Skip to content
Get started
Back to writing
Changelog6 min read

Connect your own agent, richer iMessage, one-click retry

Everything we shipped from October 5 to 9: connect an agent you already built, more ways to reply in iMessage, one-click retry, and new tools for developers.

Orange light reflected in a deep blue mountain lake

Short answer: From October 5 to 9, Keiki shipped connecting an agent you already built, more ways to reply in iMessage, one-click retry for failed messages, and new developer tools, including the external harness and strictly scoped agent API keys.

Here's what we shipped on Keiki from October 5 to 9. Everything is live now.

The first part is for everyone who uses Keiki. The second part is for engineering teams.

What's new

Connect an agent you already built

If your team has already built an AI agent, you can now connect it to Keiki. The agent keeps running in your own app. Keiki handles everything around it: phone numbers and channels, when each message is answered, delivery, conversation history and logs. To get started, open the agent page and follow the setup card.

More ways to reply in iMessage

  • Agents can add an effect to a message, such as confetti or balloons, and reply to a specific message in the thread.
  • Agents can send voice notes, polls and link cards that open inside iMessage.
  • Agents can react to a message with a tapback. When a customer reacts to one of your agent's messages, Keiki saves the reaction as feedback.
  • Each agent always replies from its own number, even when several agents share an account.

Retry a failed message in one click

When a message fails, select Retry in Logs or Conversations. Keiki sends the customer's original message to the agent again, in the same conversation. The customer doesn't need to write again.

Smoother conversations

  • Agents no longer send an extra message after they've answered. Keiki sends a follow-up only when one is needed.
  • When one agent is busy, your other agents still reply on time.
  • Tools your agents sign in to stay connected longer, so you'll need to reconnect them less often.
  • Fixes: agents can read files shared in Slack again, and Copilot no longer stops responding after you answer one of its questions.

Preview an agent for your business

Enter your website, or describe your business, at onkeiki.com. Keiki builds a preview agent and shows you a sample conversation with it. Share the preview with colleagues who haven't seen Keiki yet.

Faster dashboard

Pages, charts and analytics load faster.

Action needed if you use single sign-on (SSO)

Before Keiki trusts your company domain for SSO, it now checks the domain's DNS verification record. If that record is still in your DNS, you don't need to do anything. If you removed it, add it back. You'll find the record under Settings → Security → Company domains.

For developers

External harness: run the agent loop in your app

Set an agent's harness to external. Your app runs the model loop. Keiki keeps channel ingress, steering, turn slots, tools, delivery, history and traces. Choose a mode:

  • push: Keiki sends a signed turn request to your dispatchUrl. Your app responds 202, then reports messages and completion to Keiki.
  • relay: Keiki queues the signed request, and a connected relay forwards it. Use relay mode for an agent behind a firewall or on a local machine. The dashboard can also tunnel to a local push agent and monitor it.
  • inbox: your agent polls and claims queued work. This mode needs no public URL and no signing secret.

Each agent can have its own signing secret. timeoutMs sets the turn deadline, up to 10 minutes. Steered and Live Test turns are supported. Keiki holds their replies back, so they never reach the contact.

Adapters for common runtimes are on npm:

Read the external harness guide

iMessage tools

  • send_with_effect works on Linq and Photon lines. Use reply with reply_to_message_id for a threaded reply.
  • App cards through imessage_send_app need the iMessage Apps add-on and a dedicated line bought through Keiki; polls and voice notes need an iMessage line.
  • Each contact message now includes its message_id, so react_to_message and a targeted reply can use it. Keiki records inbound tapbacks as feedback.

Any agent in an org can now use any of the org's lines, whichever API key the agent belongs to. Outbound Photon messages always go out on the sending agent's line. Read the cloud agents guide

Keiki MCP

  • Every developer API endpoint is now its own MCP tool. Each tool carries readOnlyHint and destructiveHint annotations, so a client can ask for confirmation before it overwrites data, replaces credentials or spends credits. talk_to_agent and cancel_job are marked destructive.
  • Any MCP connection can now set custom headers, whatever its auth mode. Requests send User-Agent: Keiki/1.0 (+https://onkeiki.com) unless the connection sets its own User-Agent.

Developer API

  • delivered on webhook tool results: when your backend sends the contact something itself, such as a card or a document, add delivered to the tool result. Use a short description, or an array of up to 10. Keiki records each item as a message sent in that turn. It then appears in later turns' history, in conversation_search and in the dashboard.
  • Trace exporters: list them with GET /api/v1/developer/trace-exporters. Attach an agent by external_ref with POST /api/v1/developer/trace-exporters/:id/agents, and detach it with DELETE /api/v1/developer/trace-exporters/:id/agents/:agent_id. Read the partner deployments guide
  • Sign in with AgentID: an AI agent can sign in to Keiki as its own user with its AgentID inbox. It can also accept an org invitation without setting a password. Read the AgentID guide
  • API keys page: the page now shows which agent each key can access.

Action needed: API keys bound to one agent are now strictly scoped

A key bound to one agent can now reach only that agent:

  • Another agent's outcomes, alerts, traces and harness turns return 404.
  • Org-wide routes return 403 with An org-wide API key is required. These routes are /api/v1/keys, /orgs, /billing, /audit, /usage, /people, /phones/*, /photon/*, steering_config, and every secret write. GET /secrets still lists secret names.
  • /sync returns 403 when the request includes secrets, or a capability with a runtime to publish.

A key that creates or rotates other keys can grant only scopes it already holds. Omitting scopes requests *, so a restricted key must list the scopes it grants.

If an integration uses a bound key for org-wide calls, switch it to an org-wide key. Read the API key rules

Have a question, or want help connecting your own agent? Contact us.