diff --git a/.gitignore b/.gitignore
index e05a051..45981ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@ node_modules
 CLAUDE.md
 config.json
 provider_pools.json
+plugins.json
 fetch_system_prompt.txt
 input_system_prompt.txt
 token-store.json
diff --git a/VERSION b/VERSION
index 35d16fb..ecd7ee5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.5.7
+2.5.8
diff --git a/configs/plugins.json.example b/configs/plugins.json.example
new file mode 100644
index 0000000..4f6311c
--- /dev/null
+++ b/configs/plugins.json.example
@@ -0,0 +1,12 @@
+{
+  "plugins": {
+    "api-potluck": {
+      "enabled": true,
+      "description": "API 大锅饭 - Key 管理和用量统计插件"
+    },
+    "default-auth": {
+      "enabled": true,
+      "description": "默认 API Key 认证插件（内置）"
+    }
+  }
+}
\ No newline at end of file
diff --git a/src/api-potluck/api-routes.js b/src/api-potluck/api-routes.js
deleted file mode 100644
index 3819aaa..0000000
--- a/src/api-potluck/api-routes.js
+++ /dev/null
@@ -1,277 +0,0 @@
-/**
- * API 大锅饭 - 管理 API 路由
- * 提供 Key 管理的 RESTful API
- */
-
-import {
-    createKey,
-    listKeys,
-    getKey,
-    deleteKey,
-    updateKeyLimit,
-    resetKeyUsage,
-    toggleKey,
-    updateKeyName,
-    getStats
-} from './key-manager.js';
-
-/**
- * 解析请求体
- * @param {http.IncomingMessage} req
- * @returns {Promise<Object>}
- */
-function parseRequestBody(req) {
-    return new Promise((resolve, reject) => {
-        let body = '';
-        req.on('data', chunk => {
-            body += chunk.toString();
-        });
-        req.on('end', () => {
-            try {
-                resolve(body ? JSON.parse(body) : {});
-            } catch (error) {
-                reject(new Error('Invalid JSON format'));
-            }
-        });
-        req.on('error', reject);
-    });
-}
-
-/**
- * 发送 JSON 响应
- * @param {http.ServerResponse} res
- * @param {number} statusCode
- * @param {Object} data
- */
-function sendJson(res, statusCode, data) {
-    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(data));
-}
-
-/**
- * 验证管理员 Token
- * @param {http.IncomingMessage} req
- * @returns {Promise<boolean>}
- */
-async function checkAdminAuth(req) {
-    const authHeader = req.headers.authorization;
-    if (!authHeader || !authHeader.startsWith('Bearer ')) {
-        return false;
-    }
-    
-    // 动态导入 ui-manager 中的 token 验证逻辑
-    try {
-        const { existsSync, readFileSync } = await import('fs');
-        const { promises: fs } = await import('fs');
-        const path = await import('path');
-        
-        const TOKEN_STORE_FILE = path.join(process.cwd(), 'configs', 'token-store.json');
-        
-        if (!existsSync(TOKEN_STORE_FILE)) {
-            return false;
-        }
-        
-        const content = readFileSync(TOKEN_STORE_FILE, 'utf8');
-        const tokenStore = JSON.parse(content);
-        const token = authHeader.substring(7);
-        const tokenInfo = tokenStore.tokens[token];
-        
-        if (!tokenInfo) {
-            return false;
-        }
-        
-        // 检查是否过期
-        if (Date.now() > tokenInfo.expiryTime) {
-            return false;
-        }
-        
-        return true;
-    } catch (error) {
-        console.error('[API Potluck] Auth check error:', error.message);
-        return false;
-    }
-}
-
-/**
- * 处理 Potluck 管理 API 请求
- * @param {string} method - HTTP 方法
- * @param {string} path - 请求路径
- * @param {http.IncomingMessage} req - HTTP 请求对象
- * @param {http.ServerResponse} res - HTTP 响应对象
- * @returns {Promise<boolean>} - 是否处理了请求
- */
-export async function handlePotluckApiRoutes(method, path, req, res) {
-    // 只处理 /api/potluck 开头的请求
-    if (!path.startsWith('/api/potluck')) {
-        return false;
-    }
-    
-    // 验证管理员权限
-    const isAuthed = await checkAdminAuth(req);
-    if (!isAuthed) {
-        sendJson(res, 401, { 
-            success: false, 
-            error: { message: 'Unauthorized: Please login first', code: 'UNAUTHORIZED' } 
-        });
-        return true;
-    }
-
-    try {
-        // GET /api/potluck/stats - 获取统计信息
-        if (method === 'GET' && path === '/api/potluck/stats') {
-            const stats = await getStats();
-            sendJson(res, 200, { success: true, data: stats });
-            return true;
-        }
-
-        // GET /api/potluck/keys - 获取所有 Key 列表
-        if (method === 'GET' && path === '/api/potluck/keys') {
-            const keys = await listKeys();
-            const stats = await getStats();
-            sendJson(res, 200, { 
-                success: true, 
-                data: { 
-                    keys, 
-                    stats 
-                } 
-            });
-            return true;
-        }
-
-        // POST /api/potluck/keys - 创建新 Key
-        if (method === 'POST' && path === '/api/potluck/keys') {
-            const body = await parseRequestBody(req);
-            const { name, dailyLimit } = body;
-            const keyData = await createKey(name, dailyLimit);
-            sendJson(res, 201, { 
-                success: true, 
-                message: 'API Key created successfully',
-                data: keyData 
-            });
-            return true;
-        }
-
-        // 处理带 keyId 的路由
-        const keyIdMatch = path.match(/^\/api\/potluck\/keys\/([^\/]+)(\/.*)?$/);
-        if (keyIdMatch) {
-            const keyId = decodeURIComponent(keyIdMatch[1]);
-            const subPath = keyIdMatch[2] || '';
-
-            // GET /api/potluck/keys/:keyId - 获取单个 Key 详情
-            if (method === 'GET' && !subPath) {
-                const keyData = await getKey(keyId);
-                if (!keyData) {
-                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
-                    return true;
-                }
-                sendJson(res, 200, { success: true, data: keyData });
-                return true;
-            }
-
-            // DELETE /api/potluck/keys/:keyId - 删除 Key
-            if (method === 'DELETE' && !subPath) {
-                const deleted = await deleteKey(keyId);
-                if (!deleted) {
-                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
-                    return true;
-                }
-                sendJson(res, 200, { success: true, message: 'Key deleted successfully' });
-                return true;
-            }
-
-            // PUT /api/potluck/keys/:keyId/limit - 更新每日限额
-            if (method === 'PUT' && subPath === '/limit') {
-                const body = await parseRequestBody(req);
-                const { dailyLimit } = body;
-                
-                if (typeof dailyLimit !== 'number' || dailyLimit < 0) {
-                    sendJson(res, 400, { 
-                        success: false, 
-                        error: { message: 'Invalid dailyLimit value' } 
-                    });
-                    return true;
-                }
-
-                const keyData = await updateKeyLimit(keyId, dailyLimit);
-                if (!keyData) {
-                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
-                    return true;
-                }
-                sendJson(res, 200, { 
-                    success: true, 
-                    message: 'Daily limit updated successfully',
-                    data: keyData 
-                });
-                return true;
-            }
-
-            // POST /api/potluck/keys/:keyId/reset - 重置当天调用次数
-            if (method === 'POST' && subPath === '/reset') {
-                const keyData = await resetKeyUsage(keyId);
-                if (!keyData) {
-                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
-                    return true;
-                }
-                sendJson(res, 200, { 
-                    success: true, 
-                    message: 'Usage reset successfully',
-                    data: keyData 
-                });
-                return true;
-            }
-
-            // POST /api/potluck/keys/:keyId/toggle - 切换启用/禁用状态
-            if (method === 'POST' && subPath === '/toggle') {
-                const keyData = await toggleKey(keyId);
-                if (!keyData) {
-                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
-                    return true;
-                }
-                sendJson(res, 200, { 
-                    success: true, 
-                    message: `Key ${keyData.enabled ? 'enabled' : 'disabled'} successfully`,
-                    data: keyData 
-                });
-                return true;
-            }
-
-            // PUT /api/potluck/keys/:keyId/name - 更新 Key 名称
-            if (method === 'PUT' && subPath === '/name') {
-                const body = await parseRequestBody(req);
-                const { name } = body;
-                
-                if (!name || typeof name !== 'string') {
-                    sendJson(res, 400, { 
-                        success: false, 
-                        error: { message: 'Invalid name value' } 
-                    });
-                    return true;
-                }
-
-                const keyData = await updateKeyName(keyId, name);
-                if (!keyData) {
-                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
-                    return true;
-                }
-                sendJson(res, 200, { 
-                    success: true, 
-                    message: 'Name updated successfully',
-                    data: keyData 
-                });
-                return true;
-            }
-        }
-
-        // 未匹配的 potluck 路由
-        sendJson(res, 404, { success: false, error: { message: 'Potluck API endpoint not found' } });
-        return true;
-
-    } catch (error) {
-        console.error('[API Potluck] API error:', error);
-        sendJson(res, 500, { 
-            success: false, 
-            error: { message: error.message || 'Internal server error' } 
-        });
-        return true;
-    }
-}
diff --git a/src/api-potluck/index.js b/src/api-potluck/index.js
deleted file mode 100644
index 4530c20..0000000
--- a/src/api-potluck/index.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * API 大锅饭 - 模块入口
- * 导出所有功能供外部使用
- */
-
-// Key 管理
-export {
-    createKey,
-    listKeys,
-    getKey,
-    deleteKey,
-    updateKeyLimit,
-    resetKeyUsage,
-    toggleKey,
-    updateKeyName,
-    validateKey,
-    incrementUsage,
-    getStats,
-    KEY_PREFIX,
-    DEFAULT_DAILY_LIMIT
-} from './key-manager.js';
-
-// 中间件
-export {
-    extractPotluckKey,
-    isPotluckRequest,
-    potluckAuthMiddleware,
-    recordPotluckUsage,
-    sendPotluckError
-} from './middleware.js';
-
-// API 路由
-export { handlePotluckApiRoutes } from './api-routes.js';
diff --git a/src/api-server.js b/src/api-server.js
index 342fac0..3a305eb 100644
--- a/src/api-server.js
+++ b/src/api-server.js
@@ -4,6 +4,7 @@ import { initApiService, autoLinkProviderConfigs } from './service-manager.js';
 import { initializeUIManagement } from './ui-manager.js';
 import { initializeAPIManagement } from './api-manager.js';
 import { createRequestHandler } from './request-handler.js';
+import { discoverPlugins, getPluginManager } from './plugin-manager.js';
 
 /**
  * @license
@@ -224,6 +225,22 @@ async function startServer() {
     console.log('[Initialization] Checking for unlinked provider configs...');
     await autoLinkProviderConfigs(CONFIG);
 
+    // Initialize plugin system
+    console.log('[Initialization] Discovering and initializing plugins...');
+    await discoverPlugins();
+    const pluginManager = getPluginManager();
+    await pluginManager.initAll(CONFIG);
+    
+    // Log loaded plugins
+    const pluginList = pluginManager.getPluginList();
+    if (pluginList.length > 0) {
+        console.log(`[Plugins] Loaded ${pluginList.length} plugin(s):`);
+        pluginList.forEach(p => {
+            const status = p.enabled ? '✓' : '✗';
+            console.log(`  ${status} ${p.name} v${p.version} - ${p.description}`);
+        });
+    }
+
     // Initialize API services
     const services = await initApiService(CONFIG);
     
diff --git a/src/claude/claude-kiro.js b/src/claude/claude-kiro.js
index b015eec..1929fa8 100644
--- a/src/claude/claude-kiro.js
+++ b/src/claude/claude-kiro.js
@@ -372,11 +372,19 @@ export class KiroApiService {
     }
 
     async initializeAuth(forceRefresh = false) {
+        // 如果已有 accessToken 且不是强制刷新，直接返回
         if (this.accessToken && !forceRefresh) {
             console.debug('[Kiro Auth] Access token already available and not forced refresh.');
             return;
         }
 
+        // 如果是强制刷新且已有 refreshToken，跳过凭证加载，直接刷新
+        if (forceRefresh && this.refreshToken) {
+            console.debug('[Kiro Auth] Force refresh requested, skipping credential loading.');
+            // 直接跳转到刷新逻辑
+            return this._refreshAccessToken();
+        }
+
         // Helper to load credentials from a file
         const loadCredentialsFromFile = async (filePath) => {
             try {
@@ -486,60 +494,9 @@ export class KiroApiService {
             console.warn(`[Kiro Auth] Error during credential loading: ${error.message}`);
         }
 
-        // Refresh token if forced or if access token is missing but refresh token is available
-        if (forceRefresh || (!this.accessToken && this.refreshToken)) {
-            if (!this.refreshToken) {
-                throw new Error('No refresh token available to refresh access token.');
-            }
-            try {
-                const requestBody = {
-                    refreshToken: this.refreshToken,
-                };
-
-                let refreshUrl = this.refreshUrl;
-                if (this.authMethod !== KIRO_CONSTANTS.AUTH_METHOD_SOCIAL) {
-                    refreshUrl = this.refreshIDCUrl;
-                    requestBody.clientId = this.clientId;
-                    requestBody.clientSecret = this.clientSecret;
-                    requestBody.grantType = 'refresh_token';
-                }
-
-                let response = null;
-                if (this.authMethod === KIRO_CONSTANTS.AUTH_METHOD_SOCIAL) {
-                    response = await this.axiosSocialRefreshInstance.post(refreshUrl, requestBody);
-                    console.log('[Kiro Auth] Token refresh social response: ok');
-                } else {
-                    response = await this.axiosInstance.post(refreshUrl, requestBody);
-                    console.log('[Kiro Auth] Token refresh idc response: ok');
-                }
-
-                if (response.data && response.data.accessToken) {
-                    this.accessToken = response.data.accessToken;
-                    this.refreshToken = response.data.refreshToken;
-                    this.profileArn = response.data.profileArn;
-                    const expiresIn = response.data.expiresIn;
-                    const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString();
-                    this.expiresAt = expiresAt;
-                    console.info('[Kiro Auth] Access token refreshed successfully');
-
-                    // Update the token file - use specified path if configured, otherwise use default
-                    const tokenFilePath = this.credsFilePath || path.join(this.credPath, KIRO_AUTH_TOKEN_FILE);
-                    const updatedTokenData = {
-                        accessToken: this.accessToken,
-                        refreshToken: this.refreshToken,
-                        expiresAt: expiresAt,
-                    };
-                    if (this.profileArn) {
-                        updatedTokenData.profileArn = this.profileArn;
-                    }
-                    await saveCredentialsToFile(tokenFilePath, updatedTokenData);
-                } else {
-                    throw new Error('Invalid refresh response: Missing accessToken');
-                }
-            } catch (error) {
-                console.error('[Kiro Auth] Token refresh failed:', error.message);
-                throw new Error(`Token refresh failed: ${error.message}`);
-            }
+        // Refresh token if access token is missing but refresh token is available
+        if (!this.accessToken && this.refreshToken) {
+            await this._refreshAccessToken();
         }
 
         if (!this.accessToken) {
@@ -547,6 +504,88 @@ export class KiroApiService {
         }
     }
 
