Can't get API access to R2, to change TLS defaults

[jimmo23]

For Workers & Pages, what is the name of the domain?

not relevant

What is the issue or error you’re encountering

Can’t get API access to R2, to change TLS defaults

What steps have you taken to resolve the issue?

I found the thread here, where several other people have the same problem.

Disable TLS 1.0/1.1 for R2 subdomain

This is now possible with an API call: R2 Edit Custom Domain Settings

So I was happy to try the solution of using the API to fix this.

I went to R2 storage, created a new API key, just for cli access, and gave it full permissions to access and edit all buckets and settings.
However when I try to use the key in the suggested way, for eg.
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/r2/buckets
–header “X-Auth-Email: $CLOUDFLARE_EMAIL”
–header “X-Auth-Key: $CLOUDFLARE_API_KEY”
Then I get an authentication error.
{“success”:false,“errors”:[{“code”:10000,“message”:“Authentication error”}]}

I have visited the account main page, and see that this key has been set up with this permission (only) Workers R2 Storage:Edit

What do I need to add to this to make it work.

[sdayman]

I don’t think that’s going to be an R2 token. Try a regular API token, like this:

Create API token · Cloudflare Fundamentals docs

[jimmo23]

Although the API key was created via the R2 area, it stillappears in the Profile > API Tokens area. (I think the R2 route was just a shortcut to adding the right perms for R2 storage)
The one I created like that has edit permissions for Workers R2 Storage.
I’ve tried editing it and adding anything I can see to do with SSL or TLS, but still the same “no authentication” message

I’ll also add that I’ve successfully created API tokens to access buckets, and the files within, using various s3 clients (eg rclone). And I’ve created other API tokens to change Zone settings in the past. But I can’t figure out what permissions R2 bucket settings wants.

[sdayman]

I’m quite sure it’s the screenshot I just posted. I just set mine while scanning SSL:

Here’s what I sent:

And then I set it back to 1.0 before the scan completed:

[jimmo23]

OK well thanks for the confirmation. I have an API token with identical permissions, but its not authorizing properly. So I guess there must be something strange going on with the account itself.
I can’t even list buckets, so its not a read/write thing.

I’m logging in as a delegate of the account, with (I am assured) full admin access. I’ve tried changing the account email and/or account ID with all permutations, so its not that …

[jimmo23]

@jimmo23

–header “X-Auth-Email: $CLOUDFLARE_EMAIL”
–header “X-Auth-Key: $CLOUDFLARE_API_KEY”

So just making sure … are these the headers you’re using to authenticate?
These are the ones suggested in the link in my first post, which are different from the ones I used previously, namely
“Authorization: Bearer xxxxxxyyyyyyyyy”

[jimmo23]

Ugh. It seems that’s it. If I use Authorization Bearer, it works.
If I use X-Auth-Key, and X-Auth-Email, as instructed in the documentation (!), it doesn’t. Who would have guessed.

[jimmo23]

Might want to also update the API documentation so that the example uses Authorization Bearer, so others don’t spend hours on this!