# Connect Backblaze B2 to WordPress

To offload WordPress media to Backblaze B2, install Offloft, create a public bucket and an application key for that bucket, then copy the endpoint and keys into Offloft. The master key does not work with the S3 API. Offloft tests the connection and delivery before serving anything.

## 1. Create the bucket

Sign in to Backblaze, go to **B2 Cloud Storage > Buckets** and select **Create a Bucket**.

**Name:** unique across all of Backblaze, at least 6 characters, letters, numbers and hyphens.

**Files in Bucket:** choose **Public** so visitors can see your images (see the next steps).

After creating it, copy the **Endpoint** shown on the bucket (s3.<region>.backblazeb2.com). The part between "s3." and ".backblazeb2.com" is the region to enter in Offloft.

Bucket name:

```
my-site-media
```

## 2. Create an application key for this bucket

Go to **Application Keys** and select **Add a New Application Key**. The master application key does not work with the S3 API, so a new key is needed.

**Allow access to Bucket(s):** choose "my-site-media". **Type of Access:** choose **Read and Write**.

Select **Create New Key**. In Offloft, the **keyID** is the Access Key ID and the **applicationKey** is the Secret Access Key. *Backblaze shows the applicationKey only once.*

## 3. Let visitors read the files

Backblaze makes files readable per bucket, not per file. Open **Buckets**, select **Bucket Settings** on "my-site-media" and set **Files in Bucket** to **Public**.

If **Public** is not offered, Backblaze first asks you to verify your email address and to have a payment history on the account.

## 4. Serve files from your own domain through Cloudflare (optional)

Find your bucket's download host: open any file in the bucket and look at its **Friendly URL**, for example https://f004.backblazeb2.com/file/my-site-media/….

In Cloudflare DNS, add a CNAME record for media.yoursite.com pointing to that host (f00x.backblazeb2.com), with the proxy (orange cloud) on. Set **SSL/TLS** to **Full (strict)**.

Under **Rules**, create a **URL Rewrite Rule**: when the hostname equals media.yoursite.com, rewrite the path dynamically with the expression below, so visitors do not see /file/my-site-media in addresses.

In Offloft, use https://media.yoursite.com as the delivery address.

Rewrite expression:

```
concat("/file/my-site-media", http.request.uri.path)
```

Delivery address:

```
https://media.yoursite.com
```

## 5. Allow your site to read files (CORS) (optional)

This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

Open **Bucket Settings** on "my-site-media", go to **CORS Rules**, choose **Share everything in this bucket with one origin**, enter your site's address below and apply the rule to the **S3 Compatible API**.

Origin:

```
https://yoursite.com
```

## Permissions Offloft needs

An application key limited to this bucket, with Read and Write access. The master application key does not work with the S3 API.

## Serving your files

Backblaze makes files readable per bucket, so set Files in Bucket to Public. You can also serve files from your own domain through Cloudflare, which the guide covers. The delivery check loads a small test image from the address you enter.

## Questions

### Why can't I use my master application key?

The master application key does not work with the S3 API. Create a new key limited to this bucket.

### What if Public isn't offered for my bucket?

Backblaze first asks you to verify your email address and to have a payment history on the account.

### Which values go where in Offloft?

The keyID is the Access Key ID, and the applicationKey is the Secret Access Key.

Source: https://www.offloft.com/setup/backblaze-b2