Write credentials
Public reads are open at cdn.v8r.app/n/<namespace>/. Writes require a project token in the v8r-<Base58> shape. The control plane vends short-lived, prefix-scoped R2 credentials. The parent key never leaves the server.
1. Request credentials
curl -X POST https://www.v8r.dev/api/cdn/credentials \
-H "Authorization: Bearer v8r-<your-token>" \
-H "Content-Type: application/json" \
-d '{ "ttlSeconds": 900 }'Optional paths must stay under n/<namespace>/. The prefix is derived from the token's project, never from the request body.
2. Use the S3 client
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
const creds = await fetch("https://www.v8r.dev/api/cdn/credentials", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.V8R_CDN_TOKEN}` },
}).then((res) => res.json());
const client = new S3Client({
region: "auto",
endpoint: creds.endpoint,
credentials: {
accessKeyId: creds.accessKeyId,
secretAccessKey: creds.secretAccessKey,
sessionToken: creds.sessionToken,
},
});
await client.send(new PutObjectCommand({
Bucket: creds.bucket,
Key: `${creds.prefix}release/app.tar.gz`,
Body: buffer,
}));
const publicUrl = `${creds.publicBaseUrl}/${creds.prefix}release/app.tar.gz`;Limits
- TTL is capped at 900 seconds.
- Each token is rate-limited to 20 successful vends per 15 minutes.
- Revoking a token (or the parent R2 key) invalidates derived credentials.
- A leaked short-lived credential cannot write outside its prefix.