+    /**
+     * 内部方法：刷新 access token
+     * @private
+     */
+    async _refreshAccessToken() {
+        if (!this.refreshToken) {
+            throw new Error('No refresh token available to refresh access token.');
+        }
+
+        // Helper to save credentials to a file
+        const saveCredentialsToFile = async (filePath, newData) => {
+            try {
+                let existingData = {};
+                try {
+                    const fileContent = await fs.readFile(filePath, 'utf8');
+                    existingData = JSON.parse(fileContent);
+                } catch (readError) {
+                    if (readError.code === 'ENOENT') {
+                        console.debug(`[Kiro Auth] Token file not found, creating new one: ${filePath}`);
+                    } else {
+                        console.warn(`[Kiro Auth] Could not read existing token file ${filePath}: ${readError.message}`);
+                    }
+                }
+                const mergedData = { ...existingData, ...newData };
+                await fs.writeFile(filePath, JSON.stringify(mergedData, null, 2), 'utf8');
+                console.info(`[Kiro Auth] Updated token file: ${filePath}`);
+            } catch (error) {
+                console.error(`[Kiro Auth] Failed to write token to file ${filePath}: ${error.message}`);
+            }
+        };
+
+        try {
+            const requestBody = {
+                refreshToken: this.refreshToken,
+            };
+
+            let refreshUrl = this.refreshUrl;
+            if (this.authMethod !== KIRO_CONSTANTS.AUTH_METHOD_SOCIAL) {
+                refreshUrl = this.refreshIDCUrl;
+                requestBody.clientId = this.clientId;
+                requestBody.clientSecret = this.clientSecret;
+                requestBody.grantType = 'refresh_token';
+            }
+
+            let response = null;
+            if (this.authMethod === KIRO_CONSTANTS.AUTH_METHOD_SOCIAL) {
+                response = await this.axiosSocialRefreshInstance.post(refreshUrl, requestBody);
+                console.log('[Kiro Auth] Token refresh social response: ok');
+            } else {
+                response = await this.axiosInstance.post(refreshUrl, requestBody);
+                console.log('[Kiro Auth] Token refresh idc response: ok');
+            }
+
+            if (response.data && response.data.accessToken) {
+                this.accessToken = response.data.accessToken;
+                this.refreshToken = response.data.refreshToken;
+                this.profileArn = response.data.profileArn;
+                const expiresIn = response.data.expiresIn;
+                const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString();
+                this.expiresAt = expiresAt;
+                console.info('[Kiro Auth] Access token refreshed successfully');
+
+                // Update the token file - use specified path if configured, otherwise use default
+                const tokenFilePath = this.credsFilePath || path.join(this.credPath, KIRO_AUTH_TOKEN_FILE);
+                const updatedTokenData = {
+                    accessToken: this.accessToken,
+                    refreshToken: this.refreshToken,
+                    expiresAt: expiresAt,
+                };
+                if (this.profileArn) {
+                    updatedTokenData.profileArn = this.profileArn;
+                }
+                await saveCredentialsToFile(tokenFilePath, updatedTokenData);
+            } else {
+                throw new Error('Invalid refresh response: Missing accessToken');
+            }
+        } catch (error) {
+            console.error('[Kiro Auth] Token refresh failed:', error.message);
+            throw new Error(`Token refresh failed: ${error.message}`);
+        }
+    }
+
     /**
      * Extract text content from OpenAI message format
      */
diff --git a/src/common.js b/src/common.js
index b71e4ba..1376444 100644
--- a/src/common.js
+++ b/src/common.js
@@ -4,6 +4,7 @@ import * as http from 'http'; // Add http for IncomingMessage and ServerResponse
 import * as crypto from 'crypto'; // Import crypto for MD5 hashing
 import { convertData, getOpenAIStreamChunkStop } from './convert.js';
 import { ProviderStrategyFactory } from './provider-strategies.js';
+import { getPluginManager } from './plugin-manager.js';
 
 // ==================== 网络错误处理 ====================
 
@@ -491,14 +492,11 @@ export async function handleContentGenerationRequest(req, res, service, endpoint
         await handleUnaryRequest(res, service, model, processedRequestBody, fromProvider, toProvider, CONFIG.PROMPT_LOG_MODE, PROMPT_LOG_FILENAME, providerPoolManager, actualUuid, actualCustomName);
     }
 
-    // ============== API 大锅饭插件 - 开始 ==============
-    if (CONFIG.potluckApiKey) {
-        try {
-            const { recordPotluckUsage } = await import('./api-potluck/index.js');
-            await recordPotluckUsage(CONFIG.potluckApiKey);
-        } catch (e) { /* 静默失败，不影响主流程 */ }
-    }
-    // ============== API 大锅饭插件 - 结束 ==============
+    // 执行插件钩子：内容生成后
+    try {
+        const pluginManager = getPluginManager();
+        await pluginManager.executeHook('onContentGenerated', CONFIG);
+    } catch (e) { /* 静默失败，不影响主流程 */ }
 }
 
