R2 is S3-compatible everywhere except in your file manager
Cloudflare R2 gets picked for two reasons. The API is S3-compatible, so existing SDKs and tooling keep working, and there are no egress fees. So teams park build artifacts, release binaries, design assets and database dumps in R2 and stop calculating what it costs to pull them back out.
Then somebody needs one file. Not a pipeline, not a sync job. One file, opened in a normal application. At that point you are back in the dashboard, typing aws s3 cp with an --endpoint-url flag, or reaching for wrangler. No first-party desktop app drops an R2 bucket into Finder or File Explorer.
You can put one there yourself, without a kernel driver.
Getting the R2 credentials
R2 speaks the S3 protocol, so you need an S3-style key pair and an endpoint. Open R2 in the Cloudflare dashboard and create a token from the R2 API tokens screen. You get an Access Key ID and a Secret Access Key, and the secret is shown once. The endpoint is tied to your account ID and takes the form https://ACCOUNT-ID.r2.cloudflarestorage.com.
Two habits worth keeping:
- Scope the token to the buckets you actually touch, not the whole account.
- If you only plan to pull artifacts and eyeball uploads, issue a read-only token. It pairs with what comes next, since the free WebDAV tier is read-only anyway.
Connect the bucket in AnyStorage
AnyStorage is a desktop storage browser for macOS 11 and later, Windows 10 and later and Ubuntu 20.04 and later, Apple Silicon and Intel included. Free download, no account to create. Add a connection, choose Cloudflare R2, paste the endpoint and the key pair.
The bucket now behaves like a folder tree inside the app: tabs, search, previews, a transfer queue. For a good share of daily work that is the whole answer.
The mount is for everything else.
Mount Cloudflare R2 as a local drive over WebDAV
AnyStorage ships a WebDAV server. Open Services in the sidebar, switch to the WebDAV tab, press Start. It listens on http://127.0.0.1:3211 by default, and the port is configurable anywhere in the 1 to 65535 range. Leave the server enabled and it comes back up with the app next launch.
HTTP Basic authentication is always on. The default username is anystorage and the password is 24 random characters generated on first use. Both are editable, with a Regenerate button and copy buttons next to them.
There is no auto-mount button. You copy the URL and mount it with the tool your OS already has:
- macOS: Finder, Go, Connect to Server (Cmd+K), paste http://127.0.0.1:3211, connect as a registered user with the app's credentials.
- Windows: File Explorer, This PC, Map network drive, paste the same URL.
- Linux or anything else: any client that speaks WebDAV, including media players and backup tools.
Every storage connection that is currently connected in the app shows up as a folder at the WebDAV root, named after the connection. Your R2 bucket sits next to whatever else you have open, and 20 connection types can appear there, from S3 and B2 to Google Drive, SFTP and local folders.
No macFUSE. No reduced-security boot on Apple Silicon. No WinFsp driver, no admin rights, no config file.
What this actually buys a developer
Reads stream with HTTP range support, so seeking inside a file works without pulling all of it down.
- Drag a build artifact out of the bucket in Finder instead of generating a presigned URL for yourself.
- Quick Look a folder of images to check what a deploy uploaded.
- Scrub through a video in a normal player, straight from R2.
- Point a WebDAV-capable backup tool at it, if you are on Pro with write access enabled.
The limits, up front
The free tier serves WebDAV read-only. Writing through the mount needs a Pro license and Full control mode, and even on Pro you can deliberately keep it read-only.
There is no TLS. The URL is plain http and the auth is Basic, which is exactly why we bind 127.0.0.1 by default. LAN mode binds 0.0.0.0 instead, and the app warns you when you turn it on, because credentials then cross the network in the clear.
Three more things. After an app restart, an R2 connection appears under the WebDAV root only once you have opened it in the app, because connections connect lazily. New connections show up without restarting the server. There is no file locking, so this is not the place for two machines editing the same file. And you cannot rename or delete the top-level connection folders through WebDAV, or move files directly between two different connections through the mount.
Windows brings its own list. Its native WebClient service is deprecated as of 2026 and usually stopped, so start it in services.msc first. Windows also refuses HTTP Basic auth by default: BasicAuthLevel under HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Parameters allows Basic over SSL only until you set it to 2 and restart WebClient. Skip that and you get "The folder you entered does not appear to be valid", System error 67, or 0x80070043. The transfer cap, FileSizeLimitInBytes, defaults to 50,000,000 bytes, and copies above it fail with 0x800700DF. A third-party WebDAV client sidesteps all of it.
For moving thousands of objects, use the transfer queue in the app. The mount is for the moments when another program needs to see one file.