I think you can achieve that with an HMAC filter on the CDN part, it is functionally the same as presigned URLS : https://developers.cloudflare.com/support/firewall/learn-more/configuring-token-authentication/ That HMAC filter is only available on Cloudflare Pro thought. 20$ can get you 65 million presigned GET requests a month (55 millions + 10 free), so unless you need anything else in the pro plan, you're better off serving presigned requests directly from R2 with presigned requests. I'm not aware of anything that would prevent that.