 /**
diff --git a/src/oauth-handlers.js b/src/oauth-handlers.js
index e0428f1..0c42c87 100644
--- a/src/oauth-handlers.js
+++ b/src/oauth-handlers.js
@@ -1485,6 +1485,7 @@ export async function refreshIFlowTokens(refreshToken) {
  */
 const KIRO_REFRESH_CONSTANTS = {
     REFRESH_URL: 'https://prod.{{region}}.auth.desktop.kiro.dev/refreshToken',
+    REFRESH_IDC_URL: 'https://oidc.{{region}}.amazonaws.com/token',
     CONTENT_TYPE_JSON: 'application/json',
     AUTH_METHOD_SOCIAL: 'social',
     DEFAULT_PROVIDER: 'Google',
diff --git a/src/plugin-manager.js b/src/plugin-manager.js
new file mode 100644
index 0000000..2a8e96d
--- /dev/null
+++ b/src/plugin-manager.js
@@ -0,0 +1,504 @@
+/**
+ * 插件管理器 - 可插拔插件系统核心
+ * 
+ * 功能：
+ * 1. 插件注册与加载
+ * 2. 生命周期管理（init/destroy）
+ * 3. 扩展点管理（中间件、路由、钩子）
+ * 4. 插件配置管理
+ */
+
+import { promises as fs } from 'fs';
+import { existsSync } from 'fs';
+import path from 'path';
+
+// 插件配置文件路径
+const PLUGINS_CONFIG_FILE = path.join(process.cwd(), 'configs', 'plugins.json');
+
+/**
+ * 插件类型常量
+ */
+export const PLUGIN_TYPE = {
+    AUTH: 'auth',           // 认证插件，参与认证流程
+    MIDDLEWARE: 'middleware' // 普通中间件，不参与认证
+};
+
+/**
+ * 插件接口定义（JSDoc 类型）
+ * @typedef {Object} Plugin
+ * @property {string} name - 插件名称（唯一标识）
+ * @property {string} version - 插件版本
+ * @property {string} [description] - 插件描述
+ * @property {string} [type] - 插件类型：'auth'（认证插件）或 'middleware'（普通中间件，默认）
+ * @property {boolean} [enabled] - 是否启用（默认 true）
+ * @property {number} [_priority] - 优先级，数字越小越先执行（默认 100）
+ * @property {boolean} [_builtin] - 是否为内置插件（内置插件最后执行）
+ * @property {Function} [init] - 初始化钩子 (config) => Promise<void>
+ * @property {Function} [destroy] - 销毁钩子 () => Promise<void>
+ * @property {Function} [middleware] - 请求中间件 (req, res, requestUrl, config) => Promise<{handled: boolean, data?: Object}>
+ * @property {Function} [authenticate] - 认证方法（仅 type='auth' 时有效）(req, res, requestUrl, config) => Promise<{handled: boolean, authorized: boolean|null, error?: Object, data?: Object}>
+ * @property {Array<{method: string, path: string|RegExp, handler: Function}>} [routes] - 路由定义
+ * @property {string[]} [staticPaths] - 静态文件路径（相对于 static 目录）
+ * @property {Object} [hooks] - 钩子函数
+ * @property {Function} [hooks.onBeforeRequest] - 请求前钩子 (req, config) => Promise<void>
+ * @property {Function} [hooks.onAfterResponse] - 响应后钩子 (req, res, config) => Promise<void>
+ * @property {Function} [hooks.onContentGenerated] - 内容生成后钩子 (config) => Promise<void>
+ */
+
+/**
+ * 插件管理器类
+ */
+class PluginManager {
+    constructor() {
+        /** @type {Map<string, Plugin>} */
+        this.plugins = new Map();
+        /** @type {Object} */
+        this.pluginsConfig = { plugins: {} };
+        /** @type {boolean} */
+        this.initialized = false;
+    }
+
+    /**
+     * 加载插件配置文件
+     */
+    async loadConfig() {
+        try {
+            if (existsSync(PLUGINS_CONFIG_FILE)) {
+                const content = await fs.readFile(PLUGINS_CONFIG_FILE, 'utf8');
+                this.pluginsConfig = JSON.parse(content);
+            } else {
+                // 创建默认配置
+                this.pluginsConfig = {
+                    plugins: {
+                        'api-potluck': {
+                            enabled: true,
+                            description: 'API 大锅饭 - Key 管理和用量统计'
+                        }
+                    }
+                };
+                await this.saveConfig();
+            }
+        } catch (error) {
+            console.error('[PluginManager] Failed to load config:', error.message);
+            this.pluginsConfig = { plugins: {} };
+        }
+    }
+
+    /**
+     * 保存插件配置文件
+     */
+    async saveConfig() {
+        try {
+            const dir = path.dirname(PLUGINS_CONFIG_FILE);
+            if (!existsSync(dir)) {
+                await fs.mkdir(dir, { recursive: true });
+            }
+            await fs.writeFile(PLUGINS_CONFIG_FILE, JSON.stringify(this.pluginsConfig, null, 2), 'utf8');
+        } catch (error) {
+            console.error('[PluginManager] Failed to save config:', error.message);
+        }
+    }
+
+    /**
+     * 注册插件
+     * @param {Plugin} plugin - 插件对象
+     */
+    register(plugin) {
+        if (!plugin.name) {
+            throw new Error('Plugin must have a name');
+        }
+        if (this.plugins.has(plugin.name)) {
+            console.warn(`[PluginManager] Plugin "${plugin.name}" is already registered, skipping`);
+            return;
+        }
+        this.plugins.set(plugin.name, plugin);
+        console.log(`[PluginManager] Registered plugin: ${plugin.name} v${plugin.version || '1.0.0'}`);
+    }
+
+    /**
+     * 初始化所有已启用的插件
+     * @param {Object} config - 服务器配置
+     */
+    async initAll(config) {
+        await this.loadConfig();
+        
+        for (const [name, plugin] of this.plugins) {
+            const pluginConfig = this.pluginsConfig.plugins[name] || {};
+            const enabled = pluginConfig.enabled !== false; // 默认启用
+            
+            if (!enabled) {
+                console.log(`[PluginManager] Plugin "${name}" is disabled, skipping init`);
+                continue;
+            }
+
+            try {
+                if (typeof plugin.init === 'function') {
+                    await plugin.init(config);
+                    console.log(`[PluginManager] Initialized plugin: ${name}`);
+                }
+                plugin._enabled = true;
+            } catch (error) {
+                console.error(`[PluginManager] Failed to init plugin "${name}":`, error.message);
+                plugin._enabled = false;
+            }
+        }
+        
+        this.initialized = true;
+    }
+
+    /**
+     * 销毁所有插件
+     */
+    async destroyAll() {
+        for (const [name, plugin] of this.plugins) {
+            if (!plugin._enabled) continue;
+            
+            try {
+                if (typeof plugin.destroy === 'function') {
+                    await plugin.destroy();
+                    console.log(`[PluginManager] Destroyed plugin: ${name}`);
+                }
+            } catch (error) {
+                console.error(`[PluginManager] Failed to destroy plugin "${name}":`, error.message);
+            }
+        }
+        this.initialized = false;
+    }
+
+    /**
+     * 检查插件是否启用
+     * @param {string} name - 插件名称
+     * @returns {boolean}
+     */
+    isEnabled(name) {
+        const plugin = this.plugins.get(name);
+        return plugin && plugin._enabled === true;
+    }
+
+    /**
+     * 获取所有启用的插件（按优先级排序）
+     * 优先级数字越小越先执行，内置插件（_builtin: true）最后执行
+     * @returns {Plugin[]}
+     */
+    getEnabledPlugins() {
+        return Array.from(this.plugins.values())
+            .filter(p => p._enabled)
+            .sort((a, b) => {
+                // 内置插件排在最后
+                const aBuiltin = a._builtin ? 1 : 0;
+                const bBuiltin = b._builtin ? 1 : 0;
+                if (aBuiltin !== bBuiltin) return aBuiltin - bBuiltin;
+                
+                // 按优先级排序（数字越小越先执行）
+                const aPriority = a._priority || 100;
+                const bPriority = b._priority || 100;
+                return aPriority - bPriority;
+            });
+    }
+
+    /**
+     * 获取所有认证插件（按优先级排序）
+     * @returns {Plugin[]}
+     */
+    getAuthPlugins() {
+        return this.getEnabledPlugins().filter(p =>
+            p.type === PLUGIN_TYPE.AUTH && typeof p.authenticate === 'function'
+        );
+    }
+
+    /**
+     * 获取所有普通中间件插件（按优先级排序）
+     * @returns {Plugin[]}
+     */
+    getMiddlewarePlugins() {
+        return this.getEnabledPlugins().filter(p =>
+            p.type !== PLUGIN_TYPE.AUTH && typeof p.middleware === 'function'
+        );
+    }
+
+    /**
+     * 执行认证流程
+     * 只有 type='auth' 的插件会参与认证
+     *
+     * 认证插件返回值说明：
+     * - { handled: true } - 请求已被处理（如发送了错误响应），停止后续处理
+     * - { authorized: true, data: {...} } - 认证成功，可附带数据
+     * - { authorized: false } - 认证失败，已发送错误响应
+     * - { authorized: null } - 此插件不处理该请求，继续下一个认证插件
+     *
+     * @param {http.IncomingMessage} req - HTTP 请求
+     * @param {http.ServerResponse} res - HTTP 响应
+     * @param {URL} requestUrl - 解析后的 URL
+     * @param {Object} config - 服务器配置
+     * @returns {Promise<{handled: boolean, authorized: boolean}>}
+     */
+    async executeAuth(req, res, requestUrl, config) {
+        const authPlugins = this.getAuthPlugins();
+        
+        for (const plugin of authPlugins) {
+            try {
+                const result = await plugin.authenticate(req, res, requestUrl, config);
+                
+                if (!result) continue;
+                
+                // 如果请求已被处理（如发送了错误响应），停止执行
+                if (result.handled) {
+                    return { handled: true, authorized: false };
+                }
+                
+                // 如果认证失败，停止执行
+                if (result.authorized === false) {
+                    return { handled: true, authorized: false };
+                }
+                
+                // 如果认证成功，合并数据并返回
+                if (result.authorized === true) {
+                    if (result.data) {
+                        Object.assign(config, result.data);
+                    }
+                    return { handled: false, authorized: true };
+                }
+                
+                // authorized === null 表示此插件不处理，继续下一个
+            } catch (error) {
+                console.error(`[PluginManager] Auth error in plugin "${plugin.name}":`, error.message);
+            }
+        }
+        
+        // 没有任何认证插件处理，返回未授权
+        return { handled: false, authorized: false };
+    }
+
+    /**
+     * 执行普通中间件
+     * 只有 type!='auth' 的插件会执行
+     *
+     * 中间件返回值说明：
+     * - { handled: true } - 请求已被处理，停止后续处理
+     * - { handled: false, data: {...} } - 继续处理，可附带数据
+     * - null/undefined - 继续执行下一个中间件
+     *
+     * @param {http.IncomingMessage} req - HTTP 请求
+     * @param {http.ServerResponse} res - HTTP 响应
+     * @param {URL} requestUrl - 解析后的 URL
+     * @param {Object} config - 服务器配置
+     * @returns {Promise<{handled: boolean}>}
+     */
+    async executeMiddleware(req, res, requestUrl, config) {
+        const middlewarePlugins = this.getMiddlewarePlugins();
+        
+        for (const plugin of middlewarePlugins) {
+            try {
+                const result = await plugin.middleware(req, res, requestUrl, config);
+                
+                if (!result) continue;
+                
+                // 如果请求已被处理，停止执行
+                if (result.handled) {
+                    return { handled: true };
+                }
+                
+                // 合并数据
+                if (result.data) {
+                    Object.assign(config, result.data);
+                }
+            } catch (error) {
+                console.error(`[PluginManager] Middleware error in plugin "${plugin.name}":`, error.message);
+            }
+        }
+        
+        return { handled: false };
+    }
+
+    /**
+     * 执行所有插件的路由处理
+     * @param {string} method - HTTP 方法
+     * @param {string} path - 请求路径
+     * @param {http.IncomingMessage} req - HTTP 请求
+     * @param {http.ServerResponse} res - HTTP 响应
+     * @returns {Promise<boolean>} - 是否已处理
+     */
+    async executeRoutes(method, path, req, res) {
+        for (const plugin of this.getEnabledPlugins()) {
+            if (!Array.isArray(plugin.routes)) continue;
+            
+            for (const route of plugin.routes) {
+                const methodMatch = route.method === '*' || route.method.toUpperCase() === method;
+                if (!methodMatch) continue;
+                
+                let pathMatch = false;
+                if (route.path instanceof RegExp) {
+                    pathMatch = route.path.test(path);
+                } else if (typeof route.path === 'string') {
+                    pathMatch = path === route.path || path.startsWith(route.path + '/');
+                }
+                
+                if (pathMatch) {
+                    try {
+                        const handled = await route.handler(method, path, req, res);
+                        if (handled) return true;
+                    } catch (error) {
+                        console.error(`[PluginManager] Route error in plugin "${plugin.name}":`, error.message);
+                    }
+                }
+            }
+        }
+        return false;
+    }
+
+    /**
+     * 获取所有插件的静态文件路径
+     * @returns {string[]}
+     */
+    getStaticPaths() {
+        const paths = [];
+        for (const plugin of this.getEnabledPlugins()) {
+            if (Array.isArray(plugin.staticPaths)) {
+                paths.push(...plugin.staticPaths);
+            }
+        }
+        return paths;
+    }
+
+    /**
+     * 检查路径是否是插件静态文件
+     * @param {string} path - 请求路径
+     * @returns {boolean}
+     */
+    isPluginStaticPath(path) {
+        const staticPaths = this.getStaticPaths();
+        return staticPaths.some(sp => path === sp || path === '/' + sp);
+    }
+
+    /**
+     * 获取所有插件的公开 API 路径（不需要 UI 管理 API token 验证）
+     * @returns {string[]}
+     */
+    getPublicApiPaths() {
+        const paths = [];
+        for (const plugin of this.getEnabledPlugins()) {
+            if (Array.isArray(plugin.publicApiPaths)) {
+                paths.push(...plugin.publicApiPaths);
+            }
+        }
+        return paths;
+    }
+
+    /**
+     * 检查路径是否是插件公开 API 路径（不需要 UI 管理 API token 验证）
+     * @param {string} path - 请求路径
+     * @returns {boolean}
+     */
+    isPluginPublicApiPath(path) {
+        const publicPaths = this.getPublicApiPaths();
+        return publicPaths.some(pp => path === pp || path.startsWith(pp + '/'));
+    }
+
+    /**
+     * 执行钩子函数
+     * @param {string} hookName - 钩子名称
+     * @param  {...any} args - 钩子参数
+     */
+    async executeHook(hookName, ...args) {
+        for (const plugin of this.getEnabledPlugins()) {
+            if (!plugin.hooks || typeof plugin.hooks[hookName] !== 'function') continue;
+            
+            try {
+                await plugin.hooks[hookName](...args);
+            } catch (error) {
+                console.error(`[PluginManager] Hook "${hookName}" error in plugin "${plugin.name}":`, error.message);
+            }
+        }
+    }
+
+    /**
+     * 获取插件列表（用于 API）
+     * @returns {Object[]}
+     */
+    getPluginList() {
+        const list = [];
+        for (const [name, plugin] of this.plugins) {
+            const pluginConfig = this.pluginsConfig.plugins[name] || {};
+            list.push({
+                name: plugin.name,
+                version: plugin.version || '1.0.0',
+                description: plugin.description || pluginConfig.description || '',
+                enabled: plugin._enabled === true,
+                hasMiddleware: typeof plugin.middleware === 'function',
+                hasRoutes: Array.isArray(plugin.routes) && plugin.routes.length > 0,
+                hasHooks: plugin.hooks && Object.keys(plugin.hooks).length > 0
+            });
+        }
+        return list;
+    }
+
+    /**
+     * 启用/禁用插件
+     * @param {string} name - 插件名称
+     * @param {boolean} enabled - 是否启用
+     */
+    async setPluginEnabled(name, enabled) {
+        if (!this.pluginsConfig.plugins[name]) {
+            this.pluginsConfig.plugins[name] = {};
+        }
+        this.pluginsConfig.plugins[name].enabled = enabled;
+        await this.saveConfig();
+        
+        const plugin = this.plugins.get(name);
+        if (plugin) {
+            plugin._enabled = enabled;
+        }
+    }
+}
+
+// 单例实例
+const pluginManager = new PluginManager();
+
+/**
+ * 自动发现并加载插件
+ * 扫描 src/plugins/ 目录下的所有插件
+ */
+export async function discoverPlugins() {
+    const pluginsDir = path.join(process.cwd(), 'src', 'plugins');
+    
+    try {
+        if (!existsSync(pluginsDir)) {
+            await fs.mkdir(pluginsDir, { recursive: true });
+            console.log('[PluginManager] Created plugins directory');
+        }
+        
+        const entries = await fs.readdir(pluginsDir, { withFileTypes: true });
+        
+        for (const entry of entries) {
+            if (!entry.isDirectory()) continue;
+            
+            const pluginPath = path.join(pluginsDir, entry.name, 'index.js');
+            if (!existsSync(pluginPath)) continue;
+            
+            try {
+                // 动态导入插件
+                const pluginModule = await import(`file://${pluginPath}`);
+                const plugin = pluginModule.default || pluginModule;
+                
+                if (plugin && plugin.name) {
+                    pluginManager.register(plugin);
+                }
+            } catch (error) {
+                console.error(`[PluginManager] Failed to load plugin from ${entry.name}:`, error.message);
+            }
+        }
+    } catch (error) {
+        console.error('[PluginManager] Failed to discover plugins:', error.message);
+    }
+}
+
+/**
+ * 获取插件管理器实例
+ * @returns {PluginManager}
+ */
+export function getPluginManager() {
+    return pluginManager;
+}
+
+// 导出类和实例
+export { PluginManager, pluginManager };
\ No newline at end of file
diff --git a/src/plugins/api-potluck/api-routes.js b/src/plugins/api-potluck/api-routes.js
new file mode 100644
index 0000000..02aef7b
--- /dev/null
+++ b/src/plugins/api-potluck/api-routes.js
@@ -0,0 +1,679 @@
+/**
+ * API 大锅饭 - 管理 API 路由
+ * 提供 Key 管理的 RESTful API 和用户端查询 API
+ */
+
+import {
+    createKey,
+    listKeys,
+    getKey,
+    deleteKey,
+    updateKeyLimit,
+    resetKeyUsage,
+    toggleKey,
+    updateKeyName,
+    getStats,
+    validateKey,
+    KEY_PREFIX
+} from './key-manager.js';
+import path from 'path';
+import { promises as fs } from 'fs';
+import multer from 'multer';
+import { batchImportKiroRefreshTokensStream, importAwsCredentials } from '../../oauth-handlers.js';
+import { handleUploadOAuthCredentials } from '../../ui-manager.js';
+import { autoLinkProviderConfigs } from '../../service-manager.js';
+import { CONFIG } from '../../config-manager.js';
+
+/**
+ * 解析请求体
+ * @param {http.IncomingMessage} req
+ * @returns {Promise<Object>}
+ */
+function parseRequestBody(req) {
+    return new Promise((resolve, reject) => {
+        let body = '';
+        req.on('data', chunk => {
+            body += chunk.toString();
+        });
+        req.on('end', () => {
+            try {
+                resolve(body ? JSON.parse(body) : {});
+            } catch (error) {
+                reject(new Error('Invalid JSON format'));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+
+/**
+ * 发送 JSON 响应
+ * @param {http.ServerResponse} res
+ * @param {number} statusCode
+ * @param {Object} data
+ */
+function sendJson(res, statusCode, data) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(data));
+}
+
+/**
+ * 验证管理员 Token
+ * @param {http.IncomingMessage} req
+ * @returns {Promise<boolean>}
+ */
+async function checkAdminAuth(req) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        return false;
+    }
+    
+    // 动态导入 ui-manager 中的 token 验证逻辑
+    try {
+        const { existsSync, readFileSync } = await import('fs');
+        const { promises: fs } = await import('fs');
+        const path = await import('path');
+        
+        const TOKEN_STORE_FILE = path.join(process.cwd(), 'configs', 'token-store.json');
+        
+        if (!existsSync(TOKEN_STORE_FILE)) {
+            return false;
+        }
+        
+        const content = readFileSync(TOKEN_STORE_FILE, 'utf8');
+        const tokenStore = JSON.parse(content);
+        const token = authHeader.substring(7);
+        const tokenInfo = tokenStore.tokens[token];
+        
+        if (!tokenInfo) {
+            return false;
+        }
+        
+        // 检查是否过期
+        if (Date.now() > tokenInfo.expiryTime) {
+            return false;
+        }
+        
+        return true;
+    } catch (error) {
+        console.error('[API Potluck] Auth check error:', error.message);
+        return false;
+    }
+}
+
+/**
+ * 处理 Potluck 管理 API 请求
+ * @param {string} method - HTTP 方法
+ * @param {string} path - 请求路径
+ * @param {http.IncomingMessage} req - HTTP 请求对象
+ * @param {http.ServerResponse} res - HTTP 响应对象
+ * @returns {Promise<boolean>} - 是否处理了请求
+ */
+export async function handlePotluckApiRoutes(method, path, req, res) {
+    // 只处理 /api/potluck 开头的请求
+    if (!path.startsWith('/api/potluck')) {
+        return false;
+    }
+    console.log('[API Potluck] Handling request:', method, path);
+    
+    // 验证管理员权限
+    const isAuthed = await checkAdminAuth(req);
+    if (!isAuthed) {
+        sendJson(res, 401, { 
+            success: false, 
+            error: { message: 'Unauthorized: Please login first', code: 'UNAUTHORIZED' } 
+        });
+        return true;
+    }
+
+    try {
+        // GET /api/potluck/stats - 获取统计信息
+        if (method === 'GET' && path === '/api/potluck/stats') {
+            const stats = await getStats();
+            sendJson(res, 200, { success: true, data: stats });
+            return true;
+        }
+
+        // GET /api/potluck/keys - 获取所有 Key 列表
+        if (method === 'GET' && path === '/api/potluck/keys') {
+            const keys = await listKeys();
+            const stats = await getStats();
+            sendJson(res, 200, { 
+                success: true, 
+                data: { 
+                    keys, 
+                    stats 
+                } 
+            });
+            return true;
+        }
+
+        // POST /api/potluck/keys - 创建新 Key
+        if (method === 'POST' && path === '/api/potluck/keys') {
+            const body = await parseRequestBody(req);
+            const { name, dailyLimit } = body;
+            const keyData = await createKey(name, dailyLimit);
+            sendJson(res, 201, { 
+                success: true, 
+                message: 'API Key created successfully',
+                data: keyData 
+            });
+            return true;
+        }
+
+        // 处理带 keyId 的路由
+        const keyIdMatch = path.match(/^\/api\/potluck\/keys\/([^\/]+)(\/.*)?$/);
+        if (keyIdMatch) {
+            const keyId = decodeURIComponent(keyIdMatch[1]);
+            const subPath = keyIdMatch[2] || '';
+
+            // GET /api/potluck/keys/:keyId - 获取单个 Key 详情
+            if (method === 'GET' && !subPath) {
+                const keyData = await getKey(keyId);
+                if (!keyData) {
+                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
+                    return true;
+                }
+                sendJson(res, 200, { success: true, data: keyData });
+                return true;
+            }
+
+            // DELETE /api/potluck/keys/:keyId - 删除 Key
+            if (method === 'DELETE' && !subPath) {
+                const deleted = await deleteKey(keyId);
+                if (!deleted) {
+                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
+                    return true;
+                }
+                sendJson(res, 200, { success: true, message: 'Key deleted successfully' });
+                return true;
+            }
+
+            // PUT /api/potluck/keys/:keyId/limit - 更新每日限额
+            if (method === 'PUT' && subPath === '/limit') {
+                const body = await parseRequestBody(req);
+                const { dailyLimit } = body;
+                
+                if (typeof dailyLimit !== 'number' || dailyLimit < 0) {
+                    sendJson(res, 400, { 
+                        success: false, 
+                        error: { message: 'Invalid dailyLimit value' } 
+                    });
+                    return true;
+                }
+
+                const keyData = await updateKeyLimit(keyId, dailyLimit);
+                if (!keyData) {
+                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
+                    return true;
+                }
+                sendJson(res, 200, { 
+                    success: true, 
+                    message: 'Daily limit updated successfully',
+                    data: keyData 
+                });
+                return true;
+            }
+
+            // POST /api/potluck/keys/:keyId/reset - 重置当天调用次数
+            if (method === 'POST' && subPath === '/reset') {
+                const keyData = await resetKeyUsage(keyId);
+                if (!keyData) {
+                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
+                    return true;
+                }
