# Backblaze B2

Backblaze B2 is S3-compatible, so it can be used as a storage driver for uploaded images, videos, avatars, covers, and other user assets.

In the admin panel, select **Backblaze B2** under `Admin > Settings > Storage > Driver`.

## Create the bucket

1. Sign in to [Backblaze](https://secure.backblaze.com/user_signin.htm) and make sure B2 Cloud Storage is enabled on your account.
2. Go to `B2 Cloud Storage > Buckets` and create a new bucket.
3. Set the bucket type to **Public** if uploaded files should be served directly by the site or through a CDN.
4. After the bucket is created, open its details and copy the S3 endpoint. It looks like: `https://s3.us-east-005.backblazeb2.com`.

## Create an application key

1. Go to `B2 Cloud Storage > Application Keys`.
2. Create a new key. You can allow access to all buckets, or restrict it to the bucket you created for the site.
3. If you restrict the key to one bucket, enable **Allow List All Bucket Names**. This helps S3-compatible tools and the storage validation check list the bucket correctly.
4. Copy the `keyID` and `applicationKey`. The application key is shown only once.

## Fill in the admin settings

In `Admin > Settings > Storage`, select **Backblaze B2** and fill in:

- `Application key ID`: the Backblaze `keyID`.
- `Application key`: the Backblaze `applicationKey`.
- `Bucket name`: your B2 bucket name.
- `Region`: the region from the endpoint, for example `us-east-005`.
- `Endpoint URL`: the full S3 endpoint, for example `https://s3.us-east-005.backblazeb2.com`.
- `Custom URL`: optional. Use this only if you serve the bucket through a CDN or custom domain, for example `https://media.yourdomain.com`.

## Allow your site in CORS rules

Backblaze B2 also needs a CORS rule for your website domain. Without it, public files may upload correctly, but admin previews, file manager assets, or browser-based asset requests can fail because the browser blocks cross-origin access.

1. In Backblaze, open your bucket and click **CORS Rules**.
2. Choose **Share everything in this bucket with this one origin**.
3. Enter your site origin, for example `https://yourdomain.com`. Use only the scheme and domain, without a path.
4. If your admin panel is served from a different subdomain, add that origin too. For example, add `https://admin.yourdomain.com` if the public site and admin panel do not share the same origin.
5. If you are using a CDN or custom storage URL, make sure the CDN/custom domain is also allowed wherever your setup requires browser access.

<Info>
**Notes:**

• Backblaze B2 controls public access at the bucket level. If the bucket is private, public media URLs will not load unless you put a signed/CDN layer in front of it.<br />
• For CDN delivery, Backblaze commonly supports Cloudflare and Fastly in front of B2. Add the CDN/custom domain to `Custom URL` only after it is working.<br />
• The endpoint should not include the bucket name. Use `https://s3.<region>.backblazeb2.com`.<br />
• CORS changes can take a short time to apply. If admin previews still fail, wait a minute and refresh the admin page.
</Info>