I can't find or delete my working access tokens for R2

I am managing files with R2 using the S3 api (in node). I have created an access key and secret key a long time ago (I can't remember how or where I created them). These credentials got leaked and I want to delete the old ones and create new ones. The problem is that I can't find the access token in the dashboard anywhere, but it still works.

The

process.env.ACCESS_TOKEN

process.env.ACCESS_TOKEN

long with lowercase letters and numbers.
The

process.env.S3_SECRET_KEY

process.env.S3_SECRET_KEY

long with lowercase letters and numbers.

I'm using the code below:

const s3 = require('@aws-sdk/client-s3');

const s3Client = new s3.S3Client({
    region: 'us-east-1',
    endpoint: process.env.S3_ENDPOINT,
    credentials: {
        accessKeyId: process.env.S3_ACCESS_KEY,
        secretAccessKey: process.env.S3_SECRET_KEY
    }
});

const s3 = require('@aws-sdk/client-s3');

const s3Client = new s3.S3Client({
    region: 'us-east-1',
    endpoint: process.env.S3_ENDPOINT,
    credentials: {
        accessKeyId: process.env.S3_ACCESS_KEY,
        secretAccessKey: process.env.S3_SECRET_KEY
    }
});

const s3 = require('@aws-sdk/client-s3');

const s3Client = new s3.S3Client({
    region: 'us-east-1',
    endpoint: process.env.S3_ENDPOINT,
    credentials: {
        accessKeyId: process.env.S3_ACCESS_KEY,
        secretAccessKey: process.env.S3_SECRET_KEY
    }
});

const s3 = require('@aws-sdk/client-s3');

const s3Client = new s3.S3Client({
    region: 'us-east-1',
    endpoint: process.env.S3_ENDPOINT,
    credentials: {
        accessKeyId: process.env.S3_ACCESS_KEY,
        secretAccessKey: process.env.S3_SECRET_KEY
    }
});

TLDR: I have a working access token for R2 using S3 api, but can't find it in the dashboard.

harshil1712•9/17/25, 11:45 AM

Heya, did you figure it out? You create the API tokens from the R2 dashboard itself

Hharshil1712 Heya, did you figure it out? You create the API tokens from the R2 dashboard its...

OscarOP•9/17/25, 2:59 PM

I haven't figured it out yet. I already have a working api token, but can't find it here. Am I looking in the wrong place?

harshil1712•9/17/25, 3:04 PM

That's where you should have the tokens. Can you check if this is the correct account? Moreover, it might be that you have caching enabled, which is why you can still access the items from the bucket

Hharshil1712 That's where you should have the tokens. Can you check if this is the correct ac...

OscarOP•9/22/25, 9:27 AM

This is the correct account with the correct buckets. I do have caching enabled, but can actively create, delete and get new items

OscarOP•9/22/25, 9:29 AM

Sorry for the late response

harshil1712•9/22/25, 9:31 AM

Looking at the code snippet it feels like you are still using S3, instead of R2? Or maybe it's just the naming?

Hharshil1712 Looking at the code snippet it feels like you are still using S3, instead of R2?...

OscarOP•9/22/25, 9:33 AM

I'm using R2 with the S3 api provided by Cloudflare. I can see newly created items (with my current token) in the correct account in the buckets in the Cloudflare dashboard

harshil1712•9/22/25, 9:38 AM

I have not come across this issue before. Asking the team

OscarOP•9/23/25, 4:34 PM

If anyone sends a message here, please ping me. I'm having some trouble with the discord notification settings

OOscar If anyone sends a message here, please ping me. I'm having some trouble with the...

harshil1712•9/24/25, 3:47 PM

Hey, we will need your account ID to check this. Sorry for the dealy from my end

Hharshil1712 Hey, we will need your account ID to check this. Sorry for the dealy from my end

OscarOP•9/24/25, 4:58 PM

it's

2e01a9b3adad6513d50176031863565b

2e01a9b3adad6513d50176031863565b

harshil1712•9/25/25, 9:09 AM

Thanks! Shared with the team.

Hharshil1712 Thanks! Shared with the team.

OscarOP•10/7/25, 4:00 PM

Hey! I don't mean to bother anyone, but is there an update on this?

The working tokens have been leaked, (so a bad actor could in theory have full access to our r2 buckets), but I can't delete the r2 tokens.
This is a big security threat to us.

I really appreciate all the help that people are giving, thanks again

Hharshil1712 Thanks! Shared with the team.

OscarOP•10/17/25, 8:58 PM

Hi, is there any update on this?

I know you (and the team) are very busy and have a lot to do, but this is a big security vulnerability for us.

We don't mind if there's downtime (for a day or two) to fix this, but we do mind if all of our files are suddenly stolen or deleted.

I really appreciate all the work that has gone into this, thanks a lot!

harshil1712•10/17/25, 9:35 PM

Following up with the team. Sorry

OscarOP•10/17/25, 9:35 PM

Thank you very much

harshil1712•10/20/25, 9:54 PM

I have raised this internally. In the meantime, did you try using the API?

OscarOP•10/21/25, 8:57 AM

Which api should I use?

nestorF•10/21/25, 1:41 PM

@Oscar Hi there, our engineering team is working on this issue, but they would need you to create a Support case. would it be possible for you to do this and provide the case number?

NnestorF @Oscar Hi there, our engineering team is working on this issue, but they would n...

OscarOP•10/21/25, 1:41 PM

I don't have a paid account. Which support type should I choose?

nestorF•10/21/25, 1:49 PM

You can choose free

NnestorF You can choose free

OscarOP•10/21/25, 2:10 PM

I chose account type, because I couldn't choose R2

nestorF•10/21/25, 2:12 PM

R2 would be the product

OscarOP•10/21/25, 2:12 PM

If I chose R2, it wouldn't let me create a support case, because I have a free account

nestorF•10/21/25, 2:14 PM

no worries. I have found the case now and I will link it to the internal case that the engineering team is using to work on this issue. If our team needs to contact you, they will send you an Email from the case. Thanks a lot!

I can't find or delete my working access tokens for R2

Similar Threads

Similar Threads

Similar Threads