+                sendJson(res, 200, { 
+                    success: true, 
+                    message: 'Usage reset successfully',
+                    data: keyData 
+                });
+                return true;
+            }
+
+            // POST /api/potluck/keys/:keyId/toggle - 切换启用/禁用状态
+            if (method === 'POST' && subPath === '/toggle') {
+                const keyData = await toggleKey(keyId);
+                if (!keyData) {
+                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
+                    return true;
+                }
+                sendJson(res, 200, { 
+                    success: true, 
+                    message: `Key ${keyData.enabled ? 'enabled' : 'disabled'} successfully`,
+                    data: keyData 
+                });
+                return true;
+            }
+
+            // PUT /api/potluck/keys/:keyId/name - 更新 Key 名称
+            if (method === 'PUT' && subPath === '/name') {
+                const body = await parseRequestBody(req);
+                const { name } = body;
+                
+                if (!name || typeof name !== 'string') {
+                    sendJson(res, 400, { 
+                        success: false, 
+                        error: { message: 'Invalid name value' } 
+                    });
+                    return true;
+                }
+
+                const keyData = await updateKeyName(keyId, name);
+                if (!keyData) {
+                    sendJson(res, 404, { success: false, error: { message: 'Key not found' } });
+                    return true;
+                }
+                sendJson(res, 200, { 
+                    success: true, 
+                    message: 'Name updated successfully',
+                    data: keyData 
+                });
+                return true;
+            }
+        }
+
+        // 未匹配的 potluck 路由
+        sendJson(res, 404, { success: false, error: { message: 'Potluck API endpoint not found' } });
+        return true;
+
+    } catch (error) {
+        console.error('[API Potluck] API error:', error);
+        sendJson(res, 500, {
+            success: false,
+            error: { message: error.message || 'Internal server error' }
+        });
+        return true;
+    }
+}
+
+/**
+ * 从请求中提取 Potluck API Key
+ * @param {http.IncomingMessage} req - HTTP 请求对象
+ * @returns {string|null}
+ */
+function extractApiKeyFromRequest(req) {
+    // 1. 检查 Authorization header
+    const authHeader = req.headers['authorization'];
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+        const token = authHeader.substring(7);
+        if (token.startsWith(KEY_PREFIX)) {
+            return token;
+        }
+    }
+
+    // 2. 检查 x-api-key header
+    const xApiKey = req.headers['x-api-key'];
+    if (xApiKey && xApiKey.startsWith(KEY_PREFIX)) {
+        return xApiKey;
+    }
+
+    return null;
+}
+
+/**
+ * 处理用户端 API 请求 - 用户通过自己的 API Key 查询使用量
+ * @param {string} method - HTTP 方法
+ * @param {string} path - 请求路径
+ * @param {http.IncomingMessage} req - HTTP 请求对象
+ * @param {http.ServerResponse} res - HTTP 响应对象
+ * @returns {Promise<boolean>} - 是否处理了请求
+ */
+export async function handlePotluckUserApiRoutes(method, path, req, res) {
+    // 只处理 /api/potluckuser 开头的请求
+    if (!path.startsWith('/api/potluckuser')) {
+        return false;
+    }
+    console.log('[API Potluck User] Handling request:', method, path);
+
+    try {
+        // 从请求中提取 API Key
+        const apiKey = extractApiKeyFromRequest(req);
+        
+        if (!apiKey) {
+            sendJson(res, 401, {
+                success: false,
+                error: {
+                    message: 'API Key required. Please provide your API Key in Authorization header (Bearer maki_xxx) or x-api-key header.',
+                    code: 'API_KEY_REQUIRED'
+                }
+            });
+            return true;
+        }
+
+        // 验证 API Key
+        const validation = await validateKey(apiKey);
+        
+        if (!validation.valid && validation.reason !== 'quota_exceeded') {
+            const errorMessages = {
+                'invalid_format': 'Invalid API key format',
+                'not_found': 'API key not found',
+                'disabled': 'API key has been disabled'
+            };
+            
+            sendJson(res, 401, {
+                success: false,
+                error: {
+                    message: errorMessages[validation.reason] || 'Invalid API key',
+                    code: validation.reason
+                }
+            });
+            return true;
+        }
+
+        // GET /api/potluckuser/usage - 获取当前用户的使用量信息
+        if (method === 'GET' && path === '/api/potluckuser/usage') {
+            const keyData = await getKey(apiKey);
+            
+            if (!keyData) {
+                sendJson(res, 404, {
+                    success: false,
+                    error: { message: 'Key not found', code: 'KEY_NOT_FOUND' }
+                });
+                return true;
+            }
+
+            // 计算使用百分比
+            const usagePercent = keyData.dailyLimit > 0
+                ? Math.round((keyData.todayUsage / keyData.dailyLimit) * 100)
+                : 0;
+
+            // 返回用户友好的使用量信息（隐藏敏感信息）
+            sendJson(res, 200, {
+                success: true,
+                data: {
+                    name: keyData.name,
+                    enabled: keyData.enabled,
+                    usage: {
+                        today: keyData.todayUsage,
+                        limit: keyData.dailyLimit,
+                        remaining: Math.max(0, keyData.dailyLimit - keyData.todayUsage),
+                        percent: usagePercent,
+                        resetDate: keyData.lastResetDate
+                    },
+                    total: keyData.totalUsage,
+                    lastUsedAt: keyData.lastUsedAt,
+                    createdAt: keyData.createdAt,
+                    // 显示部分遮蔽的 Key ID
+                    maskedKey: `${apiKey.substring(0, 12)}...${apiKey.substring(apiKey.length - 4)}`
+                }
+            });
+            return true;
+        }
+
+        // POST /api/potluckuser/upload - 上传授权文件
+        if (method === 'POST' && path === '/api/potluckuser/upload') {
+            return await handleUserUpload(req, res, apiKey);
+        }
+
+        // POST /api/potluckuser/kiro/batch-import-tokens - 批量导入 Kiro refresh token
+        if (method === 'POST' && path === '/api/potluckuser/kiro/batch-import-tokens') {
+            return await handleKiroBatchImportTokens(req, res, apiKey);
+        }
+
+        // POST /api/potluckuser/kiro/import-aws-credentials - 导入 AWS SSO 凭据
+        if (method === 'POST' && path === '/api/potluckuser/kiro/import-aws-credentials') {
+            return await handleKiroImportAwsCredentials(req, res, apiKey);
+        }
+
+        // 未匹配的用户端路由
+        sendJson(res, 404, {
+            success: false,
+            error: { message: 'User API endpoint not found' }
+        });
+        return true;
+
+    } catch (error) {
+        console.error('[API Potluck] User API error:', error);
+        sendJson(res, 500, {
+            success: false,
+            error: { message: error.message || 'Internal server error' }
+        });
+        return true;
+    }
+}
+
+/**
+ * 提供商映射
+ */
+const providerMap = {
+    'gemini-cli-oauth': 'gemini',
+    'gemini-antigravity': 'antigravity',
+    'claude-kiro-oauth': 'kiro',
+    'openai-qwen-oauth': 'qwen',
+    'openai-iflow': 'iflow'
+};
+
+/**
+ * 配置 multer 用于用户上传
+ */
+const userUploadStorage = multer.diskStorage({
+    destination: async (req, file, cb) => {
+        try {
+            // 先使用临时目录
+            const uploadPath = path.join(process.cwd(), 'configs', 'temp');
+            await fs.mkdir(uploadPath, { recursive: true });
+            cb(null, uploadPath);
+        } catch (error) {
+            cb(error);
+        }
+    },
+    filename: (req, file, cb) => {
+        const timestamp = Date.now();
+        const sanitizedName = file.originalname.replace(/[^a-zA-Z0-9.-]/g, '_');
+        cb(null, `${timestamp}_${sanitizedName}`);
+    }
+});
+
+const userUploadFileFilter = (req, file, cb) => {
+    const allowedTypes = ['.json', '.txt', '.key', '.pem', '.p12', '.pfx'];
+    const ext = path.extname(file.originalname).toLowerCase();
+    if (allowedTypes.includes(ext)) {
+        cb(null, true);
+    } else {
+        cb(new Error('Unsupported file type'), false);
+    }
+};
+
+const userUpload = multer({
+    storage: userUploadStorage,
+    fileFilter: userUploadFileFilter,
+    limits: {
+        fileSize: 5 * 1024 * 1024 // 5MB 限制
+    }
+});
+
+/**
+ * 处理用户上传授权文件（带自动绑定功能）
+ * @param {http.IncomingMessage} req
+ * @param {http.ServerResponse} res
+ * @param {string} apiKey - 用户的 API Key
+ * @returns {Promise<boolean>}
+ */
+async function handleUserUpload(req, res, apiKey) {
+    // 创建一个包装的响应对象来捕获上传结果
+    let uploadResult = null;
+    const originalEnd = res.end.bind(res);
+    const originalWriteHead = res.writeHead.bind(res);
+    let statusCode = 200;
+    
+    // 拦截响应以获取上传结果
+    res.writeHead = function(code, headers) {
+        statusCode = code;
+        return originalWriteHead(code, headers);
+    };
+    
+    res.end = function(data) {
+        if (statusCode === 200 && data) {
+            try {
+                uploadResult = JSON.parse(data);
+            } catch (e) {
+                // 忽略解析错误
+            }
+        }
+        return originalEnd(data);
+    };
+    
+    // 执行文件上传
+    const handled = await handleUploadOAuthCredentials(req, res, {
+        providerMap: providerMap,
+        logPrefix: '[API Potluck User]',
+        userInfo: `user: ${apiKey.substring(0, 12)}...`,
+        customUpload: userUpload
+    });
+    
+    // 如果上传成功，调用自动绑定功能扫描并绑定新上传的配置文件
+    if (uploadResult && uploadResult.success && uploadResult.filePath) {
+        try {
+            console.log(`[API Potluck User] Triggering auto-link for uploaded file: ${uploadResult.filePath}`);
+            await autoLinkProviderConfigs(CONFIG);
+        } catch (linkError) {
+            // 自动绑定失败不影响上传结果，只记录日志
+            console.warn(`[API Potluck User] Auto-link failed:`, linkError.message);
+        }
+    }
+    
+    return handled;
+}
+
+/**
+ * 处理 Kiro 批量导入 Refresh Token
+ * @param {http.IncomingMessage} req
+ * @param {http.ServerResponse} res
+ * @param {string} apiKey - 用户的 API Key
+ */
+async function handleKiroBatchImportTokens(req, res, apiKey) {
+    try {
+        const body = await parseRequestBody(req);
+        const { refreshTokens, region } = body;
+        
+        if (!refreshTokens || !Array.isArray(refreshTokens) || refreshTokens.length === 0) {
+            sendJson(res, 400, {
+                success: false,
+                error: 'refreshTokens array is required and must not be empty'
+            });
+            return true;
+        }
+        
+        console.log(`[API Potluck User] Starting batch import of ${refreshTokens.length} tokens (user: ${apiKey.substring(0, 12)}...)`);
+        
+        // 设置 SSE 响应头
+        res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache',
+            'Connection': 'keep-alive',
+            'X-Accel-Buffering': 'no'
+        });
+        
+        // 发送 SSE 事件的辅助函数
+        const sendSSE = (event, data) => {
+            res.write(`event: ${event}\n`);
+            res.write(`data: ${JSON.stringify(data)}\n\n`);
+        };
+        
+        // 发送开始事件
+        sendSSE('start', { total: refreshTokens.length });
+        
+        // 执行流式批量导入
+        const result = await batchImportKiroRefreshTokensStream(
+            refreshTokens,
+            region || 'us-east-1',
+            (progress) => {
+                // 每处理完一个 token 发送进度更新
+                sendSSE('progress', progress);
+            }
+        );
+        
+        console.log(`[API Potluck User] Completed: ${result.success} success, ${result.failed} failed`);
+        
+        // 发送完成事件
+        sendSSE('complete', {
+            success: true,
+            total: result.total,
+            successCount: result.success,
+            failedCount: result.failed,
+            details: result.details
+        });
+        
+        res.end();
+        return true;
+        
+    } catch (error) {
+        console.error('[API Potluck User] Kiro Batch Import Error:', error);
+        if (res.headersSent) {
+            res.write(`event: error\n`);
+            res.write(`data: ${JSON.stringify({ error: error.message })}\n\n`);
+            res.end();
+        } else {
+            sendJson(res, 500, {
+                success: false,
+                error: error.message
+            });
+        }
+        return true;
+    }
+}
+
+/**
+ * 处理 Kiro 导入 AWS 凭据
+ * @param {http.IncomingMessage} req
+ * @param {http.ServerResponse} res
+ * @param {string} apiKey - 用户的 API Key
+ */
+async function handleKiroImportAwsCredentials(req, res, apiKey) {
+    try {
+        const body = await parseRequestBody(req);
+        const { credentials } = body;
+        
+        if (!credentials || typeof credentials !== 'object') {
+            sendJson(res, 400, {
+                success: false,
+                error: 'credentials object is required'
+            });
+            return true;
+        }
+        
+        // 验证必需字段
+        const missingFields = [];
+        if (!credentials.clientId) missingFields.push('clientId');
+        if (!credentials.clientSecret) missingFields.push('clientSecret');
+        if (!credentials.accessToken) missingFields.push('accessToken');
+        if (!credentials.refreshToken) missingFields.push('refreshToken');
+        
+        if (missingFields.length > 0) {
+            sendJson(res, 400, {
+                success: false,
+                error: `Missing required fields: ${missingFields.join(', ')}`
+            });
+            return true;
+        }
+        
+        console.log(`[API Potluck User] Starting AWS credentials import (user: ${apiKey.substring(0, 12)}...)`);
+        
+        const result = await importAwsCredentials(credentials);
+        
+        if (result.success) {
+            console.log(`[API Potluck User] Successfully imported credentials to: ${result.path}`);
+            sendJson(res, 200, {
+                success: true,
+                path: result.path,
+                message: 'AWS credentials imported successfully'
+            });
+        } else {
+            const statusCode = result.error === 'duplicate' ? 409 : 500;
+            sendJson(res, statusCode, {
+                success: false,
+                error: result.error,
+                existingPath: result.existingPath || null
+            });
+        }
+        return true;
+        
+    } catch (error) {
+        console.error('[API Potluck User] Kiro AWS Import Error:', error);
+        sendJson(res, 500, {
+            success: false,
+            error: error.message
+        });
+        return true;
+    }
+}
diff --git a/src/plugins/api-potluck/index.js b/src/plugins/api-potluck/index.js
new file mode 100644
index 0000000..7e04c99
--- /dev/null
+++ b/src/plugins/api-potluck/index.js
@@ -0,0 +1,210 @@
+/**
+ * API 大锅饭插件 - 标准插件格式
+ * 
+ * 功能：
+ * 1. API Key 管理（创建、删除、启用/禁用）
+ * 2. 每日配额限制
+ * 3. 用量统计
+ * 4. 管理 API 接口
+ */
+
+import {
+    createKey,
+    listKeys,
+    getKey,
+    deleteKey,
+    updateKeyLimit,
+    resetKeyUsage,
+    toggleKey,
+    updateKeyName,
+    validateKey,
+    incrementUsage,
+    getStats,
+    KEY_PREFIX,
+    DEFAULT_DAILY_LIMIT
+} from './key-manager.js';
+
+import {
+    extractPotluckKey,
+    isPotluckRequest,
+    sendPotluckError
+} from './middleware.js';
+
+import { handlePotluckApiRoutes, handlePotluckUserApiRoutes } from './api-routes.js';
+
+/**
+ * 插件定义
+ */
+const apiPotluckPlugin = {
+    name: 'api-potluck',
+    version: '1.0.0',
+    description: 'API 大锅饭 - Key 管理和用量统计插件',
+    
+    // 插件类型：认证插件
+    type: 'auth',
+    
+    // 优先级：数字越小越先执行，默认认证插件优先级为 9999
+    _priority: 10,
+
+    /**
+     * 初始化钩子
+     * @param {Object} config - 服务器配置
+     */
+    async init(config) {
+        console.log('[API Potluck Plugin] Initializing...');
+        // 插件初始化逻辑（如果需要）
+    },
+
+    /**
+     * 销毁钩子
+     */
+    async destroy() {
+        console.log('[API Potluck Plugin] Destroying...');
+        // 清理逻辑（如果需要）
+    },
+
+    /**
+     * 静态文件路径
+     */
+    staticPaths: ['potluck.html', 'potluck-user.html'],
+
+    /**
+     * 公开 API 路径（不需要 UI 管理 API 的 token 验证）
+     * 这些路径将跳过 handleUIApiRequests 中的 checkAuth 验证
+     */
+    publicApiPaths: ['/api/potluckuser'],
+
+    /**
+     * 路由定义
+     */
+    routes: [
+        {
+            method: '*',
+            path: '/api/potluckuser',
+            handler: handlePotluckUserApiRoutes
+        },
+        {
+            method: '*',
+            path: '/api/potluck',
+            handler: handlePotluckApiRoutes
+        }
+    ],
+
+    /**
+     * 认证方法 - 处理 Potluck Key 认证
+     * @param {http.IncomingMessage} req - HTTP 请求
+     * @param {http.ServerResponse} res - HTTP 响应
+     * @param {URL} requestUrl - 解析后的 URL
+     * @param {Object} config - 服务器配置
+     * @returns {Promise<{handled: boolean, authorized: boolean|null, error?: Object, data?: Object}>}
+     */
+    async authenticate(req, res, requestUrl, config) {
+        const apiKey = extractPotluckKey(req, requestUrl);
+        
+        if (!apiKey) {
+            // 不是 potluck 请求，返回 null 让其他认证插件处理
+            return { handled: false, authorized: null };
+        }
+
+        // 验证 Key
+        const validation = await validateKey(apiKey);
+        
+        if (!validation.valid) {
+            const errorMessages = {
+                'invalid_format': 'Invalid API key format',
+                'not_found': 'API key not found',
+                'disabled': 'API key has been disabled',
+                'quota_exceeded': 'Daily quota exceeded for this API key'
+            };
+
+            const statusCodes = {
+                'invalid_format': 401,
+                'not_found': 401,
+                'disabled': 403,
+                'quota_exceeded': 429
+            };
+
+            const error = {
+                statusCode: statusCodes[validation.reason] || 401,
+                message: errorMessages[validation.reason] || 'Authentication failed',
+                code: validation.reason,
+                keyData: validation.keyData
+            };
+
+            // 发送错误响应
+            sendPotluckError(res, error);
+            return { handled: true, authorized: false, error };
+        }
+
+        // 认证成功，返回数据供后续使用
+        console.log(`[API Potluck Plugin] Authorized with key: ${apiKey.substring(0, 12)}...`);
+        return {
+            handled: false,
+            authorized: true,
+            data: {
+                potluckApiKey: apiKey,
+                potluckKeyData: validation.keyData
+            }
+        };
+    },
+
+    /**
+     * 钩子函数
+     */
+    hooks: {
+        /**
+         * 内容生成后钩子 - 记录用量
+         * @param {Object} config - 服务器配置
+         */
+        async onContentGenerated(config) {
+            if (config.potluckApiKey) {
+                try {
+                    await incrementUsage(config.potluckApiKey);
+                } catch (e) {
+                    // 静默失败，不影响主流程
+                    console.error('[API Potluck Plugin] Failed to record usage:', e.message);
+                }
+            }
+        }
+    },
+
+    // 导出内部函数供外部使用（可选）
+    exports: {
+        createKey,
+        listKeys,
+        getKey,
+        deleteKey,
+        updateKeyLimit,
+        resetKeyUsage,
+        toggleKey,
+        updateKeyName,
+        validateKey,
+        incrementUsage,
+        getStats,
+        KEY_PREFIX,
+        DEFAULT_DAILY_LIMIT,
+        extractPotluckKey,
+        isPotluckRequest
+    }
+};
+
+export default apiPotluckPlugin;
+
+// 也导出命名导出，方便直接引用
+export {
+    createKey,
+    listKeys,
+    getKey,
+    deleteKey,
+    updateKeyLimit,
+    resetKeyUsage,
+    toggleKey,
+    updateKeyName,
+    validateKey,
+    incrementUsage,
+    getStats,
+    KEY_PREFIX,
+    DEFAULT_DAILY_LIMIT,
+    extractPotluckKey,
+    isPotluckRequest
+};
\ No newline at end of file
diff --git a/src/api-potluck/key-manager.js b/src/plugins/api-potluck/key-manager.js
similarity index 100%
rename from src/api-potluck/key-manager.js
rename to src/plugins/api-potluck/key-manager.js
diff --git a/src/api-potluck/middleware.js b/src/plugins/api-potluck/middleware.js
similarity index 100%
rename from src/api-potluck/middleware.js
rename to src/plugins/api-potluck/middleware.js
diff --git a/src/plugins/default-auth/index.js b/src/plugins/default-auth/index.js
new file mode 100644
index 0000000..d95109c
--- /dev/null
+++ b/src/plugins/default-auth/index.js
@@ -0,0 +1,89 @@
+/**
+ * 默认认证插件 - 内置插件
+ *
+ * 提供基于 API Key 的默认认证机制
+ * 支持多种认证方式：
+ * 1. Authorization: Bearer <key>
+ * 2. x-api-key: <key>
+ * 3. x-goog-api-key: <key>
+ * 4. URL query: ?key=<key>
+ */
+
+/**
+ * 检查请求是否已授权
+ * @param {http.IncomingMessage} req - HTTP 请求
+ * @param {URL} requestUrl - 解析后的 URL
+ * @param {string} requiredApiKey - 所需的 API Key
+ * @returns {boolean}
+ */
+function isAuthorized(req, requestUrl, requiredApiKey) {
+    const authHeader = req.headers['authorization'];
+    const queryKey = requestUrl.searchParams.get('key');
+    const googApiKey = req.headers['x-goog-api-key'];
+    const claudeApiKey = req.headers['x-api-key'];
+
+    // Check for Bearer token in Authorization header (OpenAI style)
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+        const token = authHeader.substring(7);
+        if (token === requiredApiKey) {
+            return true;
+        }
+    }
+
+    // Check for API key in URL query parameter (Gemini style)
+    if (queryKey === requiredApiKey) {
+        return true;
+    }
+
+    // Check for API key in x-goog-api-key header (Gemini style)
+    if (googApiKey === requiredApiKey) {
+        return true;
+    }
+
+    // Check for API key in x-api-key header (Claude style)
+    if (claudeApiKey === requiredApiKey) {
+        return true;
+    }
+
+    return false;
+}
+
+/**
+ * 默认认证插件定义
+ */
+const defaultAuthPlugin = {
+    name: 'default-auth',
+    version: '1.0.0',
+    description: '默认 API Key 认证插件',
+    
+    // 插件类型：认证插件
+    type: 'auth',
+    
+    // 标记为内置插件，优先级最低（最后执行）
+    _builtin: true,
+    _priority: 9999,
+
+    /**
+     * 认证方法 - 默认 API Key 认证
+     * @param {http.IncomingMessage} req - HTTP 请求
+     * @param {http.ServerResponse} res - HTTP 响应
+     * @param {URL} requestUrl - 解析后的 URL
+     * @param {Object} config - 服务器配置
+     * @returns {Promise<{handled: boolean, authorized: boolean|null}>}
+     */
+    async authenticate(req, res, requestUrl, config) {
+        // 执行默认认证
+        if (isAuthorized(req, requestUrl, config.REQUIRED_API_KEY)) {
+            // 认证成功
+            return { handled: false, authorized: true };
+        }
+
+        // 认证失败，记录日志但不发送响应（由 request-handler 统一处理）
+        console.log(`[Default Auth] Unauthorized request. Headers: Authorization=${req.headers['authorization'] ? 'present' : 'N/A'}, x-api-key=${req.headers['x-api-key'] || 'N/A'}, x-goog-api-key=${req.headers['x-goog-api-key'] || 'N/A'}`);
+        
+        // 返回 null 表示此插件不授权，让其他插件或默认逻辑处理
+        return { handled: false, authorized: null };
+    }
+};
+
+export default defaultAuthPlugin;
\ No newline at end of file
diff --git a/src/request-handler.js b/src/request-handler.js
index eb5c4e0..1150d16 100644
--- a/src/request-handler.js
+++ b/src/request-handler.js
@@ -1,5 +1,5 @@
 import deepmerge from 'deepmerge';
-import { handleError, isAuthorized } from './common.js';
+import { handleError } from './common.js';
 import { handleUIApiRequests, serveStaticFiles } from './ui-manager.js';
 import { handleAPIRequests } from './api-manager.js';
 import { getApiService, getProviderStatus } from './service-manager.js';
@@ -7,10 +7,7 @@ import { getProviderPoolManager } from './service-manager.js';
 import { MODEL_PROVIDER } from './common.js';
 import { PROMPT_LOG_FILENAME } from './config-manager.js';
 import { handleOllamaRequest, handleOllamaShow } from './ollama-handler.js';
-
-// ============== API 大锅饭插件 - 开始 ==============
-import { handlePotluckApiRoutes, potluckAuthMiddleware, sendPotluckError } from './api-potluck/index.js';
-// ============== API 大锅饭插件 - 结束 ==============
+import { getPluginManager } from './plugin-manager.js';
 
