Basin Catalog, Basin, R2 - R2 Data Catalog now supports read-only API tokens

<p><a href="https://developers.cloudflare.com/basin-catalog/">R2 Data Catalog</a> now accepts read-only API tokens, so query engines and clients that only read data no longer need a read-write token. Previously, every catalog operation required an <strong>Admin Read &amp; Write</strong> token, which granted read-only clients more access than they needed.</p> <p>You can now authenticate your Iceberg engine based on your workload:</p> <ul> <li><strong>Read-only</strong> operations (such as listing namespaces, loading tables, and querying data) work with an <strong>Admin Read only</strong> token (R2 Data Catalog read and R2 storage read).</li> <li><strong>Write</strong> operations (such as creating or dropping tables and committing transactions) continue to require an <strong>Admin Read &amp; Write</strong> token.</li> </ul> <p>This lets you follow the principle of least privilege — for example, using a read-write token for the pipeline that writes to your tables and read-only tokens for engines like <a href="https://developers.cloudflare.com/basin-sql/">R2 SQL</a>, <a href="https://developers.cloudflare.com/basin-catalog/config-examples/duckdb/">DuckDB</a>, or <a href="https://developers.cloudflare.com/basin-catalog/config-examples/pyiceberg/">PyIceberg</a> that query them.</p> <p>Note that credentials vended by the catalog inherit the R2 storage permissions of the token used to authenticate. To ensure read-only access to your underlying data, scope the R2 storage permission to read-only as well.</p> <p>For details on choosing and creating the right token, refer to <a href="https://developers.cloudflare.com/basin-catalog/manage-catalogs/#authenticate-your-iceberg-engine">Authenticate your Iceberg engine</a>.</p>