Connect your asset storage

Choose your storage

In Add Project, fill in General and choose either Murit CMS storage (selected by default, no connection needed) or Bring Your Own Storage (BYOS). Click Next to review, optionally configure webhooks, SEO, language and time zone, then Create project and site key. You can change settings later in Project Settings.

Cloudflare R2 is our recommended BYOS starting point: its credentials work with our existing S3 connector, it offers recurring free usage, and direct delivery has no egress charge. Provider allowances belong to your cloud account, are shared with its other usage, and are separate from the 200 MB Murit CMS allowance.

Provider offers checked September 12, 2026. Billing activation may be required; usage beyond an allowance can incur provider charges. Check the linked terms before creating a bucket.

• Cloudflare R2: Standard storage includes 10 GB-month, 1 million Class A and 10 million Class B operations monthly. Direct egress is free. Infrequent Access is excluded.
• Google Cloud Storage: recurring 5 GB-month regional storage, 5,000 Class A and 50,000 Class B operations monthly in us-west1, us-central1 or us-east1. A billing account is required; transfer allowances have destination restrictions.
• Amazon S3 / AWS: eligible new customers receive $100 in credits and can earn up to $100 more. The Free Plan lasts up to six months or until credits run out. This is introductory credit, not a permanent free S3 bucket; older accounts have different terms.
• Azure Blob Storage: eligible new accounts receive 5 GB LRS hot block storage with limited operations for 12 months. Murit CMS does not currently have an Azure Blob connector.

Cloudflare R2 — recommended

Cloudflare R2 provides S3-compatible object storage with zero egress fees and a generous free allowance (10 GB storage, 1M Class A and 10M Class B operations each month). Follow this step-by-step walkthrough to create your bucket, configure public media delivery, and obtain your S3 credentials.

1. Activate R2 and create a bucket:
   • In the Cloudflare dashboard sidebar, go to Storage and Database → R2 Object Storage.
   • If you have not used R2 before, complete the $0 subscription setup. (Cloudflare requires a card on file for usage exceeding 10 GB, but charges $0 within the free allowance).
   • Click Create Bucket and give it a unique name (e.g. my-project-media).
   • Keep Location set to Automatic (recommended for optimal global latency, unless specific regional jurisdiction is legally required).
   • Keep Default Storage Class set to Standard. Do not choose Infrequent Access, as it charges retrieval fees when visitors load your website images.
   • Click Create Bucket.
2. Configure Public Media Access (Choose your scenario):

   Murit CMS needs a public URL so site visitors can view uploaded images. In your bucket, go to the Settings tab and choose one of the two options below:

   • Option A: Quick Testing & Development (Public Development URL):
     Best for testing, local development, or temporary preview environments (such as Vercel preview domains). Under Public Development URL, click Enable, type allow to confirm, and save. Copy the assigned URL (e.g. https://pub-<hash>.r2.dev). Note: r2.dev URLs are rate-limited and uncached; use a custom domain for production.
   • Option B: Live Production (Custom Domain — Recommended):
     Best for production websites. Provides full global Cloudflare CDN caching, DDoS protection, zero rate limits, and branded URLs. Under Custom Domains, click Connect Domain and enter a subdomain (e.g. assets.yourdomain.com or media.yourdomain.com). If your domain is on Cloudflare DNS, the CNAME record is configured automatically. If hosted on an external DNS provider, add the single CNAME record shown by Cloudflare.
3. Generate S3 API Credentials:
   • In the Cloudflare left sidebar, return to R2 Object Storage.
   • In the right-hand Account Details panel, click Manage API Tokens.
   • Click Create Account API Token.
   • Enter a descriptive Token Name (e.g. Murit-CMS-Media).
   • Under Permissions, select Object Read & Write. (This provides upload, read, and delete rights for media files without exposing account-level admin settings).
   • Under Bucket Access, select Apply to specific buckets only and choose your bucket (best security practice).
   • Leave TTL set to Forever so that token expiration does not disrupt CMS uploads.
   • Leave Client IP Address Filtering blank, as cloud/serverless platforms (like Vercel) use dynamic outbound IPs.
   • Click Create Account API Token.
   • Copy the S3 URL, Access Key ID, and Secret Access Key.
     Important: Do not use the bearer “Token Value”. Murit CMS connects via the standard S3 API and requires the Access Key ID and Secret Access Key.
4. Connect in Murit CMS:
   • In Murit CMS, open Add Project (or Project Settings).
   • Select Connect your own storage (BYOS) and choose Cloudflare R2 (Recommended).
   • Enter your Bucket Name and leave Region set to auto.
   • Paste the Cloudflare S3 URL into Endpoint URL (normally https://<account-id>.r2.cloudflarestorage.com).
   • Paste your Access Key ID and Secret Access Key.
   • In Public CDN / Custom Domain Base URL, paste your testing development URL (https://pub-<hash>.r2.dev) or your production custom domain (https://assets.yourdomain.com). Do not use the S3 API endpoint here.
   • Leave Force Path Style turned off (default).
5. Verify your connection:
   Save or create your project, go to the Media library, and upload a test image. Confirm the image uploads successfully and opens via your configured public base URL in a new browser tab.