 /**
  * Parse request body as JSON
@@ -58,8 +55,10 @@ export function createRequestHandler(config, providerPoolManager) {
         }
 
         // Serve static files for UI (除了登录页面需要认证)
-        // ============== API 大锅饭插件: 添加 /potluck.html ==============
-        if (path.startsWith('/static/') || path === '/' || path === '/favicon.ico' || path === '/index.html' || path.startsWith('/app/') || path === '/login.html' || path === '/potluck.html') {
+        // 检查是否是插件静态文件
+        const pluginManager = getPluginManager();
+        const isPluginStatic = pluginManager.isPluginStaticPath(path);
+        if (path.startsWith('/static/') || path === '/' || path === '/favicon.ico' || path === '/index.html' || path.startsWith('/app/') || path === '/login.html' || isPluginStatic) {
             const served = await serveStaticFiles(path, res);
             if (served) return;
         }
@@ -67,10 +66,9 @@ export function createRequestHandler(config, providerPoolManager) {
         const uiHandled = await handleUIApiRequests(method, path, req, res, currentConfig, providerPoolManager);
         if (uiHandled) return;
 
-        // ============== API 大锅饭插件 - 开始 ==============
-        const potluckRouteHandled = await handlePotluckApiRoutes(method, path, req, res);
-        if (potluckRouteHandled) return;
-        // ============== API 大锅饭插件 - 结束 ==============
+        // 执行插件路由
+        const pluginRouteHandled = await pluginManager.executeRoutes(method, path, req, res);
+        if (pluginRouteHandled) return;
 
         // Ollama show endpoint with model name
         if (method === 'POST' && path === '/ollama/api/show') {
@@ -153,21 +151,25 @@ export function createRequestHandler(config, providerPoolManager) {
             }
         }
 
-        // Check authentication for API requests (before Ollama handling to allow unauthenticated Ollama endpoints)
-        // ============== API 大锅饭插件 - 开始 ==============
-        const potluckAuth = await potluckAuthMiddleware(req, requestUrl);
-        if (potluckAuth.authorized === false) {
-            sendPotluckError(res, potluckAuth.error);
+        // 1. 执行认证流程（只有 type='auth' 的插件参与）
+        const authResult = await pluginManager.executeAuth(req, res, requestUrl, currentConfig);
+        if (authResult.handled) {
+            // 认证插件已处理请求（如发送了错误响应）
             return;
-        } else if (potluckAuth.authorized === true) {
-            currentConfig.potluckApiKey = potluckAuth.apiKey;
-            console.log(`[API Potluck] Authorized with key: ${potluckAuth.apiKey.substring(0, 12)}...`);
-        } else if (!isAuthorized(req, requestUrl, currentConfig.REQUIRED_API_KEY)) {
-        // ============== API 大锅饭插件 - 结束 ==============
+        }
+        if (!authResult.authorized) {
+            // 没有认证插件授权，返回 401
             res.writeHead(401, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: { message: 'Unauthorized: API key is invalid or missing.' } }));
             return;
         }
+        
+        // 2. 执行普通中间件（type!='auth' 的插件）
+        const middlewareResult = await pluginManager.executeMiddleware(req, res, requestUrl, currentConfig);
+        if (middlewareResult.handled) {
+            // 中间件已处理请求
+            return;
+        }
 
         // Handle Ollama request BEFORE getting apiService (Ollama endpoints handle their own provider selection)
         // This is important because Ollama /api/tags aggregates models from ALL providers, not just the default one
diff --git a/src/ui-manager.js b/src/ui-manager.js
index 8c15a64..e23ca22 100644
--- a/src/ui-manager.js
+++ b/src/ui-manager.js
@@ -56,6 +56,7 @@ import { getAllProviderModels, getProviderModels } from './provider-models.js';
 import { CONFIG } from './config-manager.js';
 import { serviceInstances, getServiceAdapter } from './adapter.js';
 import { initApiService } from './service-manager.js';
+import { getPluginManager } from './plugin-manager.js';
 import { handleGeminiCliOAuth, handleGeminiAntigravityOAuth, handleQwenOAuth, handleKiroOAuth, handleIFlowOAuth, batchImportKiroRefreshTokens, batchImportKiroRefreshTokensStream, importAwsCredentials } from './oauth-handlers.js';
 import {
     generateUUID,
@@ -517,8 +518,10 @@ export async function handleUIApiRequests(method, pathParam, req, res, currentCo
         return true;
     }
     
-    // Handle UI management API requests (需要token验证，除了登录接口、健康检查和Events接口)
-    if (pathParam.startsWith('/api/') && pathParam !== '/api/login' && pathParam !== '/api/health' && pathParam !== '/api/events') {
+    // Handle UI management API requests (需要token验证，除了登录接口、健康检查、Events接口和插件公开API路径)
+    const pluginManager = getPluginManager();
+    const isPluginPublicApi = pluginManager.isPluginPublicApiPath(pathParam);
+    if (pathParam.startsWith('/api/') && pathParam !== '/api/login' && pathParam !== '/api/health' && pathParam !== '/api/events' && !isPluginPublicApi) {
         // 检查token验证
         const isAuth = await checkAuth(req);
         if (!isAuth) {
@@ -539,84 +542,7 @@ export async function handleUIApiRequests(method, pathParam, req, res, currentCo
 
