Mini bosses
Hand someone exactly the folder they work in, on Cloudflare R2 or any SFTP server, with R2 Bucket Boss.
Share exactly the folder they need
A mini boss is a limited-access configuration you export from R2 Bucket Boss and send to a client, a contractor or a teammate. It opens straight into one folder on your SFTP server or Cloudflare R2 bucket, and keeps them there.
Inside that folder they can browse, preview, upload, rename, move, duplicate and delete files and folders. They can't navigate above it, so there's no need to walk them through the rest of your server or explain which folders to leave alone.
Export a folder as a mini boss
Choose the folder
In R2 Bucket Boss, right-click a folder on Mac, or long-press it on iPhone or iPad, and choose Export as Mini Boss (Limited Access)…
Already inside the folder? Use Export This Folder as Mini Boss (Limited Access)… instead: right-click empty space on Mac, or open the … menu on iPhone or iPad.
Export the limited-access configuration
In the Export Mini Boss sheet, give it a name and a passphrase, then export. You get a .r2bb file: a limited-access configuration for just that folder.
Send it
Send the file to the person, and send the passphrase separately.
They're in
They open the file in R2 Bucket Boss on Mac, iPhone or iPad, and the session opens straight into that folder. Mini boss servers show a lock icon and "Limited to" plus the folder name in the server list.
Keeping it secure
R2 Bucket Boss keeps the recipient inside the folder you shared. For full isolation, enforced by Cloudflare or your server rather than just the app, give the mini boss its own credentials:
- Cloudflare R2: your account API token is never included in a mini boss. When exporting, you can paste R2 keys scoped to just that bucket, so Cloudflare itself keeps the mini boss out of your other buckets, even outside the app. Otherwise it shares the server's current R2 keys. To create scoped keys, go to R2 → Manage API Tokens → Create API token in the Cloudflare dashboard, choose Object Read & Write, and select Apply to specific buckets only.
- SFTP: a mini boss includes the server's login. For full isolation, create a separate SFTP login on the server that can only reach that folder.
To revoke access, delete the scoped R2 token in the Cloudflare dashboard, or remove the SFTP login on the server.
Open Manage R2 API Tokens →Good to know
- Mini bosses work with both SFTP servers and Cloudflare R2.
- Creating a mini boss requires R2BB Pro. Opening one doesn't: as with all of R2 Bucket Boss, browsing and previewing are free, and making changes needs Pro.
- Mini bosses arrive in R2 Bucket Boss 1.1, coming soon.