# Amazon S3 and other providers

> What each S3-compatible storage provider needs, and how its files are made public.

Every provider is reached through its S3-compatible API. Pick it under **Provider (S3-compatible API)**, then enter what it asks for: the account ID on R2, the endpoint on a custom server, nothing extra on Google Cloud Storage, and the region everywhere else. Then the bucket and a key limited to that bucket.

| Provider | Endpoint | How files become public |
|---|---|---|
| Cloudflare R2 | `https://<account>.r2.cloudflarestorage.com` | A custom domain on the bucket. R2 has no object ACLs. [Step by step](/docs/offload-media/connect-cloudflare-r2/). |
| Amazon S3 | `https://s3.<region>.amazonaws.com` | A bucket policy or CloudFront. New buckets refuse ACLs, so the ACL setting starts off. |
| Backblaze B2 | `https://s3.<region>.backblazeb2.com` | A public bucket. No ACL is ever sent. |
| DigitalOcean Spaces | `https://<region>.digitaloceanspaces.com` | The public-read ACL, on by default: files are private otherwise. |
| Hetzner | `https://<location>.your-objectstorage.com` | Public bucket visibility, or the ACL setting. |
| Scaleway | `https://s3.<region>.scw.cloud` | The public-read ACL, on by default. |
| Akamai (Linode) | `https://<cluster>.linodeobjects.com` | The public-read ACL, on by default. |
| Google Cloud Storage | `https://storage.googleapis.com`, with HMAC keys | An `allUsers` reader on the bucket. Buckets with uniform bucket-level access refuse ACLs. |
| Custom (MinIO and others) | The endpoint you enter | An anonymous-read bucket policy. MinIO has no object ACLs. |

**Delivery domain.** A custom domain or CDN in front of the bucket. It's required on R2; elsewhere a public bucket can be served from its own address without one.

**Bucket names.** R2 and Hetzner allow lowercase letters, numbers and hyphens. The others allow dots too, and Google Cloud Storage also allows underscores; a bucket name with dots is always reached path-style, because the provider's TLS certificate doesn't cover it.

**Custom endpoints** take **Endpoint**. **Path-style requests** is on by default for them: MinIO and most self-hosted servers need it. The region is optional and defaults to `us-east-1`.

## Not offered

- **Wasabi:** new accounts can't make buckets public, and deleting a file within 90 days is billed for the rest of them.
- **Bunny Storage:** its S3 API is a preview on new storage zones only. The custom endpoint may work with it; it hasn't been tested.

Checked against ZealDen Safe Media Offload 1.0.3 on main, 19 October 2026.