     // 文件上传API
     if (method === 'POST' && pathParam === '/api/upload-oauth-credentials') {
-        const uploadMiddleware = upload.single('file');
-        
-        uploadMiddleware(req, res, async (err) => {
-            if (err) {
-                console.error('[UI API] File upload error:', err.message);
-                res.writeHead(400, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: {
-                        message: err.message || 'File upload failed'
-                    }
-                }));
-                return;
-            }
-
-            try {
-                if (!req.file) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        error: {
-                            message: 'No file was uploaded'
-                        }
-                    }));
-                    return;
-                }
-
-                // multer执行完成后，表单字段已解析到req.body中
-                const provider = req.body.provider || 'common';
-                const tempFilePath = req.file.path;
-                
-                // 根据实际的provider移动文件到正确的目录
-                let targetDir = path.join(process.cwd(), 'configs', provider);
-                
-                // 如果是kiro类型的凭证，需要再包裹一层文件夹
-                if (provider === 'kiro') {
-                    // 使用时间戳作为子文件夹名称，确保每个上传的文件都有独立的目录
-                    const timestamp = Date.now();
-                    const originalNameWithoutExt = path.parse(req.file.originalname).name;
-                    const subFolder = `${timestamp}_${originalNameWithoutExt}`;
-                    targetDir = path.join(targetDir, subFolder);
-                }
-                
-                await fs.mkdir(targetDir, { recursive: true });
-                
-                const targetFilePath = path.join(targetDir, req.file.filename);
-                await fs.rename(tempFilePath, targetFilePath);
-                
-                const relativePath = path.relative(process.cwd(), targetFilePath);
-
-                // 广播更新事件
-                broadcastEvent('config_update', {
-                    action: 'add',
-                    filePath: relativePath,
-                    provider: provider,
-                    timestamp: new Date().toISOString()
-                });
-
-                console.log(`[UI API] OAuth credentials file uploaded: ${targetFilePath} (provider: ${provider})`);
-
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    success: true,
-                    message: 'File uploaded successfully',
-                    filePath: relativePath,
-                    originalName: req.file.originalname,
-                    provider: provider
-                }));
-
-            } catch (error) {
-                console.error('[UI API] File upload processing error:', error);
-                res.writeHead(500, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    error: {
-                        message: 'File upload processing failed: ' + error.message
-                    }
-                }));
-            }
-        });
-        return true;
+        return handleUploadOAuthCredentials(req, res);
     }
 
