Keyboard does not have access to the API keys you input. Those are stored in your private GitHub repo. Keyboard only knows that the environment variable is available to point Claude to when ready to execute a task. By default you will always have the ability to to approve or deny any task before Claude goes and executes a task leveraging the API key (you can also turn this final approval off if you want).