Browser and SDK access (CORS)

How to let your web app call Zata directly from the browser.

Browsers block a web page from calling another site's API unless that site allows the page's origin. This is called CORS. You only need it when JavaScript running in a browser talks to Zata directly — for example a web app that uploads files to a bucket.

When you need CORS

What you do	CORS needed?
S3 tools, the AWS CLI, or an SDK running on your server or computer	No
A plain link, <img> or <video> tag pointing at a public file or a presigned URL	No
JavaScript in a web page calling Zata (fetch, XMLHttpRequest, the AWS SDK for JavaScript in the browser), including uploads to a presigned URL	Yes

Ask for CORS

The Zata console has no CORS setting. The Zata team sets up CORS for you on request.

Collect the details

• The bucket names and their region (Indore or Mumbai).
• The exact origins of your web app, for example https://app.example.com. Wildcards such as * are only allowed after review.
• Whether you need read-only access (GET, HEAD) or also uploads and deletes (PUT, POST, DELETE).
• Any extra request headers your app sends, if they differ from the standard AWS SDK headers.

Open a support ticket

In the Zata console, select Support in the sidebar and send the details. See Get support.

Keep keys out of the browser

Never put an access key or secret key in browser or mobile app code — anyone can read it there. Zata has no temporary credentials (no STS), so use one of these instead:

• Presigned URLs — your server signs a short-lived URL, and the browser uses it to download (GET) or upload (PUT) one file. For uploads, the browser must send the same Content-Type that was signed. See Share a file.
• A sub-user key on your server — your backend calls Zata with a sub-user key that can only reach the buckets it needs.