Skip to content

Bluetooth

This page covers how the Create talks to Bluetooth hosts: the five host slots and the keys that pick them, output selection and its hazards, pairing, the BLE v1 to v2 change, the security level, what the keyboard exposes over GATT, link behavior, and what is known about the Speedlink dongle. The one thing to know first: the two halves are bonded to each other and a host sees one keyboard; configuration and firmware updates happen over USB only. The link between the halves is on Split link.

Unless another source is named, MEASURED means measured on the owner's board, with the keyboard firmware and date given beside the tag. Byte strings follow the byte convention. No Bluetooth address is reproduced. Third-party Bluetooth measurements come from the public createflow-dongle project, which describes its subject as "a Naya Create running firmware 0.3.41 in September 2026"1.

At a glance

  • One host-facing keyboard: the left half is the central of a bonded pair and the host gets one set of HID reports and one battery level.
  • Five host slots on the wire (0-4); NayaFlow's keys reach slots 1-4; the stock pairing combo is Layer 2 + 5 (Layer 2 + Esc in the v1.0.6 manual).
  • BLE v2 arrived with 3.35.4 and wiped every host bond on the way.
  • The vendor 0x1234 service answers reads with 65 and does nothing else that anyone has found.
  • Do not press BT_OUT on battery with no host in range: the keyboard froze until power cycled.

One keyboard, two halves

The two halves are bonded to each other over Bluetooth LE (the split link) and a host sees one Bluetooth keyboard MEASURED pair tables, 2026-09-01. A third-party central held a single connection and got the keys of the whole keyboard, the touchpad, the dials and the media keys, with one battery level REPORTED1. So a host gets one stream of reports for the whole keyboard INFERRED. Whether the right half advertises to hosts at all is not measured (open questions).

The SoC and radio belong to The keyboard half: our reading of the FCC exhibits is a Nordic nRF52840 (package code CKAA) DOC. The Bluetooth SIG listing 311198 ("NAYA TECH/NAYA CREATE", Naya B.V., qualified 2025-09-19) declares core specification 5.1, lists model NAYA-800-1 with "USB, 2.4G, BLE three working modes", and references a Zephyr host (QDID 151074) and a Zephyr controller for nRF52 (QDID 150092) DOC2, which points to a Zephyr link layer rather than Nordic's SoftDevice INFERRED. Marketing says Bluetooth 5.4. The official registers, checked 2026-09-23, hold exactly three FCC IDs under grantee 2BQ4V (left half, right half, dongle; final actions 2025-08-26, 2025-08-29 and 2025-09-03, nothing filed since) and the matching ISED certifications 34320-0825CRL, 34320-0825CRR and 34320-0825DG; each half's filing has a BLE test report and a separate "2.4G SRD" report (2 Mbps only) under the same FCC ID DOC34. Whether shipping firmware ever uses that SRD mode, on the halves or the dongle, is OPEN (details). Details are on Regulatory records.

Host slots

Five host slots exist on the wire: be/100c reports a profile count of 5, and be/1009 / be/100a take one data byte below 5 MEASURED 2026-09-10 STATIC6. NayaFlow's keys BT_DEVICE_1-4 select slots 1-4, with the same numbering the status blob uses (the key records carry one-based arguments). Slot 0 is reachable only by NayaCore's BT_SELECT_SL (wire record (3, 0)), which NayaFlow never offers; the dongle is the usual guess for it STATIC6. The vendor's v0.1.0 notes (one-based) make slots 1-4 user-assignable and reserve "slot 5" for a future BLE dongle; how that maps onto wire slots 0-4 is open DOC8. The Kickstarter campaign (2023) promised Bluetooth to "up to five devices", and its FAQ several Bluetooth devices plus one RF device through the included dongle DOC1213.

Wire slot Selected by Vendor naming What is known Evidence
0 BT_SELECT_SL (3, 0) only (NayaCore; NayaFlow never offers it) "slot 5, reserved for a future dongle" is the likely match never bonded by us; purpose open STATIC OPEN
1 BT_DEVICE_1, record (3, 1) "Dev. 1" normal host slot MEASURED 2026-09-10
2 BT_DEVICE_2, (3, 2) "Dev. 2" normal host slot MEASURED 2026-09-10
3 BT_DEVICE_3, (3, 3) "Dev. 3" normal host slot MEASURED 2026-09-10
4 BT_DEVICE_4, (3, 4) "Dev. 4" normal host slot MEASURED 2026-09-10

The active slot persists across a power cycle: after a user pressed BT_DEVICE_1 and power cycled the board, the status still showed slot 1 active MEASURED 3.41.0, 2026-09-10.

