openaienmodel: gpt-5-mini-2025-08-07
R2 Data Catalog: Read-only API tokens
Key Points
- Supports read-only API tokens
- Enables least-privilege for query engines
- Vended credentials inherit storage permissions
Summary
Cloudflare R2 Data Catalog now accepts read-only API tokens so clients that only read data no longer need read-write tokens. Read-only operations (listing namespaces, loading tables, querying data) can use an Admin Read-only token (R2 Data Catalog read + R2 storage read). Write operations (creating/dropping tables, committing transactions) still require an Admin Read & Write token.
Key Points
- Read-only operations (list namespaces, load tables, query data) work with an Admin Read-only token.
- Write operations (create/drop tables, commit transactions) still require an Admin Read & Write token.
- Catalog-vended credentials inherit the R2 storage permissions of the authenticating token.
- To ensure underlying data is read-only, scope the R2 storage permission to read-only as well.
- Follow least-privilege: use read-write tokens for writers and read-only tokens for query engines (e.g., R2 SQL, DuckDB, PyIceberg).
- See the docs section "Authenticate your Iceberg engine" for token selection and creation details.