A keyboard shortcut can send selected text from almost any app to an AI service and put the result back on the clipboard. The convenience is real. So is the risk: the clipboard may contain customer data, credentials or text you never meant to send outside the app.
This guide describes the architecture and controls. It does not promise a setup time, monthly cost or universal productivity gain.
Verified on 24 August 2026 against Microsoft Learn, Make and OpenAI documentation.
The basic design
The workflow has four parts:
- an Apple Shortcut or Power Automate desktop flow reads the clipboard
- the user chooses an approved task
- a Make webhook joins the task instruction to the text and calls the OpenAI API
- the result returns to the local automation and replaces the clipboard
That pattern is simple enough to understand, but every hop is a data boundary.
Build the front end
Create a local shortcut that reads clipboard text only after a deliberate key combination. Show a confirmation that names the task and destination before sending.
Include a cancel button. Reject blank content and set a sensible length limit. Never run continuously in the background or capture every clipboard change.
For Windows, Power Automate for desktop can read and write clipboard text. Its licensing and organisational availability depend on how the desktop flow is run, so verify the current Microsoft terms for your scenario.
Protect the webhook
A Make custom webhook is effectively an API endpoint. Treat its URL as a secret, but do not rely on an unguessable URL alone.
Add an authentication value, validate the request shape, limit accepted size and reject unexpected task names. Keep OpenAI credentials inside the Make connection, not on the client shortcut.
If the workflow handles sensitive business data, a public automation platform may not be the right middle layer. Consider a company-controlled API endpoint with Entra authentication, logging controls and a documented owner.
Use prompt templates carefully
Store a small allowlist of tasks such as:
- shorten this draft without changing facts
- list questions the text leaves unanswered
- convert these notes into proposed actions
Do not offer an unrestricted hidden system prompt that suggests the model can make final decisions. Ask for structured output where the next step needs predictable fields.
Handle provider responses
Use a current OpenAI API model that is available in your project. Add branches for authentication failure, timeout, rate limiting, safety refusal and invalid output.
Return an error message that cannot be mistaken for a completed response. Preserve the original clipboard until a valid result arrives so a failure does not destroy the user's text.
Privacy and proof
OpenAI says API data is not used to train models by default, while its data-controls documentation describes endpoint-specific retention. Make has its own processing and retention terms. Your source application may also prohibit sending its data to either service.
Test with synthetic content first. Then measure generation plus review time, correction rate and cases where the shortcut should not be used.
A working shortcut proves that text travelled through the chosen services and returned. It does not prove that the output is correct, private enough for every clipboard item or cheaper than an approved built-in assistant.
For help turning useful desktop experiments into governed automations, join the Power Automate Builders Space.