BT_NEXT (1, 0) and BT_PREV (2, 0) exist only in NayaCore's table STATIC6. NayaFlow offers BT_DEVICE_1-4 and BT_CLEAR (0, 0), which NayaFlow's tooltip says clears the selected slot and starts pairing DOC7; whether the bond is cleared on the press was not measured. The select and clear commands be/1009 / be/100a had not been exercised on hardware by us as of 2026-09-10 MEASURED (read side only). The key records are on Keymap.

Keys and key combos

The current manual (v1.1.x, pages 7 and 20) gives these Layer 2 combos; NayaFlow 1.25.1's stock profile agrees, with BT_CLEAR at positions 6 and 73 DOC16 MEASURED stock positions, 2026-09-10. A failed pairing attempt falls back to the previous connection DOC16.

The v1.0.6 manual (the FCC exhibit) pairs differently: its Layer 2 table puts BT Clear on LA1 (the Esc position), "Speedlink" on LA4 and "Connect to Bluetooth" on LB4, while its text says keys 1-5, so pairing there is Layer 2 + Esc. The later manual and the stock profile moved Clear to LG1. Each manual is right for its version; the stock default today is Layer 2 + 5 DOC1716.

Action Manual v1.1.x and stock profile Manual v1.0.6 (FCC exhibit) Evidence
Select host 1-4 hold Layer 2 (A5 or H1), press 1-4 (LC1-LF1, "Dev. 1-4") Layer 2 + 1-5 (text) DOC
Clear slot / enter pairing Layer 2 + 5 (LG1; "BT Clear" in the table, "enter pairing mode" in the text) Layer 2 + Esc (LA1, "BT Clear") DOC
Output through USB Layer 2 + Z (LC4) Layer 2 + Z DOC
Output through wireless Layer 2 + Left Shift (LB4, "WL") LB4 "Connect to Bluetooth" DOC
Speedlink (dongle) not listed LA4 "Speedlink" DOC
Power button (Windows) / display sleep (macOS) Layer 2 + Esc (LA1) not listed DOC

NayaFlow's stock profile puts a full set of connection keys on EACH half's System layer (left positions 2-6, 47 and 48; right 15, 29, 45, 61, 73, 71 and 72): BT_DEVICE_1-4, BT_CLEAR, BT_OUT and USB_DEVICE MEASURED read from a NayaFlow-flashed board, 2026-09-10. Positions are explained on Layout and positions.

Output selection and its hazards

Output selection is the 08 record (ZMK &out) with 1 = USB and 2 = wireless; the keyboard sends to one output at a time. A Bluetooth device key also switches the output: pressing BT_DEVICE_1 with no bonded host stopped typing over USB MEASURED 3.41.0, 2026-09-08 and 2026-09-10 DOC16.

Output hazards seen on 3.41.0 MEASURED 2026-09-10, 2026-09-11:

  • BT_OUT pressed on battery (USB unplugged, dongle on USB) with no reachable host froze the keyboard, layer switching included, until a power cycle.
  • With a host bonded and the cable in, BT_DEVICE_1 then USB left typing stuck until USB was pressed a second time; the configuration ports stayed healthy.
  • USB_DEVICE after BT_DEVICE_1 with no host looked like a shut-off (USB stayed enumerated) until both halves were power cycled (open questions).

Pairing and identities

The keyboard would not enter Bluetooth pairing while on USB power MEASURED 3.41.0, 2026-09-11. The createflow-dongle project says the same in its own words: keep the keyboard off USB while pairing, because on a cable it sends keystrokes over the cable; on a free slot it advertises openly (also reported by createflow-dongle1).

The address be/1008 returns (the status blob's "local address") is the split-link identity; a Windows host paired with a different, host-facing identity MEASURED 3.41.0, 2026-09-11.

