[R2] Document read-only API tokens for Data Catalog

[Marcinthecloud]

Summary

Documents read-only API token support for R2 Data Catalog, now that read-only tokens are accepted for all accounts.

• Rewrote Authenticate your Iceberg engine to cover read-only vs. read-write tokens, when to use each, and added a read-only example Access Policy
• Added a note that vended credentials inherit the token's R2 storage permissions (scope storage to read-only for read-only data access)
• Clarified the R2 API tokens Considerations note: Admin Read only works for read operations, Admin Read & Write required for writes
• Updated the Data Catalog get-started guide to mention Admin Read only as an option for query-only clients
• Added a changelog entry

Documentation checklist

• Is there a changelog entry (guidelines)? If you don't add one for something awesome and new (however small) — how will our customers find out? Changelogs are automatically posted to RSS feeds, the Discord, and X.
• The change adheres to the documentation style guide.

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
/src/content/changelog/	@cloudflare/pm-changelogs, @cloudflare/product-owners
/src/content/docs/r2/	@oxyjun, @elithrar, @jonesphillip, @aninibread, @harshil1712, @helloimalastair, @cloudflare/workers-docs, @cloudflare/product-owners
/src/content/docs/r2/data-catalog/	@Marcinthecloud, @sejoker, @jonesphillip, @elithrar, @laplab, @vovacf201, @nagraham, @cloudflare/product-owners

[Marcinthecloud]

/review

[cloudflare-docs-bot]

Review

✅ No issues found in commit 88929bb.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

_{No code review issues found.}

Conventions

_{No convention issues found.}

Style Guide Review

_{No style-guide issues found.}

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.

[github-actions]

Preview URL: https://88929bb4.preview.developers.cloudflare.com
Preview Branch URL: https://r2-data-catalog-read-only-tokens.preview.developers.cloudflare.com

Files with changes (up to 15)

Original Link	Updated Link
https://developers.cloudflare.com/r2/data-catalog/manage-catalogs/	https://r2-data-catalog-read-only-tokens.preview.developers.cloudflare.com/r2/data-catalog/manage-catalogs/
https://developers.cloudflare.com/changelog/post/2026-07-09-r2-data-catalog-read-only-tokens/	https://r2-data-catalog-read-only-tokens.preview.developers.cloudflare.com/changelog/post/2026-07-09-r2-data-catalog-read-only-tokens/
https://developers.cloudflare.com/r2/api/tokens/	https://r2-data-catalog-read-only-tokens.preview.developers.cloudflare.com/r2/api/tokens/
https://developers.cloudflare.com/r2/data-catalog/get-started/	https://r2-data-catalog-read-only-tokens.preview.developers.cloudflare.com/r2/data-catalog/get-started/

[helloimalastair]

Approved for R2 Team