> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Browser and SDK access (CORS)

Browsers block a web page from calling another site's API unless that site allows the page's origin. This is called CORS. You only need it when **JavaScript running in a browser** talks to Zata directly — for example a web app that uploads files to a bucket.

## When you need CORS

| What you do                                                                                                                                        | CORS needed? |
| -------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ |
| S3 tools, the AWS CLI, or an SDK running on your server or computer                                                                                | No           |
| A plain link, `<img>` or `<video>` tag pointing at a public file or a presigned URL                                                                | No           |
| JavaScript in a web page calling Zata (`fetch`, `XMLHttpRequest`, the AWS SDK for JavaScript in the browser), including uploads to a presigned URL | Yes          |

## Ask for CORS

The Zata console has no CORS setting. The Zata team sets up CORS for you on request.

#### Collect the details

* The bucket names and their region (**Indore** or **Mumbai**).
* The exact origins of your web app, for example `https://app.example.com`. Wildcards such as `*` are only allowed after review.
* Whether you need read-only access (`GET`, `HEAD`) or also uploads and deletes (`PUT`, `POST`, `DELETE`).
* Any extra request headers your app sends, if they differ from the standard AWS SDK headers.

#### Open a support ticket

In the Zata console, select **Support** in the sidebar and send the details. See [Get support](/help/support).

## Keep keys out of the browser

Never put an access key or secret key in browser or mobile app code — anyone can read it there. Zata has no temporary credentials (no STS), so use one of these instead:

* **Presigned URLs** — your server signs a short-lived URL, and the browser uses it to download (`GET`) or upload (`PUT`) one file. For uploads, the browser must send the same `Content-Type` that was signed. See [Share a file](/buckets/share-a-file).
* **A sub-user key on your server** — your backend calls Zata with a [sub-user](/sub-users/overview) key that can only reach the buckets it needs.