BLE v2 arrived with keyboard 3.35.4 (beta 1.18.0, stable 1.19.1): latency down to 7.5 ms (Apple platforms enforce 15 ms), "stronger host connection security at Level 4", each slot advertising its own name ("NayaCreate BLE 1", "NayaCreate BLE 2", ...), and every known host removed by the v1 to v2 update (hosts must forget the old "NayaCreate Left" entry and pair again; some need a Bluetooth restart). The split link fails until both halves run v2; the update order does not matter DOC811. NayaFlow 1.25.1 warns CREATE_LEFT_BLE_V1_DETECTED / CREATE_RIGHT_BLE_V1_DETECTED, and NayaCore runs its ClearBLEDevices operation automatically after an update that crosses the BLE version ("updated to %2 (above BLE version). Starting ClearBLEDevices operation.") STATIC67.

be/100f GET BLE FW VERSION answers 00 02 on 3.41.0 on both halves: one data byte, 2 = BLE v2 MEASURED 3.41.0, 2026-09-07 to 2026-09-17. The whole reply frame is aa 50 00 00 be 04 10 0f 00 02 1d 04: the 1d after the data byte is the frame checksum, not a third version byte. On 3.28.7 be/100f returns no frame at all (the firmware predates it) MEASURED 3.28.7, 2026-09-19. See Command map.

Security level: the vendor's notes claim Level 4 for host connections DOC8. A third-party central with no display or keyboard (Just Works) bonded at encryption level 2 (no MITM protection) on 3.41, so the keyboard does not refuse unauthenticated pairing, and the level a host reaches depends on the host REPORTED1. On our board the bonded Windows slot's security byte in the status blob read 2 MEASURED 3.41.0, 2026-09-11 (also reported by createflow-dongle). The blob is decoded on Split link.

GATT: what the keyboard exposes

All of this section comes from third-party reads, with the report map also matched against our own USB capture; no Bluetooth central of ours has read the table, and NayaFlow has no Bluetooth transport. A read-only check from a host that is already bonded settles it (open questions).

GATT services and handles, listed after encryption on 3.41 by createflow-dongle REPORTED1:

Service Handles Characteristics Evidence
0x1801 Generic Attribute 0x0001-0x0008 standard REPORTED
0x1800 Generic Access 0x0009-0x000f standard REPORTED
0x180f Battery 0x0010-0x0013 Battery Level 0x2a19, value handle 0x0012, notify REPORTED
0x180a Device Information 0x0014-0x001a not listed by the source REPORTED
0x1812 HID over GATT 0x001b-0x0030 report map and reports (below) REPORTED
0x1234 vendor 0x0031-0x0034 one characteristic 0x5678 (read, write, notify) and its CCCD REPORTED

There is one Battery Level characteristic for the whole keyboard, with no second one for the other half REPORTED1; per-half charge is available only over USB (fe/1006, see Command map). Over USB a half reports only its cell voltage, and the voltage a full half rests at depends on its firmware: flat on USB for 30 minutes, 3.41.0 halves held about 4.07 to 4.09 V and 3.28.7 halves about 4.19 to 4.21 V MEASURED owner's boards, 2026-09-26. Which cell and which scale the firmware uses for the Bluetooth percentage is not known (Power and batteries).

The HID service carries report protocol only: 22 handles leave no room for a Protocol Mode or boot-report characteristic INFERRED (handle arithmetic), and the third-party client finds no boot keyboard report REPORTED1. The 212-byte report map that createflow-dongle reads over Bluetooth (its firmware carries a verbatim copy) is byte-identical to the left half's USB HID report descriptor in our own capture REPORTED1 MEASURED (USB side: owner's board, 3.41.0, 2026-09-11). Trackball and touch input reach a host as report 3. The table decodes that map; each row is in createflow-dongle's copy1 and in our USB descriptor capture of the same date.

Report id Kind Contents Evidence
1 keyboard (input) 8 modifier bits, 1 reserved byte, 6-key array (0-255) REPORTED MEASURED (USB descriptor)
1 keyboard (output) 5 LED bits + 3 padding bits REPORTED MEASURED (USB descriptor)
2 consumer control six 16-bit usages, 0-4095 REPORTED MEASURED (USB descriptor)
3 mouse 5 buttons, 8-bit relative X and Y, wheel, AC Pan (0x238), AC Zoom (0x22f) REPORTED MEASURED (USB descriptor)

Whether the keyboard acts on the host's lock-key LED output report is not known.

The 0x1234 / 0x5678 pipe: reads return one byte 65 ("e"), writes are accepted, and nothing is ever notified (createflow-dongle) REPORTED1. Writing the keyboard's USB configuration frames to it (GET FW VERSION, addressed to either half) gets no reply, and there is no DFU, SMP or UART service REPORTED1. So configuration and firmware updates are USB-only on 3.41.0 INFERRED; "no reply to a configuration frame, no known use" is safer wording than "dead". NayaFlow 1.25.1 has no Bluetooth transport at all: NayaCore links Qt SerialPort and no Bluetooth module STATIC6.

