Key audit

Key audit is one list of every credential in use at your level, so you can find old, unused or failing keys and rotate them from one place. Open Key audit in the Admin console.

Key values are never shown. Each row holds only details about the key: its name, provider, the last four characters where LEMA Chat keeps them, who owns it, its type, its age, when it was last rotated and last used, its health, and what uses it.

What you see

As a workspace admin you see your workspace's keys: the connections your workspace uses for model providers, storage, voice, email, search and images, including OAuth connections.

You can filter the list by Provider and Level, and sort it by age, oldest or newest first.

Each key can carry a warning badge:

• Older than 90 days (the age limit your platform operator sets; 90 days by default)
• Never used
• Failing health (the last live check failed)
• Needs re-auth
• Disabled

A key you can only look at shows View only.

Each row says only what has been observed:

• Health reads "Checked date: OK" or "Checked date: failing" from the last live check. A key never checked reads Health not checked.
• Rotation reads Rotated only when a new value was saved. An OAuth token that renewed itself reads Refreshed.
• If part of the list could not be read, the page says which part, above the list, instead of leaving those keys out silently.

Actions

Depending on the key, you can:

• Rotate: enter the replacement value and press Save & test. For an API key, rotating mints a fresh key and revokes the one it replaces. The fresh key is shown once.
• Test: check the key still works.
• Disable a connection, or Revoke an API key. Both ask you to confirm.

Every action goes through the same checks as the Connections and API keys pages, is refused while platform support is viewing the workspace as you, and is written to the audit log (who did what to which key, never the value).

Key overview

Every user has Your keys and connections in Settings > Keys & connections, below MCP API keys. It lists your own personal integrations and API keys, with the same badges and actions, so you can rotate your own keys without an admin. Below it, Deleted keys and connections is your personal Trash: restore a key or connection you deleted from there.