Backblaze B2 and the S3 Compatible API on Cloudflare

A compatible API for object storage

Backblaze B2 Cloud Storage now supports Amazon’s S3 API, which brings the storage provider’s low-cost model to a far broader range of existing applications. For Cloudflare customers, the move also strengthens the case for using a Bandwidth Alliance partner, since data movement from B2 to Cloudflare’s network eliminates first-mile transfer fees.

Here is why that matters and a look at how to point an S3-based Cloudflare Worker at Backblaze B2.

Why the S3 API became the default

Before cloud storage matured, hosting content meant building and maintaining your own storage infrastructure. Amazon S3 changed that in 2006 by offering scalable, pay-as-you-go object storage. But it came with a proprietary interface—there was no WebDAV or FTP-style standard to plug into. Applications had to speak S3.

Fifteen years later, S3 has effectively become the standard HTTP file storage API. Developers have built it into codebases and internal tooling so deeply that switching storage providers means not just migrating bytes but rewriting application logic. That engineering cost is often significant enough to discourage moving to a more economical provider. As a result, many storage vendors have natively adopted S3 compatibility to remove that barrier. Backblaze’s new support fits that pattern.

The first-mile bandwidth problem

Content delivery networks have commoditized the last mile—getting cached content to end users over cheap, peered connections. The less-discussed cost is the first mile: moving data from its origin storage into the CDN. Most storage providers route that traffic over the public internet and bill per gigabyte egressed.

Cloudflare and many storage providers, including Backblaze, share data center facilities and mutual interconnect capacity. Those shared fibre connections make it possible to waive first-mile charges, which is the basis of the Bandwidth Alliance. For media companies constantly pushing new user-generated content into the CDN, eliminating that egress bill can be a deciding factor in provider choice.

S3-compatible Workers in practice

Developers often connect Cloudflare’s network directly to a storage provider, serving video and other content without an intermediate web server. For security, each uncached request needs to be signed using the S3 API. Cloudflare Workers is a way to run that signing logic at the edge.

The Cloudflare Solutions Engineering team has tested Backblaze B2 with a Worker that was originally written for Amazon S3. It works by changing only the target endpoint—no code changes are required.

A minimal setup starts with a Wrangler project template intended for S3:

wrangler generate <projectname> https://github.com/obezuk/worker-signed-s3-template

The template relies on aws4fetch, a lightweight S3 signing library that runs in Service Worker environments. The generated index.js contains a standard request signing implementation:

import { AwsClient } from 'aws4fetch'

const aws = new AwsClient({
    "accessKeyId": AWS_ACCESS_KEY_ID,
    "secretAccessKey": AWS_SECRET_ACCESS_KEY,
    "region": AWS_DEFAULT_REGION
});

addEventListener('fetch', function(event) {
    event.respondWith(handleRequest(event.request))
});

async function handleRequest(request) {
    var url = new URL(request.url);
    url.hostname = AWS_S3_BUCKET;
    var signedRequest = await aws.sign(url);
    return await fetch(signedRequest, { "cf": { "cacheEverything": true } });
}

Configuration notes

The wrangler.toml file should point to Backblaze B2 credentials and the correct bucket endpoint:

[env.dev]
vars = { AWS_ACCESS_KEY_ID = "<BACKBLAZE B2 keyId>", 
AWS_SECRET_ACCESS_KEY = "<BACKBLAZE B2 secret>", 
AWS_DEFAULT_REGION = "", 
AWS_S3_BUCKET = "<BACKBLAZE B2 bucketName>.<BACKBLAZE B2 S3 Endpoint>"}

Set AWS_S3_BUCKET to the bucket name, a period and the S3 endpoint address. For a bucket named example-bucket and endpoint s3.us-west-002.backblazeb2.com, use example-bucket.s3.us-west-002.backblazeb2.com.

AWS_DEFAULT_REGION is extracted from the endpoint: here, us-west-002. For production use, store AWS_SECRET_ACCESS_KEY with Wrangler’s Secret Environment variables rather than in plain configuration.

Testing the Worker

Running wrangler preview --env dev opens a preview window for the Worker. In a test case with a B2 bucket containing adaptive streaming video for a static site, the Worker signed private requests correctly and served the content through Cloudflare.

Note: Cloudflare permits caching of third party video content only for enterprise domains. Free, Pro and Biz plans wanting to serve video may use Stream instead.

Backblaze B2’s S3 compatibility removes the last major obstacle to switching from Amazon S3 to a Bandwidth Alliance provider: existing applications and stored data can move with minimal engineering effort. Backblaze is additionally offering to cover migration costs for data transfers from S3 to B2. With first-mile fees off the table for eligible customers, the change makes it easier to cut storage bills without sacrificing compatibility.