Which half the createflow-dongle central connected to is not stated in its findings REPORTED1.

On 3.41 the keyboard drops the host link after its idle time (supervision timeout, HCI reason 0x08) and is back about 2 s after a key press; it reconnects by itself after sleep and after a restart; heavy touchpad use peaked near 130 reports per second with none lost. A host whose bond the keyboard no longer holds (slot cleared or re-paired) stays connected but gets no keystrokes, and the keyboard answers "PIN or key missing" REPORTED1.

Modules have no radio of their own: they link through the dock contacts, and their gestures reach a Bluetooth host as ordinary HID reports through the keyboard. The vendor said on Reddit (2023-06-06; archived text, the permalink could not be verified live) that a module hot-swap does not drop host connections because the half's small cell carries it through; the current manual says the same of the internal cell DOC16. See Module fields for what the host receives.

The vendor's v1.0.6 manual lists a "Speedlink Dongle (Wireless dongle, NAYA-100-1)" in the box and "Speedlink Connection: Using Bluetooth v5.4" DOC17. The dongle has no manual of its own: its FCC "user manual" exhibits are the right-half manual v1.0.6, which adds "Ensure the speedlink dongle is properly seated" DOC5. Its regulatory record describes the radio differently: the dongle's SAR report (R00, 2025-08-12, hardware B0K17_Dongle_20241106_V01) names only a "2.4G SRD" radio at 2 Mbps, one antenna at the cap end and no simultaneous transmission; FCC ID 2BQ4V0825DG (granted 2025-09-03), ISED 34320-0825DG (2025-09-08) DOC53. Which link protocol "2.4G SRD" is (BLE at 2 Mbps or a vendor 2.4 GHz mode) is not stated in the filings, for the dongle or for the halves, which carry the same mode beside BLE; whether shipping firmware ever uses it is OPEN (open questions); in 2023 the vendor said it was exploring Nordic's low-latency packet mode (LLPM) DOC14. The Kickstarter campaign called it an "RF dongle", and update 15 moved it from a planned USB-C receiver to USB-A DOC1215. NayaFlow 0.1.0 named its action "Connect via Speedlink" (RF_DEVICE) STATIC10. The left half answers be/100d with a stored dongle address MEASURED 3.41.0, 2026-09-11. No vendor text we have read says a dongle mode ever shipped, and a relayed vendor statement (early 2026, through the createflow-dongle project) called it "not yet active" REPORTED1; that statement cannot be checked. NayaFlow 1.21.0 and 1.25.1 carry dongle strings and a Naya_DeviceDongle class but no dongle firmware STATIC69. NayaCore fixed a dongle-caused hang (5.8.1) and crash (6.11.0) DOC8. Whether the dongle bridges a battery-powered keyboard is open: our test froze on BT_OUT (above) MEASURED 2026-09-11 (open questions). USB details are on USB and hardware on Speedlink dongle.

createflow-dongle (Apache-2.0, third party) turns an nRF52840 USB stick into a BLE-central, HID-over-GATT-client bridge that presents the keyboard's own report map over USB; it pairs on an ordinary user slot (1-4). It is the source of the third-party measurements on this page DOC1.

Host software and vendor claims

Host software history around Bluetooth: NayaFlow 1.18.0 / 1.19.x added a Connection Settings tab, a device status in the top bar, a split-connection warning and a "Clear BLE Devices" button ("forces Create to forget all Bluetooth connections"; the host may need to forget the keyboard too). NayaCore 6.4.0 added BLE v2 support and Clear BLE Devices; 6.9.2 fixed a pairing workflow that could fail silently; 6.11.0 added pairing error codes, target selection and a post-update BLE version check DOC118.

Vendor host claims: BLE v2 is reliable across Debian Linux, Windows, macOS, iPadOS, iOS and Android DOC8; the Kickstarter FAQ (2023, live) lists device support for macOS, Windows, Linux, iPadOS, iOS, Android and ChromeOS, and a 2024 vendor Reddit answer repeats the list (archived text, not live-verified) DOC13.

