> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Access keys

An access key is the username and password your S3 tools and apps use to connect to Zata. It has two parts: the **access key** (public ID) and the **secret key** (keep it private). You manage keys for yourself and for your [sub-users](/sub-users/overview) on the **Access Keys** page of the Zata console.

> **Warning**
>
> Each key works in one region only. A key made for **Indore** does not work on the Mumbai endpoint, and the other way round. Use a key from the same region as your bucket.

| Region               | Endpoint                |
| -------------------- | ----------------------- |
| **Indore** (`idr01`) | `https://idr01.zata.ai` |
| **Mumbai** (`bom01`) | `https://bom01.zata.ai` |

## The Access Keys page

Open **Access Keys** in the sidebar. The page shows how many keys you have (**Total Keys**, **Root Keys**, **Sub-user Keys**) and a list of all keys in both regions. Use the **All Keys**, **Root Keys** and **Sub-user Keys** tabs to filter the list.

![The Access Keys page with key counts, filter tabs and a list of root and sub-user keys with their region, type and status](/_fern-img/9e8b058ba8c0028b07a98c9c9d6cc501b738cd98d8ffc5bc1cb78c7da5ac4dd1.webp)

* **Root** keys belong to you, the account owner. They can do everything in your account.
* **Sub** keys belong to a sub-user. They can only do what you allowed that sub-user to do.

## Create a key

The steps depend on who the key is for. Pick the tab that fits.

#### Key for yourself (Root User)

#### Open the dialog

On the **Access Keys** page, select **Generate Key**.

#### Choose Root User and the region

Select **Root User**. Under **Select Region**, choose **Indore** or **Mumbai**, then select **Continue**.

![The Create Access Key dialog with Root User selected and the region set to Indore](/_fern-img/cce8a66f45b31fafd8114d1523bfcc0f87bf534ebbd17f55f28e24d20a06e25e.webp)

#### Generate the key

The **Important Note** window opens. Select **Generate Key**. A `.txt` key file downloads straight away. It contains the service URL, the access key, the secret key and the region.

![The Important Note window with the Back and Generate Key buttons](/_fern-img/32a315c9b82aa6e86b9406a150120d685e2b806c1cba2e5aba55913a8b12cb06.webp)

#### Key for a sub-user (Sub User)

#### Open the dialog

On the **Access Keys** page, select **Generate Key**.

#### Choose Sub User and the region

Select **Sub User**. Under **Select Region**, choose the region the key is for, then select **Continue**.

![The Create Access Key dialog with Sub User selected and the region set to Indore](/_fern-img/5596795f532afbb9182ff79b37ffbf0f8dc97ece967fe46c9b766c092e27e6d1.webp)

#### Choose the sub-user

The **Important Note** window opens with a **Select Sub User** list. This list appears only when you chose **Sub User**. Pick the sub-user. **Generate Key** stays greyed out until you do.

![The Important Note window with the Select Sub User list open](/_fern-img/b5fa5caf9a71d103e4f3abb61a7bf7cb6218775a3b8c114a0e2c3fac21fc134e.webp)

#### Generate the key

Select **Generate Key**. A `.txt` key file downloads straight away. It contains the service URL, the access key, the secret key and the region. Give this file to the sub-user.

> **Warning**
>
> The secret key is only in that file. Zata cannot show it again. Store the file somewhere safe. If you lose it, [rotate the key](#rotate-a-key) to get a new pair.

## Key limits

| Key owner       | Keys per region |
| --------------- | --------------- |
| You (root keys) | 2               |
| Each sub-user   | 1               |

These are the default limits. If you hit one, you see a "key limit reached" message. Delete a key you no longer use, or [contact support](/help/support) if you need more.

A sub-user already gets one key in each of its regions when you create it, so you normally only create a sub-user key after deleting one. See [New keys for a sub-user](/sub-users/access-keys).

## Manage your keys

Each key has three buttons in the **Actions** column:

| Button                                             | What it does                                                                                                                                                |
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Deactivate Key** / **Activate Key** (power icon) | Turns the key off for now, or back on. A deactivated key stops working but is not deleted.                                                                  |
| **Rotate Key**                                     | Replaces the key with a new access key and secret key. The old pair stops working at once, and a new key file downloads. Update your apps with the new key. |
| **Delete Key**                                     | Removes the key for good. Apps using it stop working. This cannot be undone.                                                                                |

### Rotate a key

Select **Rotate Key** on the key's row, read the warning and select **Rotate Key** again. Only an active key can be rotated — activate it first if it is off.

### What the console stops you from doing

So that you never lock yourself out, some buttons are greyed out:

* You must keep **at least one active root key in each region**. You cannot deactivate, rotate or delete the only active root key in a region. To replace it, create a second root key in that region first, switch your apps over, then delete the old one.
* You cannot delete a sub-user's **last** key. Delete the [sub-user](/sub-users/delete-a-sub-user) instead.
* You cannot create a key for a **suspended** sub-user, or rotate a key in a region where the sub-user is suspended. [Reactivate](/sub-users/suspend-and-reactivate) it first.

## Keep your keys safe

* Never share your secret key or put it in public code, a web page or a mobile app.
* Give each person or app its own [sub-user](/sub-users/overview) with only the access it needs, instead of sharing your root key. Zata has no temporary credentials (STS or IAM roles).
* Rotate keys from time to time, and delete keys you no longer use.

## Next steps

* [Endpoints and regions](/get-started/endpoints-and-regions)
* [Connect your tools](/connect/overview)