Summary
Cloudflare's R2 Data Catalog now accepts Admin Read-only API tokens for read operations, so clients and agents can query Iceberg catalog data without being granted Admin Read & Write access.
What changed
On 2026-07-09 Cloudflare enabled read-only API tokens for R2 Data Catalog: read operations now work with Admin Read-only tokens instead of requiring Admin Read & Write.
Why it matters
Least-privilege access was missing for R2's Iceberg catalog. Read-only tokens let teams hand query access to analysts, downstream services, or agents without exposing write capability, reducing blast radius as more automated consumers read from data lakes.
Evidence excerpt
R2 Data Catalog now supports read-only API tokens: read-only operations now accept Admin Read-only tokens instead of requiring Admin Read & Write access.