Google Cloud Storage

Google Cloud Storage (GCS) provides enterprise-grade object storage with a permanent free tier (5 GB-months of Standard regional storage, 5,000 Class A upload operations, and 50,000 Class B read operations monthly in us-central1, us-east1, or us-west1). Follow this step-by-step walkthrough to set up your billing, create your bucket, configure public media delivery, generate service account credentials, and connect to Murit CMS.

1. Project & Billing Setup (Choose your starting point):
   • For New Google Cloud Users:
     Go to the Google Cloud Console. Google requires an active Cloud Billing account on file before buckets or storage APIs can be created, even for the free tier. Click Start Free Trial or go to Billing → Add Billing Account. Eligible new customers receive $300 in credits valid for 90 days. Google will never automatically charge after the trial without your explicit confirmation.
   • For Existing Google Cloud Users:
     Select your existing project from the top dropdown or click New Project (e.g. acme-cms-production). If the Create Bucket button appears disabled with the warning “Unable to create a bucket when billing is disabled”, open the left menu → Billing → Account Management, locate your project, click the three vertical dots (Actions) → Change billing, and link your active billing account.
   • Note your Project ID: Note down the exact project_id displayed in the project selector (e.g. beatbuckit or my-cms-project-425100). You will need this in Murit CMS.
2. Create and Configure your Storage Bucket:

   In the Google Cloud Console, open the navigation menu → Cloud Storage → Buckets, and click Create Bucket. Complete the 5-step wizard:

   • Step 1: Get started: Enter a globally unique bucket name (e.g. my-cms-media).
   • Step 2: Choose where to store your data: Choose Region (select us-central1, us-east1, or us-west1 to qualify for Google’s recurring 5 GB free tier, or select your local geographic region for minimum latency). Alternatively, select Multi-region if global redundancy is preferred.
   • Step 3: Choose how to store your data: Choose Set a default class → Standard. Important: Do not select Nearline, Coldline, or Archive, as these storage classes charge retrieval fees every time a visitor views your website images.
   • Step 4: Choose how to control access to objects (CRITICAL):
     Under Prevent public access, you must UNCHECK “Enforce public access prevention on this bucket”.
     Warning: Keeping this box checked blocks all public website visitors with a 403 Forbidden error.
     Under Access control, keep Uniform selected (recommended best practice).
   • Step 5: Choose how to protect object data: Keep Soft delete policy enabled (default 7 days retention protects against accidental deletion).
   • Click Create. If a confirmation modal appears regarding turning off public access prevention, click confirm.
3. Configure Public Read Access for Visitors:

   Murit CMS serves blog images to public website visitors. You must grant public read permissions to the bucket:

   • Click into your newly created bucket and open the Permissions tab.
   • Under the Public access summary, confirm that Public Access Prevention is not enforced. Click the blue Grant access (or + Add principal) button.
   • In New principals, type: allUsers
   • In Select a role, search for and select: Cloud Storage → Storage Object Viewer.
     Note: Storage Object Viewer grants read-only rights so visitors can load images. It does NOT permit anyone to upload, modify, or delete files.
   • Click Save.
   • When the prompt asks “Are you sure you want to make this resource public?”, click Allow Public Access.
   • The Public access badge will now update to: “Access granted to public principals”.
4. Create a Service Account & Download JSON Key:

   Murit CMS needs dedicated credentials to upload, organize, and delete media files:

   • Open the left navigation menu → IAM & Admin → Service Accounts.
   • Click + Create Service Account.
   • Enter a descriptive Service account name (e.g. murit-cms-storage). The Service account ID will auto-populate. Click Create and continue.
   • Granting Permissions (Handling Organization Restrictions):
     If your Google Cloud account permits project-level IAM, select role Cloud Storage → Storage Object Admin, click Continue, and click Done.
     If Step 2 displays the warning “You do not have permission to set policy on the project (resourcemanager.projects.setIamPolicy)”:simply click Done. Then, open Cloud Storage → Buckets → your bucket → Permissions tab, click Grant access, paste your service account email (murit-cms-storage@<project-id>.iam.gserviceaccount.com), and assign the role Storage Object Admin directly on the bucket. (Scoping to the specific bucket is safer and requires no organization-level IAM privileges).
   • Download Key: In the Service Accounts list, click your service account → open the Keys tab → click Add Key → Create new key. Select JSON and click Create. A .json credential file will automatically download to your computer.
5. Connect in Murit CMS:
   • Open your downloaded .json key file in any text editor (Notepad, VS Code).
   • In Murit CMS, open Add Project & Create Site Key (or go to Overview → Project Settings).
   • Select Connect your own storage (BYOS) and choose Google Cloud Storage.
   • Copy and paste the fields from your JSON file:
     • Bucket Name: Your bucket name (e.g. my-cms-media).
     • Project ID: The project_id string from the JSON (e.g. my-project-id).
     • Service Account Client Email: The client_email string from the JSON.
     • Service Account Private Key: The entire private_key string from the JSON, starting from -----BEGIN PRIVATE KEY----- through -----END PRIVATE KEY-----\n. Murit CMS automatically handles escaped newlines.
     • Public Domain / CDN URL: Enter https://storage.googleapis.com/<your-bucket-name> (or your custom Cloud CDN domain).
   • Click Create project and site key (or Save Changes).
6. Test and Verify Your Connection:
   • Automated Probe Test: In your project’s settings page, scroll down to the Connection, Storage & Background Delivery section and click Test Saved Storage. Murit CMS will immediately upload a transient JSON probe file, verify read/write access, and clean up the file, confirming:
     “Successfully verified connection to gcs storage!”
   • Live Media Verification: Go to Media in the sidebar, click Upload Media, and save an image. Open the image URL in an Incognito / Private browser tab to verify that it loads cleanly from https://storage.googleapis.com/... without any 403 Forbidden errors.

Amazon S3

1. Create a general purpose S3 bucket and note its AWS region. Use Standard storage for frequently accessed website assets.
2. Create a dedicated IAM user with an access key for this integration. Scope its policy to this bucket: s3:ListBucket on arn:aws:s3:::YOUR-BUCKET, and s3:GetObject, s3:PutObject, s3:DeleteObject on arn:aws:s3:::YOUR-BUCKET/*. See bucket-scoped IAM examples. Do not use root account credentials.
3. Provide public delivery through CloudFront with origin access to your bucket, or grant public GetObject access on a bucket dedicated to public assets. For the latter, review the relevant Block Public Access settings and follow AWS’s public read instructions. Do not grant public write access.
4. Select BYOS → Amazon S3. Enter Bucket Name, the actual Region (for example us-east-1), Access Key ID and Secret Access Key. Leave Endpoint URL blank and Force Path Style off.
5. Enter your CloudFront/custom domain as the public base URL, or use https://YOUR-BUCKET.s3.YOUR-REGION.amazonaws.com for direct public reads.

Other S3-compatible storage

Select Other S3-compatible storage / MinIO, then enter the bucket, provider region, HTTPS S3 endpoint, access key, secret and public asset base URL. Enable Force Path Style if required by that provider. The endpoint must be reachable from the CMS server; private/local network endpoints are restricted. Free allowances and compatibility depend on the provider; MinIO also requires hosting you manage.

Azure availability

Azure offers introductory Blob Storage usage, but its native API is not S3-compatible and cannot be connected through this form. Choose one of the supported providers above.

Check your connection

Create your project, upload a small image in Media, and open its public URL in a signed-out browser. Confirm the image loads on your frontend. Saving credentials alone does not test upload permissions or public delivery.

If uploads fail, check the bucket, region, endpoint and write permissions. If an upload succeeds but its URL returns 403, check public read/CDN access and the public base URL. Keep credentials in CMS storage settings; never put them in frontend code or public documentation.

Content Storage Sync is optional and off by default. It exports published content to the chosen bucket. Use a dedicated bucket for public assets and exports. BYOS removes the Murit CMS platform quota; your provider’s limits and billing still apply. Changing providers does not automatically migrate existing files: keep the previous bucket and URLs available until migration is complete.

You can monitor media capacity across all projects at any time using the interactiveWorkspace Storage meter bar at the top of the Overview console, or open the dedicated workspace storage console (/admin?view=storage) for project-by-project breakdowns and unmetered BYOS status tags.