     // Update admin password
@@ -3342,3 +3268,110 @@ async function copyRecursive(src, dest) {
         await fs.copyFile(src, dest);
     }
 }
+
+/**
+ * 处理 OAuth 凭据文件上传
+ * @param {http.IncomingMessage} req - HTTP 请求对象
+ * @param {http.ServerResponse} res - HTTP 响应对象
+ * @param {Object} options - 可选配置
+ * @param {Object} options.providerMap - 提供商类型映射表
+ * @param {string} options.logPrefix - 日志前缀
+ * @param {string} options.userInfo - 用户信息（用于日志）
+ * @param {Object} options.customUpload - 自定义 multer 实例
+ * @returns {Promise<boolean>} 始终返回 true 表示请求已处理
+ */
+export function handleUploadOAuthCredentials(req, res, options = {}) {
+    const {
+        providerMap = {},
+        logPrefix = '[UI API]',
+        userInfo = '',
+        customUpload = null
+    } = options;
+    
+    const uploadMiddleware = customUpload ? customUpload.single('file') : upload.single('file');
+    
+    return new Promise((resolve) => {
+        uploadMiddleware(req, res, async (err) => {
+            if (err) {
+                console.error(`${logPrefix} File upload error:`, err.message);
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: {
+                        message: err.message || 'File upload failed'
+                    }
+                }));
+                resolve(true);
+                return;
+            }
+
+            try {
+                if (!req.file) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        error: {
+                            message: 'No file was uploaded'
+                        }
+                    }));
+                    resolve(true);
+                    return;
+                }
+
+                // multer执行完成后，表单字段已解析到req.body中
+                const providerType = req.body.provider || 'common';
+                // 应用提供商映射（如果有）
+                const provider = providerMap[providerType] || providerType;
+                const tempFilePath = req.file.path;
+                
+                // 根据实际的provider移动文件到正确的目录
+                let targetDir = path.join(process.cwd(), 'configs', provider);
+                
+                // 如果是kiro类型的凭证，需要再包裹一层文件夹
+                if (provider === 'kiro') {
+                    // 使用时间戳作为子文件夹名称，确保每个上传的文件都有独立的目录
+                    const timestamp = Date.now();
+                    const originalNameWithoutExt = path.parse(req.file.originalname).name;
+                    const subFolder = `${timestamp}_${originalNameWithoutExt}`;
+                    targetDir = path.join(targetDir, subFolder);
+                }
+                
+                await fs.mkdir(targetDir, { recursive: true });
+                
+                const targetFilePath = path.join(targetDir, req.file.filename);
+                await fs.rename(tempFilePath, targetFilePath);
+                
+                const relativePath = path.relative(process.cwd(), targetFilePath);
+
+                // 广播更新事件
+                broadcastEvent('config_update', {
+                    action: 'add',
+                    filePath: relativePath,
+                    provider: provider,
+                    timestamp: new Date().toISOString()
+                });
+
+                const userInfoStr = userInfo ? `, ${userInfo}` : '';
+                console.log(`${logPrefix} OAuth credentials file uploaded: ${targetFilePath} (provider: ${provider}${userInfoStr})`);
+
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    success: true,
+                    message: 'File uploaded successfully',
+                    filePath: relativePath,
+                    originalName: req.file.originalname,
+                    provider: provider
+                }));
+                resolve(true);
+
+            } catch (error) {
+                console.error(`${logPrefix} File upload processing error:`, error);
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: {
+                        message: 'File upload processing failed: ' + error.message
+                    }
+                }));
+                resolve(true);
+            }
+        });
+    });
+}
diff --git a/static/potluck-user.html b/static/potluck-user.html
new file mode 100644
index 0000000..0eea253
--- /dev/null
+++ b/static/potluck-user.html
@@ -0,0 +1,1137 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>API 大锅饭 - 我的用量</title>
+    <style>
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+        body { 
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; 
+            background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%); 
+            min-height: 100vh; 
+            color: #e0e0e0;
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            padding: 20px;
+        }
+        .container { 
+            max-width: 600px; 
+            width: 100%;
+            margin: 0 auto; 
+        }
+        header { 
+            text-align: center;
+            padding: 40px 0 30px;
+        }
+        h1 { 
+            font-size: 28px; 
+            color: #fff; 
+            display: flex; 
+            align-items: center; 
+            justify-content: center;
+            gap: 12px; 
+        }
+        h1 span { font-size: 36px; }
+        .subtitle {
+            color: #888;
+            margin-top: 10px;
+            font-size: 14px;
+        }
+        
+        /* 登录区域 */
+        .login-section {
+            background: rgba(255,255,255,0.05);
+            border-radius: 16px;
+            padding: 30px;
+            margin-bottom: 20px;
+        }
+        .login-section h2 {
+            font-size: 18px;
+            color: #fff;
+            margin-bottom: 20px;
+            text-align: center;
+        }
+        .login-section.hidden {
+            display: none;
+        }
+        .input-group {
+            display: flex;
+            flex-direction: column;
+            gap: 15px;
+        }
+        .input-group input {
+            width: 100%;
+            padding: 14px 18px;
+            border: 1px solid #333;
+            border-radius: 10px;
+            background: rgba(255,255,255,0.05);
+            color: #fff;
+            font-size: 15px;
+            font-family: monospace;
+        }
+        .input-group input:focus {
+            outline: none;
+            border-color: #4ade80;
+        }
+        .input-group input::placeholder {
+            color: #666;
+        }
+        .btn {
+            padding: 14px 28px;
+            border: none;
+            border-radius: 10px;
+            cursor: pointer;
+            font-size: 15px;
+            font-weight: 600;
+            transition: all 0.2s;
+            width: 100%;
+        }
+        .btn-primary {
+            background: #4ade80;
+            color: #000;
+        }
+        .btn-primary:hover {
+            background: #22c55e;
+        }
+        .btn-primary:disabled {
+            background: #333;
+            color: #666;
+            cursor: not-allowed;
+        }
+        .remember-key {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 13px;
+            color: #888;
+        }
+        .remember-key input[type="checkbox"] {
+            width: 16px;
+            height: 16px;
+            accent-color: #4ade80;
+        }
+        
+        /* 已登录区域 */
+        .dashboard-section {
+            display: none;
+        }
+        .dashboard-section.active {
+            display: block;
+        }
+        
+        /* 用户信息卡片 */
+        .user-card {
+            background: rgba(255,255,255,0.05);
+            border-radius: 16px;
+            padding: 25px;
+            margin-bottom: 20px;
+        }
+        .user-header {
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            margin-bottom: 20px;
+            flex-wrap: wrap;
+            gap: 10px;
+        }
+        .user-info {
+            display: flex;
+            align-items: center;
+            gap: 15px;
+        }
+        .user-avatar {
+            width: 50px;
+            height: 50px;
+            background: linear-gradient(135deg, #4ade80, #22c55e);
+            border-radius: 50%;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 24px;
+        }
+        .user-details .user-name {
+            font-size: 18px;
+            font-weight: 600;
+            color: #fff;
+        }
+        .user-details .user-key {
+            font-family: monospace;
+            font-size: 12px;
+            color: #666;
+            margin-top: 4px;
+        }
+        .user-status {
+            padding: 6px 14px;
+            border-radius: 20px;
+            font-size: 13px;
+            font-weight: 500;
+        }
+        .user-status.enabled {
+            background: rgba(74, 222, 128, 0.2);
+            color: #4ade80;
+        }
+        .user-status.disabled {
+            background: rgba(239, 68, 68, 0.2);
+            color: #ef4444;
+        }
+        .user-actions {
+            display: flex;
+            gap: 10px;
+            margin-top: 15px;
+        }
+        .action-btn {
+            background: rgba(255,255,255,0.1);
+            border: none;
+            padding: 8px 16px;
+            border-radius: 8px;
+            color: #888;
+            font-size: 13px;
+            cursor: pointer;
+            transition: all 0.2s;
+            display: flex;
+            align-items: center;
+            gap: 6px;
+        }
+        .action-btn:hover {
+            background: rgba(255,255,255,0.15);
+            color: #fff;
+        }
+        .action-btn.logout {
+            color: #ef4444;
+        }
+        .action-btn.logout:hover {
+            background: rgba(239, 68, 68, 0.2);
+        }
+        
+        /* 使用量统计 */
+        .usage-stats {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
+            gap: 15px;
+            margin-top: 20px;
+        }
+        .stat-card {
+            background: rgba(255,255,255,0.03);
+            border-radius: 12px;
+            padding: 18px;
+            text-align: center;
+        }
+        .stat-card .label {
+            font-size: 12px;
+            color: #888;
+            margin-bottom: 8px;
+        }
+        .stat-card .value {
+            font-size: 28px;
+            font-weight: bold;
+            color: #4ade80;
+        }
+        .stat-card .value.warning { color: #fbbf24; }
+        .stat-card .value.danger { color: #ef4444; }
+        
+        /* 进度条 */
+        .usage-progress {
+            margin-top: 25px;
+        }
+        .progress-header {
+            display: flex;
+            justify-content: space-between;
+            margin-bottom: 10px;
+            font-size: 14px;
+        }
+        .progress-header .label { color: #888; }
+        .progress-header .value { color: #fff; font-weight: 600; }
+        .progress-bar {
+            height: 12px;
+            background: rgba(255,255,255,0.1);
+            border-radius: 6px;
+            overflow: hidden;
+        }
+        .progress-bar .fill {
+            height: 100%;
+            background: linear-gradient(90deg, #4ade80, #22c55e);
+            border-radius: 6px;
+            transition: width 0.5s ease;
+        }
+        .progress-bar .fill.warning { background: linear-gradient(90deg, #fbbf24, #f59e0b); }
+        .progress-bar .fill.danger { background: linear-gradient(90deg, #ef4444, #dc2626); }
+        .progress-info {
+            display: flex;
+            justify-content: space-between;
+            margin-top: 8px;
+            font-size: 12px;
+            color: #666;
+        }
+        
+        /* 上传授权文件区域 */
+        .upload-section {
+            background: rgba(255,255,255,0.05);
+            border-radius: 16px;
+            padding: 25px;
+            margin-bottom: 20px;
+        }
+        .upload-section h3 {
+            font-size: 16px;
+            color: #fff;
+            margin-bottom: 8px;
+        }
+        .upload-desc {
+            font-size: 13px;
+            color: #888;
+            margin-bottom: 20px;
+        }
+        .upload-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+            gap: 15px;
+        }
+        .upload-card {
+            background: rgba(255,255,255,0.03);
+            border: 1px solid rgba(255,255,255,0.1);
+            border-radius: 12px;
+            padding: 18px;
+            text-align: center;
+            transition: all 0.2s;
+        }
+        .upload-card:hover {
+            border-color: rgba(74, 222, 128, 0.3);
+            background: rgba(255,255,255,0.05);
+        }
+        .upload-icon {
+            font-size: 28px;
+            margin-bottom: 10px;
+        }
+        .upload-name {
+            font-size: 14px;
+            font-weight: 600;
+            color: #fff;
+            margin-bottom: 4px;
+        }
+        .upload-provider {
+            font-size: 11px;
+            color: #666;
+            font-family: monospace;
+            margin-bottom: 12px;
+        }
+        .upload-btn {
+            width: 100%;
+            padding: 10px 16px;
+            border: none;
+            border-radius: 8px;
+            background: rgba(74, 222, 128, 0.2);
+            color: #4ade80;
+            font-size: 13px;
+            font-weight: 500;
+            cursor: pointer;
+            transition: all 0.2s;
+        }
+        .upload-btn:hover {
+            background: rgba(74, 222, 128, 0.3);
+        }
+        .upload-btn:disabled {
+            background: rgba(255,255,255,0.1);
+            color: #666;
+            cursor: not-allowed;
+        }
+        .upload-btn .btn-loading {
+            display: inline-flex;
+            align-items: center;
+            gap: 6px;
+        }
+        .upload-status {
+            margin-top: 10px;
+            font-size: 12px;
+            min-height: 18px;
+            word-break: break-all;
+            overflow: hidden;
+            text-overflow: ellipsis;
+            max-width: 100%;
+        }
+        .upload-status.success {
+            color: #4ade80;
+        }
+        .upload-status.error {
+            color: #ef4444;
+        }
+        
+        /* 详细信息 */
+        .detail-section {
+            background: rgba(255,255,255,0.05);
+            border-radius: 16px;
+            padding: 25px;
+        }
+        .detail-section h3 {
+            font-size: 16px;
+            color: #fff;
+            margin-bottom: 15px;
+        }
+        .detail-list {
+            display: flex;
+            flex-direction: column;
+            gap: 12px;
+        }
+        .detail-item {
+            display: flex;
+            justify-content: space-between;
+            padding: 10px 0;
+            border-bottom: 1px solid rgba(255,255,255,0.05);
+        }
+        .detail-item:last-child { border-bottom: none; }
+        .detail-item .label { color: #888; font-size: 14px; }
+        .detail-item .value { color: #fff; font-size: 14px; font-weight: 500; }
+        
+        /* 错误提示 */
+        .error-message {
+            background: rgba(239, 68, 68, 0.1);
+            border: 1px solid rgba(239, 68, 68, 0.3);
+            border-radius: 12px;
+            padding: 20px;
+            text-align: center;
+            color: #ef4444;
+            display: none;
+            margin-bottom: 20px;
+        }
+        .error-message.active { display: block; }
+        .error-message .icon { font-size: 40px; margin-bottom: 10px; }
+        .error-message .title { font-size: 16px; font-weight: 600; margin-bottom: 5px; }
+        .error-message .desc { font-size: 14px; color: #888; }
+        
+        /* 加载状态 */
+        .loading {
+            text-align: center;
+            padding: 40px;
+            color: #888;
+            display: none;
+        }
+        .loading.active { display: block; }
+        .loading .spinner {
+            width: 40px;
+            height: 40px;
+            border: 3px solid rgba(255,255,255,0.1);
+            border-top-color: #4ade80;
+            border-radius: 50%;
+            animation: spin 1s linear infinite;
+            margin: 0 auto 15px;
+        }
+        @keyframes spin { to { transform: rotate(360deg); } }
+        
+        /* 页脚 */
+        footer {
+            margin-top: 40px;
+            text-align: center;
+            color: #666;
+            font-size: 13px;
+        }
+        footer a { color: #4ade80; text-decoration: none; }
+        footer a:hover { text-decoration: underline; }
+        
+        /* Toast 提示 */
+        .toast {
+            position: fixed;
+            bottom: 20px;
+            right: 20px;
+            padding: 15px 25px;
+            background: #1e293b;
+            border-radius: 8px;
+            color: #fff;
+            box-shadow: 0 4px 20px rgba(0,0,0,0.3);
+            transform: translateY(100px);
+            opacity: 0;
+            transition: all 0.3s;
+            z-index: 2000;
+        }
+        .toast.show { transform: translateY(0); opacity: 1; }
+        .toast.success { border-left: 4px solid #4ade80; }
+        .toast.error { border-left: 4px solid #ef4444; }
+        
+        /* 响应式 */
+        @media (max-width: 480px) {
+            .user-info { flex-direction: column; text-align: center; }
+            .user-header { flex-direction: column; }
+            .user-actions { justify-content: center; }
+            .usage-stats { grid-template-columns: repeat(2, 1fr); }
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <header>
+            <h1><span>🍲</span> API 大锅饭</h1>
+            <p class="subtitle" id="headerSubtitle">使用 API Key 登录查看用量</p>
+        </header>
+        
+        <!-- 登录区域 -->
+        <div class="login-section" id="loginSection">
+            <h2>🔑 登录</h2>
+            <div class="input-group">
+                <input type="text" id="apiKeyInput" placeholder="请输入您的 API Key (maki_xxx...)" autocomplete="off">
+                <label class="remember-key">
+                    <input type="checkbox" id="rememberKey" checked>
+                    <span>记住我的 Key（存储在本地浏览器）</span>
+                </label>
+                <button class="btn btn-primary" id="loginBtn" onclick="login()">登录</button>
+            </div>
+        </div>
+        
+        <!-- 加载状态 -->
+        <div class="loading" id="loading">
+            <div class="spinner"></div>
+            <p>正在加载...</p>
+        </div>
+        
+        <!-- 错误提示 -->
+        <div class="error-message" id="errorMessage">
+            <div class="icon">⚠️</div>
+            <div class="title" id="errorTitle">登录失败</div>
+            <div class="desc" id="errorDesc">请检查您的 API Key 是否正确</div>
+        </div>
+        
+        <!-- 已登录区域 -->
+        <div class="dashboard-section" id="dashboardSection">
+            <!-- 用户信息卡片 -->
+            <div class="user-card">
+                <div class="user-header">
+                    <div class="user-info">
+                        <div class="user-avatar">👤</div>
+                        <div class="user-details">
+                            <div class="user-name" id="userName">-</div>
+                            <div class="user-key" id="userKey">-</div>
+                        </div>
+                    </div>
+                    <span class="user-status enabled" id="userStatus">启用</span>
+                </div>
+                
+                <!-- 使用量进度 -->
+                <div class="usage-progress">
+                    <div class="progress-header">
+                        <span class="label">今日使用量</span>
+                        <span class="value"><span id="usageToday">0</span> / <span id="usageLimit">0</span></span>
+                    </div>
+                    <div class="progress-bar">
+                        <div class="fill" id="progressFill" style="width: 0%"></div>
+                    </div>
+                    <div class="progress-info">
+                        <span>剩余 <span id="usageRemaining">0</span> 次</span>
+                        <span id="usagePercent">0%</span>
+                    </div>
+                </div>
+                
+                <!-- 统计卡片 -->
+                <div class="usage-stats">
+                    <div class="stat-card">
+                        <div class="label">今日已用</div>
+                        <div class="value" id="statToday">0</div>
+                    </div>
+                    <div class="stat-card">
+                        <div class="label">每日限额</div>
+                        <div class="value" id="statLimit">0</div>
+                    </div>
+                    <div class="stat-card">
+                        <div class="label">累计调用</div>
+                        <div class="value" id="statTotal">0</div>
+                    </div>
+                </div>
+                
+                <!-- 操作按钮 -->
+                <div class="user-actions">
+                    <button class="action-btn" onclick="refreshUsage()">🔄 刷新</button>
+                    <button class="action-btn logout" onclick="logout()">🚪 退出登录</button>
+                </div>
+            </div>
+            
+            <!-- 上传授权文件 -->
+            <div class="upload-section">
+                <h3>📤 上传授权文件</h3>
+                <p class="upload-desc">上传您的 OAuth 授权文件到对应的提供商目录</p>
+                
+                <div class="upload-grid">
+                    <div class="upload-card" data-provider="gemini-cli-oauth">
+                        <div class="upload-icon">🔷</div>
+                        <div class="upload-name">Gemini CLI</div>
+                        <div class="upload-provider">gemini</div>
+                        <input type="file" class="upload-input" accept=".json,.txt,.key,.pem" style="display:none">
+                        <button class="upload-btn" onclick="triggerUpload(this)">
+                            <span class="btn-text">选择文件</span>
+                            <span class="btn-loading" style="display:none">上传中...</span>
+                        </button>
+                        <div class="upload-status"></div>
+                    </div>
+                    
+                    <div class="upload-card" data-provider="gemini-antigravity">
+                        <div class="upload-icon">🌀</div>
+                        <div class="upload-name">Antigravity</div>
+                        <div class="upload-provider">antigravity</div>
+                        <input type="file" class="upload-input" accept=".json,.txt,.key,.pem" style="display:none">
+                        <button class="upload-btn" onclick="triggerUpload(this)">
+                            <span class="btn-text">选择文件</span>
+                            <span class="btn-loading" style="display:none">上传中...</span>
+                        </button>
+                        <div class="upload-status"></div>
+                    </div>
+                    
+                    <div class="upload-card" data-provider="claude-kiro-oauth">
+                        <div class="upload-icon">🤖</div>
+                        <div class="upload-name">Kiro (Claude)</div>
+                        <div class="upload-provider">kiro</div>
+                        <input type="file" class="upload-input" accept=".json,.txt,.key,.pem" style="display:none">
+                        <button class="upload-btn" onclick="triggerUpload(this)">
+                            <span class="btn-text">选择文件</span>
+                            <span class="btn-loading" style="display:none">上传中...</span>
+                        </button>
+                        <div class="kiro-actions" style="display: flex; gap: 5px; margin-top: 8px;">
+                            <button class="upload-btn secondary" style="background: rgba(255,255,255,0.1); color: #fff; font-size: 12px; padding: 6px;" onclick="showKiroBatchImportModal()">批量导入</button>
+                            <button class="upload-btn secondary" style="background: rgba(255,255,255,0.1); color: #fff; font-size: 12px; padding: 6px;" onclick="showKiroAwsImportModal()">AWS导入</button>
+                        </div>
+                        <div class="upload-status"></div>
+                    </div>
+                    
+                    <div class="upload-card" data-provider="openai-qwen-oauth">
+                        <div class="upload-icon">🌐</div>
+                        <div class="upload-name">Qwen (OpenAI)</div>
+                        <div class="upload-provider">qwen</div>
+                        <input type="file" class="upload-input" accept=".json,.txt,.key,.pem" style="display:none">
+                        <button class="upload-btn" onclick="triggerUpload(this)">
+                            <span class="btn-text">选择文件</span>
+                            <span class="btn-loading" style="display:none">上传中...</span>
+                        </button>
+                        <div class="upload-status"></div>
+                    </div>
+                    
+                    <div class="upload-card" data-provider="openai-iflow">
+                        <div class="upload-icon">🔄</div>
+                        <div class="upload-name">iFlow (OpenAI)</div>
+                        <div class="upload-provider">iflow</div>
+                        <input type="file" class="upload-input" accept=".json,.txt,.key,.pem" style="display:none">
+                        <button class="upload-btn" onclick="triggerUpload(this)">
+                            <span class="btn-text">选择文件</span>
+                            <span class="btn-loading" style="display:none">上传中...</span>
+                        </button>
+                        <div class="upload-status"></div>
+                    </div>
+                </div>
+            </div>
+            
+            <!-- 详细信息 -->
+            <div class="detail-section">
