Connector setup without secrets, redaction from chat and an audit trail for every web app

As more of an organization's work runs through AI agents, three things get harder: setting up connections without passing credentials around, keeping data-protection rules current, and knowing what the apps people build actually do. This week's Keyboard release addresses all three. Here's what shipped and who it's for.

Set up connectors without sharing a secret

For IT Admins. Your AI agent can now create connectors for you, both API-key apps and OAuth providers, up to 20 in a single request. None of them carries a credential. Each connector comes back with a link to the Keyboard dashboard, where an admin types the secret in directly, so it never appears in the conversation or the model's context.

A few safeguards sit behind this:

• Keyboard verifies that the person asking is an org admin on every request.
• Any request that includes a secret field is refused.
• An existing connector is never overwritten.
• For organizations that run Keyboard in their own infrastructure, the request is handled by their own deployment.

Why it matters: admins can describe a batch of connectors in plain language and get setup links back, while the rule that credentials only ever enter through the dashboard stays intact.

Manage redaction settings from your AI client

For CISOs. Org admins can now read and update the organization's PII redaction settings from their AI client, working against the same settings the dashboard uses.

Changes merge rather than replace. List entries are added or removed individually, and custom recognizers are added or updated by name, so bulk-adding patterns never wipes out existing rules. Two settings stay deliberately dashboard-only: the master on/off switch, and the choice between failing open and failing closed when redaction is unavailable.

Why it matters: a security team can tune redaction as new data patterns come up, in the same place they're already working, without risking the rules already in place. The decisions with the biggest blast radius still need a deliberate visit to the dashboard.

An audit trail for every web app

For CISOs and IT Admins. Org web apps let members build and share small apps on top of company data. Admins now get a full view of what each one does.

The Web apps page lists the organization's apps, and each app has its own admin page showing:

• who created it and who published it last;
• the connections it declares;
• who it's shared with, including how many teams and users;
• the files it contains, and the packages it uses with the versions it pins.

Every call an org web app makes through Keyboard is logged as its own entry: the viewer, the connection, the method, the host, the path (without query, body or headers) and the upstream status.

For CIOs. API usage now records which web app made each call, so daily usage can be broken down by app. This is attribution, not authentication: it tells you which app a call came from, not who is allowed to make it.

Why it matters: when someone builds an app that touches company systems, admins can see exactly what it reaches, who uses it and how heavily, without asking the builder.

Newer models in the model picker

For CIOs. The latest model releases are now available in the AI provider model picker, so an organization can add them to its model allow-list as soon as it's ready, without waiting for a Keyboard release.

Getting started

Credential-free connector setup and redaction settings are available to org admins from their AI client today. The web app audit views are on the Web apps page of the Keyboard dashboard. To learn more, visit the Keyboard docs.