups" }
  ]
}

3. That user → Security credentials → Create access key → copy Access Key ID + Secret Access Key.

Endpoint: (leave blank — AWS S3 is the default)
Region:   your bucket's region, e.g. us-east-1

Full walkthrough with pricing, key mapping, and lifecycle rules: back up Supabase to Backblaze B2.

1. B2 console → Buckets → Create a Bucket (files private).
2. Application Keys → Add a New Application Key, scoped to that bucket with read and write.
3. Map the values: keyID → Access Key ID, applicationKey → Secret Access Key. The endpoint is shown on the bucket page.

Endpoint: https://s3.<region>.backblazeb2.com
Region:   the <region> part, e.g. us-west-004