qq: in the enterprise license is there a way to keep users from seeing the SDK keys? I've tried to play with the user roles but even when I create a role that only should have access to the ideas bit, the users continue to see the SDK keys

I don't believe so. The key are intended to be visible publicly. What's the intent behind wanting to limit their visibility?

infosec guidelines pretty much. We follow the least privilege concept, so if a user doesn't need to implement the sdk ideally we wouldn't want it to be able to look at it/copy

That makes sense. I'm going to log this as a feature request.