[bozsikarmand]

Summary

Surfaces the single most-missed detail when switching from dashboard-created R2 tokens to API-created ones: the S3 Secret Access Key is the SHA-256 hex digest of the API token value, not the raw value.

• Adds a warning at the top of the "Create API tokens via API" section with the derivation and the exact failure mode.
• Bolds the derivation bullets in "Get S3 API credentials from an API token" and adds the canonical symptom (The request signature we calculated does not match...) so the error connects to the cause.
• Documents that the same derivation applies to token rolls (PUT /tokens/{token_id}/value) and that the Access Key ID is stable, making roll-based rotation atomic for S3 consumers.

Why

Verified end-to-end against a live R2 bucket while building an automated rotation flow: API-created tokens authenticate against the Cloudflare API but every S3 request fails with the signature error when the raw token value is used as the secret. The error reads like a permissions problem, so the miss costs a long debugging session. The information exists in the last bullets of this page but is skipped by everyone arriving from dashboard-created tokens.

Docs only, no behavior changes.

[cloudflare-docs-bot]

AI Review

✅ Reviewed acc0d62 · 2 findings · incremental

👉 Fix in your agent 👈

Fix the following review findings in PR #33978 (https://github.com/cloudflare/cloudflare-docs/pull/33978).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification.
- If you disagree, explain why.
- If you need clarification before deciding, ask those questions.
- Then share your plan for which issues to tackle and in what order.

After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.

The comment must come before the commit because the next review reads PR comments.

## Style Guide
- S-1966d154 | src/content/docs/r2/api/tokens.mdx:78 | Invalid admonition type `warning`
  The admonition opens with `:::warning`, but the style guide allows only `:::note`, `:::caution`, and `:::tip` as valid admonition types.
- S-0b58054e | src/content/docs/r2/api/tokens.mdx:80 | Directional word `below`
  The prose contains the directional word `below`; per the style guide, directional words should be replaced with a direct reference by name or link (the link itself is already present).

Style Guide

• src/content/docs/r2/api/tokens.mdx:78 · Invalid admonition type warning

  The admonition opens with :::warning, but the style guide allows only :::note, :::caution, and :::tip as valid admonition types.

• src/content/docs/r2/api/tokens.mdx:80 · Directional word below

  The prose contains the directional word below; per the style guide, directional words should be replaced with a direct reference by name or link (the link itself is already present).

Commands

• /review Run a review now.
• /full-review Review the entire PR diff.
• /disable-auto-review Stop automatic reviews.
• /rebase Rebase against production.

[cloudflare-docs-bot]

Review coverage

🟡 1 ownership area needs approval.

Suggested reviewers: @helloimalastair @vy-ton

Needs approval	Eligible approvers	Suggested
r2	@helloimalastair, @rdimaio, @vy-ton, @cloudflare/product-owners	helloimalastair, vy-ton

CODEOWNERS mappings for displayed areas (1)

Pattern	Owners
/src/content/docs/r2/	@helloimalastair, @rdimaio, @vy-ton, @cloudflare/product-owners

[helloimalastair]

authenticates the request but fails signature validation

This wording is a bit confusing. While I do get your intention here, I think this could be reworded a tad.