> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# S3 Browser with a sub-user key

A sub-user's key only works on the buckets the account owner assigned to it. S3 Browser normally lists your buckets, but for a sub-user that list is always empty. So you connect as usual and then add the bucket by its exact name.

## Before you start

* **The sub-user's credentials file.** Zata downloads it when the owner creates the sub-user or adds a region to it. For each region it lists the **Service URL**, **Access Key** and **Secret Key**. The secret key cannot be shown again — if the file is lost, the owner makes a new key, see [New keys for a sub-user](/sub-users/access-keys).
* **The exact name of a bucket assigned to the sub-user.** The owner sees it in the Zata console under **Subusers**, in the **Assigned Buckets** column. To give access, see [Assign a bucket](/sub-users/assign-a-bucket).
* S3 Browser installed — [download S3 Browser](https://s3browser.com/download.aspx).

![The Subusers page in the Zata console, showing a sub-user with one bucket in the Assigned Buckets column](/_fern-img/3fb9fd2978aecc9636672358eb907fa4031cbda67bb1ab6d6d387ef3a37a2511.webp)

> **Note**
>
> A sub-user has a separate key for each region. Use the key and Service URL of the region the bucket is in — an Indore key does not work on the Mumbai endpoint, and the other way round.

## Connection settings

| Setting                                                  | Value                                                                                                               |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Account type                                             | **S3 Compatible Storage**                                                                                           |
| REST Endpoint                                            | the **Service URL** from the credentials file: `https://idr01.zata.ai` (Indore) or `https://bom01.zata.ai` (Mumbai) |
| Access Key ID / Secret Access Key                        | the **Access Key** and **Secret Key** from the credentials file, for the bucket's region                            |
| Use secure transfer (SSL/TLS)                            | On                                                                                                                  |
| Signature version / Addressing model (advanced settings) | **Signature V4** / **Path style**                                                                                   |

## Set up S3 Browser

#### Add an account

Open S3 Browser and select **Accounts** → **Add new account**.

![The Accounts menu in S3 Browser with Add new account](/_fern-img/76d1e633d84982920fe80d54b970ab17d08f6b750b5edbbe2e36b04f57c5dde2.webp)

#### Enter the sub-user's key

Enter a **Display name**, set **Account type** to **S3 Compatible Storage**, and enter the REST Endpoint and the sub-user's keys. Keep **Use secure transfer (SSL/TLS)** ticked. Under **advanced settings**, choose **Signature V4** and **Path style** (screenshot on the [S3 Browser](/connect/desktop-apps/s3-browser) page). Then select **Add new account**.

![Add New Account form filled in with a sub-user's key and the endpoint https://idr01.zata.ai](/_fern-img/6703115bb181acdd790c0afc94390d92ce43cf88a5fa484e176bbedd8586f06d.webp)

The bucket list stays empty. That is normal for a sub-user.

#### Add the bucket by name

Select **Add external bucket** above the bucket list. Enter the exact bucket name and select **Add External bucket**.

If the owner gave you access to one folder only, enter the bucket name and the folder, for example `my-bucket/reports/`.

![The Add External Bucket dialog with a bucket name entered](/_fern-img/183796efbd554623c3845a040cfb05af19e9c42d8a2293fbef3c9ada6b22e238.webp)

#### Open the bucket

The bucket now appears in the list. Select it to see its files.

![The added bucket selected in S3 Browser, with its files listed on the right](/_fern-img/f9b823733e0f1e94808da102ed74bd02733b4f803816c7e024135538c7d74166.webp)

## What the sub-user can do

The owner sets one of these permissions for each bucket (or folder):

| Permission    | What works in S3 Browser                                                               |
| ------------- | -------------------------------------------------------------------------------------- |
| View Only     | Browse and download files                                                              |
| Upload Only   | Upload new files only. Listing the bucket is denied, so you cannot browse or download. |
| View & Upload | Browse, download and upload. No delete.                                                |
| Full Access   | Browse, download, upload and delete. Renaming or moving needs this level too.          |

Sub-users cannot create buckets — **New bucket** always gives Access Denied. Ask the account owner to create the bucket and assign it to you.

## Troubleshooting

| Problem                                      | Fix                                                                                                                                                                                                                                                      |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The bucket list is empty                     | Normal for sub-users. Add the bucket with **Add external bucket**.                                                                                                                                                                                       |
| Access Denied when you open the bucket       | Check the bucket name (exact, lowercase). Check with the owner that the bucket is assigned to this sub-user and that the permission includes listing — **Upload Only** does not. If access is limited to a folder, add `my-bucket/folder-name/` instead. |
| `InvalidAccessKeyId` or the connection fails | The key is from the other region. Use the key and Service URL for the bucket's region.                                                                                                                                                                   |
| Invalid credentials                          | Copy the keys again from the credentials file, without extra spaces.                                                                                                                                                                                     |

See also [Access denied](/help/troubleshooting/access-denied) and [Sub-users overview](/sub-users/overview).