For the people who let AI sessions do real work

Give AI sessions a handle, not the key.

Anything a model can read, a prompt injection can send away. Keyward answers an AI session with a reference, puts the value into the process that needs it, and asks you, with Windows Hello, before a value ever reaches the model.

Where it stands See what it does

An illustration of the Keyward Desktop window, as designed. The title bar carries the menus. Projects and environments are listed on the left. The canvas lists the secrets of one environment by name, with their handles and when each was rotated; one value is shown, with the approval that revealed it to a named program for ten minutes. A prompt in the corner asks whether Claude Code may read one key.

web-shop · production

−□✕

Projects Secrets Policy Callers Leases Audit Sync Local only

DATABASE_URLkw://web-shop/prod/DATABASE_URLrotated 3 d ago

STRIPE_SECRET_KEYkw://web-shop/prod/STRIPE_SECRET_KEYrotated 12 d ago

OPENAI_API_KEYsk-••••••••••••Q4revealed to Claude Code · 9 min left

SMTP_PASSWORDkw://web-shop/prod/SMTP_PASSWORDrotated 41 d ago

GITLAB_TOKENkw://web-shop/prod/GITLAB_TOKENinjected into git · 2 min ago

Allow Claude Code to read OPENAI_API_KEY for 10 minutes? · Windows Hello

CALLER · CLAUDE CODE

POLICY

Lease10 min

ReferenceInject

Vault on this computer · TPM-bound · 5 callers allowed Server: keyward.vault.exprezoe.com · synced 4 min ago

What changes when the model gets a handle

Nothing leaves in the conversation. The session sees kw://web-shop/prod/STRIPE_SECRET_KEY and what is known about it. The value goes into npm publish, or git push, or the test suite, as an environment variable for that one command.

A reveal is a decision you make. When a session really needs a value in its context, Keyward Desktop asks you: which program, which secret, the reason the model gave, for how long. You answer with Windows Hello. The lease is minutes, and the audit remembers that the secret was exposed.

The caller is who it is, not who it says. The Keyward Service reads the signature of the program that asks. Claude Code is Claude Code because Anthropic signed it; a script that claims to be Claude Code gets references only.

One door for every client

Claude Code, Codex and Claude Desktop talk to the service on your computer. claude.ai, ChatGPT and Codex in the cloud talk to the Keyward server behind OAuth through Exprezoe Identity, which is what a custom connector is. Same tools, same policy, same rule.

Where it stands

Keyward Server 1.0.0-alpha.1 is the first build. Keyward Desktop, the Service and the connectors are designed and not built. The status page says what exists and what is next, and nothing on this page will be promised before it is proven.

Keyward Server 1.0.0-alpha.1 is being built; Keyward Desktop is designed

A secrets, credentials and machine-identity platform you run yourself, and a vault on your own Windows computer that gives AI sessions handles instead of secrets. In early access, licenses go to Exprezoe's staff and to the testers we invite; one license covers Keyward Desktop and the command line.

Where it stands I have a license