Skip to main content
Access and security

Access keys

Create, rotate, deactivate and delete the keys your apps use to connect.

An access key is the username and password your S3 tools and apps use to connect to Zata. It has two parts: the access key (public ID) and the secret key (keep it private). You manage keys for yourself and for your sub-users on the Access Keys page of the Zata console.

Each key works in one region only. A key made for Indore does not work on the Mumbai endpoint, and the other way round. Use a key from the same region as your bucket.

RegionEndpoint
Indore (idr01)https://idr01.zata.ai
Mumbai (bom01)https://bom01.zata.ai

The Access Keys page​

Open Access Keys in the sidebar. The page shows how many keys you have (Total Keys, Root Keys, Sub-user Keys) and a list of all keys in both regions. Use the All Keys, Root Keys and Sub-user Keys tabs to filter the list.

The Access Keys page with key counts, filter tabs and a list of root and sub-user keys with their region, type and status
  • Root keys belong to you, the account owner. They can do everything in your account.
  • Sub keys belong to a sub-user. They can only do what you allowed that sub-user to do.

Create a key​

The steps depend on who the key is for. Pick the tab that fits.

Open the dialog

On the Access Keys page, select Generate Key.

Choose Root User and the region

Select Root User. Under Select Region, choose Indore or Mumbai, then select Continue.

The Create Access Key dialog with Root User selected and the region set to Indore
Generate the key

The Important Note window opens. Select Generate Key. A .txt key file downloads straight away. It contains the service URL, the access key, the secret key, the region and the user.

The Important Note window with the Back and Generate Key buttons

The secret key is only in that file. Zata cannot show it again. Store the file somewhere safe. If you lose it, rotate the key to get a new pair.

Key limits​

Key ownerKeys per region
You (root keys)2
Each sub-user1

These are the default limits. If you hit one, you see a "key limit reached" message. Delete a key you no longer use, or contact support if you need more.

A sub-user already gets one key in each of its regions when you create it, so you normally only create a sub-user key after deleting one. See New keys for a sub-user.

Manage your keys​

Each key has three buttons in the Actions column:

ButtonWhat it does
Deactivate Key / Activate Key (power icon)Turns the key off for now, or back on. A deactivated key stops working but is not deleted.
Rotate KeyReplaces the key with a new access key and secret key. The old pair stops working at once, and a new key file downloads. Update your apps with the new key.
Delete KeyRemoves the key for good. Apps using it stop working. This cannot be undone.

Rotate a key​

Select Rotate Key on the key's row, read the warning and select Rotate Key again. Only an active key can be rotated — activate it first if it is off.

What the console stops you from doing​

So that you never lock yourself out, some buttons are greyed out:

  • You must keep at least one active root key in each region. You cannot deactivate, rotate or delete the only active root key in a region. To replace it, create a second root key in that region first, switch your apps over, then delete the old one.
  • You cannot delete a sub-user's last key. Delete the sub-user instead.
  • You cannot create a key for a suspended sub-user, or rotate a key in a region where the sub-user is suspended. Reactivate it first.

Keep your keys safe​

  • Never share your secret key or put it in public code, a web page or a mobile app.
  • Give each person or app its own sub-user with only the access it needs, instead of sharing your root key. Zata has no temporary credentials (STS or IAM roles).
  • Rotate keys from time to time, and delete keys you no longer use.

Next steps​