> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Create a sub-user

Create a sub-user for each person or app that needs its own access. You can create up to 5 sub-users by default (see [Limits](/sub-users/overview#limits)).

#### Open Sub-user Management

In the sidebar, open **Subusers** and select **Create Subuser**.

![The Sub-user Management page with search filters, an empty sub-user list and the Create Subuser button](/_fern-img/c027c1aff98b50524ae5e4b01e30f5d486faaeb3d2b4237a968bfd132ac5e44e.webp)

#### Choose the access type

Under **Access Type**, choose:

* **Programmatic access only** — access keys for S3 tools and apps. No dashboard login, no email needed.
* **Programmatic + Dashboard access** — access keys plus a login to the sub-user dashboard. Needs an email address for the invitation.

See [Access types and permissions](/sub-users/access-types) for the difference. You can give a programmatic sub-user dashboard access later.

#### Enter a username

The username starts with a fixed prefix made from your account (for example `sub1a2b-`). Type the rest: letters, numbers, dot (`.`), underscore (`_`) and dash (`-`) only. The whole username can be up to 64 characters and must be unique across Zata.

#### Enter an email (dashboard access only)

For **Programmatic + Dashboard access**, enter the person's email address under **Email**. The invitation goes there.

#### Choose regions

Under **Regions**, tick **Mumbai**, **Indore** or both. The sub-user gets a separate key pair in each region, and can only be given buckets in its regions. You can [change regions](/sub-users/regions) later.

![The Create Subuser dialog with Access Type, Username with prefix, Email and Regions fields](/_fern-img/c68ae3678afc2ae3207762b87136828443c570c232a4724b1e9d95826152fe27.webp)

#### Create and save the keys

Select **Create Subuser**. A credentials file downloads automatically, and the dialog changes to **Subuser Created**, showing the access key and secret key for each region. Select **Download Again** if you need another copy, then **Done**.

> **Warning**
>
> Save the credentials file now. Zata never shows the secret keys again. If a secret key is lost, [rotate that key](/access/access-keys#rotate-a-key).

The credentials file contains the sign-in URL, the username, and for each region the service URL (`https://idr01.zata.ai` or `https://bom01.zata.ai`), access key and secret key.

## After you create it

The new sub-user appears in the **Sub-user Management** list.

![A new sub-user in the list with its regions, status Suspended and an Invite pending badge](/_fern-img/c1cb75c35773c32dec18ce6d2e177f1f32f94baa21eded293eb41785c29e3067.webp)

* A **Programmatic access only** sub-user is **Active** straight away. Its keys work at once.
* A **Programmatic + Dashboard access** sub-user gets an invitation email and shows **Suspended** with **Invite pending** until it accepts. Until then, its keys do not work either. See [Invitations](/sub-users/invitations).

Either way, the sub-user cannot reach any bucket yet. Next, [assign a bucket](/sub-users/assign-a-bucket).

If you see "Subuser limit reached", delete a sub-user you no longer need or [contact support](/help/support).