---
title: R2 Data Catalog now supports read-only API tokens
description: Connect query engines to R2 Data Catalog using read-only API tokens
image: https://edgetunnel-b2h.pages.dev/changelog-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

[ ← Back to all posts ](https://edgetunnel-b2h.pages.dev/changelog/) 

## R2 Data Catalog now supports read-only API tokens

Jul 13, 2026 

[ R2 ](https://edgetunnel-b2h.pages.dev/r2/) 

[R2 Data Catalog](https://edgetunnel-b2h.pages.dev/r2/data-catalog/) now accepts read-only API tokens, so query engines and clients that only read data no longer need a read-write token. Previously, every catalog operation required an **Admin Read & Write** token, which meant read-only clients were granted more access than they needed.

You can now authenticate your Iceberg engine based on your workload:

* **Read-only** operations (such as listing namespaces, loading tables, and querying data) work with an **Admin Read only** token (R2 Data Catalog read and R2 storage read).
* **Write** operations (such as creating or dropping tables and committing transactions) continue to require an **Admin Read & Write** token.

This lets you follow the principle of least privilege — for example, using a read-write token for the pipeline that writes to your tables and read-only tokens for engines like [R2 SQL](https://edgetunnel-b2h.pages.dev/r2-sql/), [DuckDB](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/duckdb/), or [PyIceberg](https://edgetunnel-b2h.pages.dev/r2/data-catalog/config-examples/pyiceberg/) that query them.

Note that credentials vended by the catalog inherit the R2 storage permissions of the token used to authenticate. To ensure read-only access to your underlying data, scope the R2 storage permission to read-only as well.

For details on choosing and creating the right token, refer to [Authenticate your Iceberg engine](https://edgetunnel-b2h.pages.dev/r2/data-catalog/manage-catalogs/#authenticate-your-iceberg-engine).

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-09-r2-data-catalog-read-only-tokens/#page","headline":"R2 Data Catalog now supports read-only API tokens · Changelog","description":"Connect query engines to R2 Data Catalog using read-only API tokens","url":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-09-r2-data-catalog-read-only-tokens/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/changelog-preview.png","dateModified":"2026-07-13","datePublished":"2026-07-13","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```