> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# New keys for a sub-user

A sub-user gets one key pair in each of its regions automatically — when you [create it](/sub-users/create-a-sub-user) and when you [add a region](/sub-users/regions). By default it can have only **one key per region**, so you rarely create sub-user keys by hand.

You manage sub-user keys on the **Access Keys** page, under the **Sub-user Keys** tab. The buttons work the same way as for your own keys — see [Manage your keys](/access/access-keys#manage-your-keys).

## A key was lost or leaked

Rotate it. On the **Access Keys** page, find the sub-user's key and select **Rotate Key**. The old key stops working at once, and a file with the new access key and secret key downloads. Give the new key to the person or app that uses it.

To block a key for a while instead, select **Deactivate Key**. Select **Activate Key** to turn it back on.

## Create a new key

You only need this after you deleted the sub-user's key in a region.

#### Start

On the **Access Keys** page, select **Generate Key**.

#### Choose Sub User and the region

Select **Sub User**, choose the region under **Select Region**, and select **Continue**.

#### Choose the sub-user

Under **Select Sub User**, pick the sub-user, then select **Generate Key**. The key file downloads straight away.

This only works when the sub-user is in that region, has no key there yet, and is not suspended. You cannot delete a sub-user's last key — delete the sub-user instead.

## What the sub-user can do itself

A sub-user with dashboard access can see and **rotate** its own keys on its **Access Keys** page. You get a notification when it does. It cannot create, deactivate or delete keys. See [What sub-users see: Access keys](/sub-users/portal/access-keys).