Bluetooth problems

Symptom Cause Fix Evidence
Keyboard frozen, layers too, after BT_OUT on battery no reachable host in wireless output power cycle; avoid BT_OUT on battery MEASURED 2026-09-11
Typing stuck after BT_DEVICE_1 then USB output switching with a bonded host and the cable in press USB (Layer 2 + Z) again MEASURED 2026-09-10
Keyboard looks off after USB_DEVICE, USB still enumerated selected a Bluetooth slot with no host first power cycle both halves MEASURED 2026-09-10
Will not enter pairing on USB power unplug and pair on battery, on a free slot MEASURED 2026-09-11
Old host cannot reconnect after an update to 3.35.4 or later the v1 to v2 update removed every bond forget "NayaCreate Left" on the host, pair again; restart Bluetooth if needed DOC
Split link dead after updating one half across 3.35.4 only one half on BLE v2 update the other half DOC
Host connected but no keys, "PIN or key missing" the keyboard no longer holds that host's bond forget and pair again REPORTED
Host link drops when idle supervision timeout after the idle time press a key; back in about 2 s REPORTED

Commands that touch Bluetooth

The be family (pair address, unpair, slots, dongle address, status, clear split links) is listed on Command map; the status blob and the pairing repair are on Split link.

Safety notes

Commands and keys that drop bonds or freeze the keyboard

  • Do not press BT_OUT (Layer 2 + Left Shift) on battery with no host in range: the keyboard froze until power cycled (measured 3.41.0, 2026-09-11).
  • The firmware step from BLE v1 to v2 (to 3.35.4 or later) wipes every host bond.
  • be/1004 UNPAIR ALL and be/100a CLEAR BLE PROFILE drop bonds, and be/1004 also drops the split link. Read Split link before using either; neither has been used by us outside the pairing repair.

Open questions

  • OPEN What wire slot 0 is for, and how it relates to the vendor's "slot 5" (details).
  • OPEN Whether BT_CLEAR clears the bond on press; whether the right half advertises to hosts (details).
  • OPEN The Device Information strings, and whether the keyboard uses the host's lock-key LED report (details).
  • OPEN be/1009 / be/100a on hardware (details).
  • OPEN What USB_DEVICE does after a Bluetooth slot was selected with no host (details).
  • OPEN Whether the stock dongle bridges anything, and its protocol address (details); whether shipping firmware ever uses the "2.4G SRD" mode, on the dongle or the halves (details); what the SIG listing's "2.4G" mode refers to (details).
  • OPEN USB-side HID boot protocol (details).

Sources

  1. createflow-dongle, docs/findings.md and its firmware sources (third party, Apache-2.0): GATT table, report map, pairing, security level, link behavior, the original dongle. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  2. Bluetooth SIG qualification listing 311198, "NAYA TECH/NAYA CREATE" (Naya B.V., 2025-09-19), with its referenced Zephyr host (QDID 151074) and controller (QDID 150092) listings. ↩

  3. FCC Equipment Authorization Search, grantee 2BQ4V, and the ISED Radio Equipment List, company 34320 (both checked 2026-09-23). ↩↩

  4. FCC ID 2BQ4V0825CRL (left half), BLE and "2.4G SRD" test reports, fccid.io/2BQ4V0825CRL. ↩

  5. FCC ID 2BQ4V0825DG (Speedlink dongle), SAR report R00 and user manual exhibits, fccid.io/2BQ4V0825DG. ↩↩

  6. NayaFlow 1.25.1, NayaCore 6.11.0 strings (static reading): Bluetooth action tables, validation messages, ClearBLEDevices, linked Qt modules. ↩↩↩↩↩↩

  7. NayaFlow 1.25.1 renderer and flow-bg-server strings (static reading): BT_CLEAR tooltip, BLE v1 warnings. ↩↩

  8. create-legacy-firmware, vendor release notes, changelogs/ (v0.1.0, v1.19.1, v1.20.0, v1.25.0). ↩↩↩↩↩↩

  9. create-legacy-firmware, firmware-history/ (v1.21.0 and v1.25.1 image sets). ↩

  10. NayaFlow 0.1.0, from the create-legacy-firmware release archive, github.com/create-collective/create-legacy-firmware (static reading). ↩

  11. Vendor release notes of the beta channel, NayaTech/NayaFlow-beta-releases (1.18.0 and later). ↩↩

  12. Kickstarter campaign page, naya-create/naya-create (2023), "Connectivity". ↩↩

  13. Kickstarter FAQ, naya-create/naya-create/faqs (read 2026-09-23). ↩↩

  14. Kickstarter update 7, 2023-11-07. ↩

  15. Kickstarter update 15, 2024-09-03. ↩

  16. Naya Create User Manual v1.1.x (pages 7 and 20, key combos; internal cell); see Manuals. ↩↩↩↩↩

  17. Naya Create User Manual v1.0.6, FCC ID 2BQ4V0825CRR user manual exhibits (fccid.io/2BQ4V0825CRR). ↩↩