> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# About sub-users

A sub-user is an extra login under your Zata account, for a team member, a customer or an app. It gets its own access keys, and it can only use the buckets and actions you give it. You never have to share your own keys, and you can suspend or delete a sub-user at any time. You manage sub-users under **Subusers** in the Zata console.

## How it works

1. **[Create the sub-user](/sub-users/create-a-sub-user)** and choose its [access type](/sub-users/access-types) and regions. Zata gives it one key pair per region.
2. **[Assign buckets](/sub-users/assign-a-bucket)**. A new sub-user can reach nothing until you do this. Choose a permission level such as **View Only** or **Full Access**, for the whole bucket or one folder.
3. The sub-user connects with its keys in any S3 tool. A sub-user with dashboard access can also [sign in to its own dashboard](/sub-users/portal/overview).

## What a sub-user can and cannot do

A sub-user can only do what you allowed on each bucket. On top of that, some things are always for the account owner only:

| A sub-user cannot…                           | Notes                                                                                                    |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| Create or delete buckets                     | Creating a bucket returns `AccessDenied`.                                                                |
| See a list of its buckets with S3 tools      | Listing all buckets returns an empty list, even when it has access. Open the bucket by its name instead. |
| Make a bucket or file public, or change ACLs | Not grantable to sub-users.                                                                              |
| Change versioning, bucket tags or file tags  | **Change versioning**, **Manage bucket tags** and **Add/edit file tags** cannot be given to sub-users.   |
| Read or change bucket policies               | Only you manage policies. A sub-user can [request more permissions](/sub-users/policies).                |
| Create, deactivate or delete keys            | It can [rotate](/sub-users/portal/access-keys) its own key from its dashboard.                           |
| Add regions, invite others or see billing    | Owner only.                                                                                              |

> **Tip**
>
> In S3 tools, type the bucket name in the path or bucket field instead of browsing the bucket list. In rclone, also set `no_check_bucket = true`. For an example, see [S3 Browser with a sub-user key](/connect/desktop-apps/s3-browser-sub-user).

## Limits

| Limit                          | Default      |
| ------------------------------ | ------------ |
| Sub-users per account          | 5            |
| Access keys per sub-user       | 1 per region |
| Invitation emails per sub-user | 3            |

When you reach the sub-user limit, delete a sub-user you no longer need, or [contact support](/help/support) to ask for more.

> **Note**
>
> If your own account is suspended (for example for billing), all your sub-users are suspended too. See [Suspend and reactivate](/sub-users/suspend-and-reactivate).

## In this section

#### [Create a sub-user](/sub-users/create-a-sub-user)

Choose the access type, username and regions.

#### [Access types and permissions](/sub-users/access-types)

Keys only or keys plus dashboard, and what each permission level allows.

#### [Assign a bucket](/sub-users/assign-a-bucket)

Give a sub-user access to a bucket or folder.

#### [Policies and requests](/sub-users/policies)

Pick single actions and handle requests for more access.

#### [Invitations](/sub-users/invitations)

How dashboard sub-users set their password and sign in.

#### [What sub-users see](/sub-users/portal/overview)

The sub-user's own dashboard.