+                <h3>📊 详细信息</h3>
+                <div class="detail-list">
+                    <div class="detail-item">
+                        <span class="label">最后调用时间</span>
+                        <span class="value" id="lastUsedAt">-</span>
+                    </div>
+                    <div class="detail-item">
+                        <span class="label">配额重置日期</span>
+                        <span class="value" id="resetDate">-</span>
+                    </div>
+                    <div class="detail-item">
+                        <span class="label">Key 创建时间</span>
+                        <span class="value" id="createdAt">-</span>
+                    </div>
+                </div>
+            </div>
+        </div>
+        
+        <footer>
+            <p>需要管理 Key？<a href="/potluck.html">前往管理后台</a></p>
+        </footer>
+    </div>
+    
+    <div id="toast" class="toast"></div>
+
+    <!-- Kiro 批量导入模态框 -->
+    <div id="kiroBatchModal" class="modal-overlay" style="display: none; position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(0,0,0,0.5); z-index: 1000; justify-content: center; align-items: center;">
+        <div class="modal-content" style="background: #1e293b; border-radius: 16px; padding: 25px; width: 90%; max-width: 600px; max-height: 90vh; overflow-y: auto; border: 1px solid rgba(255,255,255,0.1);">
+            <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 20px;">
+                <h3 style="color: #fff; font-size: 18px;">🔄 Kiro 批量导入</h3>
+                <button onclick="closeModal('kiroBatchModal')" style="background: none; border: none; color: #888; font-size: 24px; cursor: pointer;">&times;</button>
+            </div>
+            <div style="margin-bottom: 15px; padding: 12px; background: rgba(74, 222, 128, 0.1); border: 1px solid rgba(74, 222, 128, 0.2); border-radius: 8px;">
+                <p style="color: #4ade80; font-size: 13px;">请输入 refreshToken，每行一个。系统将自动刷新并生成凭据文件。</p>
+            </div>
+            <textarea id="batchTokensInput" rows="10" style="width: 100%; background: rgba(0,0,0,0.2); border: 1px solid rgba(255,255,255,0.1); border-radius: 8px; color: #fff; padding: 12px; font-family: monospace; resize: vertical;" placeholder="aorAxxxxxxxx&#10;aorAyyyyyyyy"></textarea>
+            
+            <div id="batchProgress" style="display: none; margin-top: 15px;">
+                <div style="display: flex; justify-content: space-between; font-size: 12px; color: #888; margin-bottom: 5px;">
+                    <span id="batchProgressText">正在导入...</span>
+                    <span id="batchProgressPercent">0%</span>
+                </div>
+                <div style="height: 6px; background: rgba(255,255,255,0.1); border-radius: 3px; overflow: hidden;">
+                    <div id="batchProgressBar" style="height: 100%; width: 0%; background: #4ade80; transition: width 0.3s;"></div>
+                </div>
+                <div id="batchResults" style="margin-top: 10px; max-height: 150px; overflow-y: auto; font-size: 12px; font-family: monospace;"></div>
+            </div>
+
+            <div style="display: flex; justify-content: flex-end; gap: 10px; margin-top: 20px;">
+                <button class="btn" style="background: rgba(255,255,255,0.1); color: #fff; width: auto;" onclick="closeModal('kiroBatchModal')">取消</button>
+                <button class="btn btn-primary" style="width: auto;" onclick="startKiroBatchImport()">开始导入</button>
+            </div>
+        </div>
+    </div>
+
+    <!-- Kiro AWS 导入模态框 -->
+    <div id="kiroAwsModal" class="modal-overlay" style="display: none; position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(0,0,0,0.5); z-index: 1000; justify-content: center; align-items: center;">
+        <div class="modal-content" style="background: #1e293b; border-radius: 16px; padding: 25px; width: 90%; max-width: 600px; max-height: 90vh; overflow-y: auto; border: 1px solid rgba(255,255,255,0.1);">
+            <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 20px;">
+                <h3 style="color: #fff; font-size: 18px;">☁️ Kiro AWS 导入</h3>
+                <button onclick="closeModal('kiroAwsModal')" style="background: none; border: none; color: #888; font-size: 24px; cursor: pointer;">&times;</button>
+            </div>
+            <div style="margin-bottom: 15px; padding: 12px; background: rgba(251, 191, 36, 0.1); border: 1px solid rgba(251, 191, 36, 0.2); border-radius: 8px;">
+                <p style="color: #fbbf24; font-size: 13px;">请粘贴 AWS SSO cache 文件中的 JSON 内容（需包含 clientId, clientSecret, accessToken, refreshToken）。</p>
+            </div>
+            
+            <textarea id="awsJsonInput" rows="12" style="width: 100%; background: rgba(0,0,0,0.2); border: 1px solid rgba(255,255,255,0.1); border-radius: 8px; color: #fff; padding: 12px; font-family: monospace; resize: vertical;" placeholder='{
+  "clientId": "...",
+  "clientSecret": "...",
+  "accessToken": "...",
+  "refreshToken": "..."
+}'></textarea>
+
+            <div style="display: flex; justify-content: flex-end; gap: 10px; margin-top: 20px;">
+                <button class="btn" style="background: rgba(255,255,255,0.1); color: #fff; width: auto;" onclick="closeModal('kiroAwsModal')">取消</button>
+                <button class="btn btn-primary" style="width: auto;" onclick="startKiroAwsImport()">导入</button>
+            </div>
+        </div>
+    </div>
+    
+    <script>
+        const API_BASE = '/api/potluckuser';
+        let currentApiKey = '';
+        let isLoggedIn = false;
+        
+        
+        async function login() {
+            const apiKey = document.getElementById('apiKeyInput').value.trim();
+            
+            if (!apiKey) {
+                showToast('请输入 API Key', 'error');
+                return;
+            }
+            
+            if (!apiKey.startsWith('maki_')) {
+                showToast('API Key 格式不正确，应以 maki_ 开头', 'error');
+                return;
+            }
+            
+            currentApiKey = apiKey;
+            
+            // 显示加载状态
+            showLoading(true);
+            hideError();
+            hideLogin();
+            hideDashboard();
+            
+            try {
+                const response = await fetch(`${API_BASE}/usage`, {
+                    method: 'GET',
+                    headers: {
+                        'Authorization': `Bearer ${apiKey}`,
+                        'Content-Type': 'application/json'
+                    }
+                });
+                
+                const data = await response.json();
+                
+                if (!response.ok || !data.success) {
+                    throw new Error(data.error?.message || '登录失败');
+                }
+                
+                // 保存 Key（如果勾选了记住）
+                if (document.getElementById('rememberKey').checked) {
+                    localStorage.setItem('potluck_user_key', apiKey);
+                } else {
+                    localStorage.removeItem('potluck_user_key');
+                }
+                
+                isLoggedIn = true;
+                
+                // 显示用户信息
+                displayUserInfo(data.data);
+                showDashboard();
+                document.getElementById('headerSubtitle').textContent = '我的 API 使用量';
+                showToast('登录成功', 'success');
+                
+            } catch (error) {
+                showError(error.message);
+                showLogin();
+            } finally {
+                showLoading(false);
+            }
+        }
+        
+        async function refreshUsage() {
+            if (!currentApiKey) {
+                logout();
+                return;
+            }
+            
+            showLoading(true);
+            
+            try {
+                const response = await fetch(`${API_BASE}/usage`, {
+                    method: 'GET',
+                    headers: {
+                        'Authorization': `Bearer ${currentApiKey}`,
+                        'Content-Type': 'application/json'
+                    }
+                });
+                
+                const data = await response.json();
+                
+                if (!response.ok || !data.success) {
+                    throw new Error(data.error?.message || '刷新失败');
+                }
+                
+                displayUserInfo(data.data);
+                showToast('刷新成功', 'success');
+                
+            } catch (error) {
+                showToast(error.message, 'error');
+            } finally {
+                showLoading(false);
+            }
+        }
+        
+        function logout() {
+            currentApiKey = '';
+            isLoggedIn = false;
+            localStorage.removeItem('potluck_user_key');
+            
+            hideDashboard();
+            hideError();
+            showLogin();
+            document.getElementById('apiKeyInput').value = '';
+            document.getElementById('headerSubtitle').textContent = '使用 API Key 登录查看用量';
+            showToast('已退出登录', 'success');
+        }
+        
+        function displayUserInfo(data) {
+            // 用户信息
+            document.getElementById('userName').textContent = data.name || '未命名';
+            document.getElementById('userKey').textContent = data.maskedKey;
+            
+            // 状态
+            const statusEl = document.getElementById('userStatus');
+            if (data.enabled) {
+                statusEl.textContent = '启用';
+                statusEl.className = 'user-status enabled';
+            } else {
+                statusEl.textContent = '已禁用';
+                statusEl.className = 'user-status disabled';
+            }
+            
+            // 使用量
+            const usage = data.usage;
+            document.getElementById('usageToday').textContent = usage.today;
+            document.getElementById('usageLimit').textContent = usage.limit;
+            document.getElementById('usageRemaining').textContent = usage.remaining;
+            document.getElementById('usagePercent').textContent = usage.percent + '%';
+            
+            // 进度条
+            const progressFill = document.getElementById('progressFill');
+            progressFill.style.width = Math.min(usage.percent, 100) + '%';
+            progressFill.className = 'fill';
+            if (usage.percent >= 90) {
+                progressFill.classList.add('danger');
+            } else if (usage.percent >= 70) {
+                progressFill.classList.add('warning');
+            }
+            
+            // 统计卡片
+            document.getElementById('statToday').textContent = usage.today;
+            document.getElementById('statToday').className = 'value' + (usage.percent >= 90 ? ' danger' : usage.percent >= 70 ? ' warning' : '');
+            document.getElementById('statLimit').textContent = usage.limit;
+            document.getElementById('statTotal').textContent = data.total;
+            
+            // 详细信息
+            document.getElementById('lastUsedAt').textContent = formatTime(data.lastUsedAt);
+            document.getElementById('resetDate').textContent = usage.resetDate || '-';
+            document.getElementById('createdAt').textContent = formatDateTime(data.createdAt);
+        }
+        
+        function formatTime(isoStr) {
+            if (!isoStr) return '从未使用';
+            const d = new Date(isoStr);
+            const now = new Date();
+            const diff = now - d;
+            
+            if (diff < 60000) return '刚刚';
+            if (diff < 3600000) return Math.floor(diff / 60000) + ' 分钟前';
+            if (diff < 86400000) return Math.floor(diff / 3600000) + ' 小时前';
+            if (diff < 604800000) return Math.floor(diff / 86400000) + ' 天前';
+            
+            return d.toLocaleDateString('zh-CN');
+        }
+        
+        function formatDateTime(isoStr) {
+            if (!isoStr) return '-';
+            const d = new Date(isoStr);
+            return d.toLocaleDateString('zh-CN') + ' ' + d.toLocaleTimeString('zh-CN', { hour: '2-digit', minute: '2-digit' });
+        }
+        
+        function showLoading(show) {
+            document.getElementById('loading').classList.toggle('active', show);
+            document.getElementById('loginBtn').disabled = show;
+        }
+        
+        function showLogin() {
+            document.getElementById('loginSection').classList.remove('hidden');
+        }
+        
+        function hideLogin() {
+            document.getElementById('loginSection').classList.add('hidden');
+        }
+        
+        function showDashboard() {
+            document.getElementById('dashboardSection').classList.add('active');
+        }
+        
+        function hideDashboard() {
+            document.getElementById('dashboardSection').classList.remove('active');
+        }
+        
+        function showError(message) {
+            const errorEl = document.getElementById('errorMessage');
+            document.getElementById('errorDesc').textContent = message;
+            errorEl.classList.add('active');
+        }
+        
+        function hideError() {
+            document.getElementById('errorMessage').classList.remove('active');
+        }
+        
+        function showToast(message, type = 'success') {
+            const toast = document.getElementById('toast');
+            toast.textContent = message;
+            toast.className = `toast ${type} show`;
+            setTimeout(() => toast.classList.remove('show'), 3000);
+        }
+        
+        // 提供商映射
+        const providerMap = {
+            'gemini-cli-oauth': 'gemini',
+            'gemini-antigravity': 'antigravity',
+            'claude-kiro-oauth': 'kiro',
+            'openai-qwen-oauth': 'qwen',
+            'openai-iflow': 'iflow'
+        };
+        
+        // 触发文件上传
+        function triggerUpload(btn) {
+            const card = btn.closest('.upload-card');
+            const input = card.querySelector('.upload-input');
+            input.click();
+        }
+        
+        // 初始化上传事件监听
+        function initUploadListeners() {
+            document.querySelectorAll('.upload-card').forEach(card => {
+                const input = card.querySelector('.upload-input');
+                const btn = card.querySelector('.upload-btn');
+                const status = card.querySelector('.upload-status');
+                const providerType = card.dataset.provider;
+                
+                input.addEventListener('change', async (e) => {
+                    const file = e.target.files[0];
+                    if (!file) return;
+                    
+                    // 验证文件类型
+                    const allowedExtensions = ['.json', '.txt', '.key', '.pem', '.p12', '.pfx'];
+                    const ext = '.' + file.name.split('.').pop().toLowerCase();
+                    if (!allowedExtensions.includes(ext)) {
+                        status.textContent = '不支持的文件类型';
+                        status.className = 'upload-status error';
+                        input.value = '';
+                        return;
+                    }
+                    
+                    // 验证文件大小 (5MB)
+                    if (file.size > 5 * 1024 * 1024) {
+                        status.textContent = '文件大小不能超过 5MB';
+                        status.className = 'upload-status error';
+                        input.value = '';
+                        return;
+                    }
+                    
+                    // 显示上传中状态
+                    btn.disabled = true;
+                    btn.querySelector('.btn-text').style.display = 'none';
+                    btn.querySelector('.btn-loading').style.display = 'inline';
+                    status.textContent = '';
+                    status.className = 'upload-status';
+                    
+                    try {
+                        const formData = new FormData();
+                        formData.append('file', file);
+                        formData.append('provider', providerType);
+                        
+                        const response = await fetch(`${API_BASE}/upload`, {
+                            method: 'POST',
+                            headers: {
+                                'Authorization': `Bearer ${currentApiKey}`
+                            },
+                            body: formData
+                        });
+                        
+                        const data = await response.json();
+                        
+                        if (response.ok && data.success) {
+                            status.textContent = '✓ ' + (data.filePath || '上传成功');
+                            status.className = 'upload-status success';
+                            showToast('文件上传成功', 'success');
+                        } else {
+                            throw new Error(data.error?.message || '上传失败');
+                        }
+                    } catch (error) {
+                        status.textContent = '✗ ' + error.message;
+                        status.className = 'upload-status error';
+                        showToast('上传失败: ' + error.message, 'error');
+                    } finally {
+                        btn.disabled = false;
+                        btn.querySelector('.btn-text').style.display = 'inline';
+                        btn.querySelector('.btn-loading').style.display = 'none';
+                        input.value = '';
+                    }
+                });
+            });
+        }
+        
+        // 页面加载完成后初始化上传监听器
+        document.addEventListener('DOMContentLoaded', () => {
+            initUploadListeners();
+            
+            const savedKey = localStorage.getItem('potluck_user_key');
+            if (savedKey) {
+                document.getElementById('apiKeyInput').value = savedKey;
+                // 自动登录
+                login();
+            }
+            
+            // 回车键登录
+            document.getElementById('apiKeyInput').addEventListener('keypress', (e) => {
+                if (e.key === 'Enter') {
+                    login();
+                }
+            });
+        });
+
+        // 模态框控制
+        function closeModal(id) {
+            document.getElementById(id).style.display = 'none';
+        }
+
+        function showKiroBatchImportModal() {
+            document.getElementById('kiroBatchModal').style.display = 'flex';
+            document.getElementById('batchTokensInput').value = '';
+            document.getElementById('batchProgress').style.display = 'none';
+            document.getElementById('batchResults').innerHTML = '';
+        }
+
+        function showKiroAwsImportModal() {
+            document.getElementById('kiroAwsModal').style.display = 'flex';
+            document.getElementById('awsJsonInput').value = '';
+        }
+
+        // Kiro 批量导入逻辑
+        async function startKiroBatchImport() {
+            const tokens = document.getElementById('batchTokensInput').value.split('\n').filter(t => t.trim());
+            if (tokens.length === 0) {
+                showToast('请输入至少一个 refreshToken', 'error');
+                return;
+            }
+
+            const progressDiv = document.getElementById('batchProgress');
+            const progressBar = document.getElementById('batchProgressBar');
+            const progressText = document.getElementById('batchProgressText');
+            const progressPercent = document.getElementById('batchProgressPercent');
+            const resultsDiv = document.getElementById('batchResults');
+            
+            progressDiv.style.display = 'block';
+            progressBar.style.width = '0%';
+            resultsDiv.innerHTML = '';
+            
+            try {
+                const response = await fetch(`${API_BASE}/kiro/batch-import-tokens`, {
+                    method: 'POST',
+                    headers: {
+                        'Authorization': `Bearer ${currentApiKey}`,
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({ refreshTokens: tokens })
+                });
+
+                const reader = response.body.getReader();
+                const decoder = new TextDecoder();
+                let buffer = '';
+
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done) break;
+                    
+                    buffer += decoder.decode(value, { stream: true });
+                    const lines = buffer.split('\n');
+                    buffer = lines.pop() || '';
+
+                    for (const line of lines) {
+                        if (line.startsWith('data: ')) {
+                            try {
+                                const data = JSON.parse(line.substring(6));
+                                if (data.current) {
+                                    const percent = Math.round((data.index / data.total) * 100);
+                                    progressBar.style.width = percent + '%';
+                                    progressPercent.textContent = percent + '%';
+                                    progressText.textContent = `正在导入 ${data.index}/${data.total}`;
+                                    
+                                    const color = data.current.success ? '#4ade80' : '#ef4444';
+                                    const icon = data.current.success ? '✓' : '✗';
+                                    const msg = data.current.success ? data.current.path : data.current.error;
+                                    resultsDiv.innerHTML += `<div style="color:${color}">${icon} Token ${data.current.index}: ${msg}</div>`;
+                                    resultsDiv.scrollTop = resultsDiv.scrollHeight;
+                                }
+                                if (data.successCount !== undefined) {
+                                    showToast(`导入完成: 成功 ${data.successCount}, 失败 ${data.failedCount}`, 'success');
+                                    setTimeout(() => closeModal('kiroBatchModal'), 2000);
+                                }
+                            } catch (e) {}
+                        }
+                    }
+                }
+            } catch (error) {
+                showToast('导入失败: ' + error.message, 'error');
+            }
+        }
+
+        // Kiro AWS 导入逻辑
+        async function startKiroAwsImport() {
+            const jsonStr = document.getElementById('awsJsonInput').value.trim();
+            if (!jsonStr) {
+                showToast('请输入 JSON 内容', 'error');
+                return;
+            }
+
+            try {
+                const credentials = JSON.parse(jsonStr);
+                const response = await fetch(`${API_BASE}/kiro/import-aws-credentials`, {
+                    method: 'POST',
+                    headers: {
+                        'Authorization': `Bearer ${currentApiKey}`,
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({ credentials })
+                });
+
+                const data = await response.json();
+                if (response.ok && data.success) {
+                    showToast('AWS 凭据导入成功', 'success');
+                    closeModal('kiroAwsModal');
+                } else {
+                    throw new Error(data.error || '导入失败');
+                }
+            } catch (error) {
+                showToast('导入错误: ' + error.message, 'error');
+            }
+        }
+    </script>
+</body>
+</html>
\ No newline at end of file
diff --git a/static/potluck.html b/static/potluck.html
index 6af88f7..1b4e823 100644
--- a/static/potluck.html
+++ b/static/potluck.html
@@ -227,8 +227,37 @@
                 document.getElementById('keyName').value = ''; document.getElementById('keyLimit').value = '1000';
             } else { showToast(result?.error?.message || '创建失败', 'error'); }
         }
-        function copyKey() { navigator.clipboard.writeText(currentNewKey).then(() => showToast('已复制到剪贴板', 'success')); }
-        function copyToClipboard(text) { navigator.clipboard.writeText(text).then(() => showToast('Key 已复制', 'success')); }
+        function copyToClipboardFallback(text) {
+            const textArea = document.createElement('textarea');
+            textArea.value = text;
+            textArea.style.position = 'fixed';
+            textArea.style.left = '-9999px';
+            textArea.style.top = '-9999px';
+            document.body.appendChild(textArea);
+            textArea.focus();
+            textArea.select();
+            try {
+                document.execCommand('copy');
+                showToast('已复制到剪贴板', 'success');
+            } catch (err) {
+                showToast('复制失败，请手动复制', 'error');
+            }
+            document.body.removeChild(textArea);
+        }
+        function copyKey() {
+            if (navigator.clipboard && navigator.clipboard.writeText) {
+                navigator.clipboard.writeText(currentNewKey).then(() => showToast('已复制到剪贴板', 'success')).catch(() => copyToClipboardFallback(currentNewKey));
+            } else {
+                copyToClipboardFallback(currentNewKey);
+            }
+        }
+        function copyToClipboard(text) {
+            if (navigator.clipboard && navigator.clipboard.writeText) {
+                navigator.clipboard.writeText(text).then(() => showToast('Key 已复制', 'success')).catch(() => copyToClipboardFallback(text));
+            } else {
+                copyToClipboardFallback(text);
+            }
+        }
         async function resetUsage(keyId) {
             if (!confirm('确定要重置该 Key 的今日调用次数吗？')) return;
             const result = await apiRequest(`${API_BASE}/keys/${encodeURIComponent(keyId)}/reset`, { method: 'POST' });