feat: Codex账号管理优化与API Key激活机制

✨ 新功能 - 支持通过refreshToken新增Codex账号，创建时立即验证token有效性 - API Key新增首次使用自动激活机制，支持activation模式设置有效期 - 前端账号表单增加token验证功能，确保账号创建成功 🐛 修复 - 修复Codex token刷新失败问题，增加分布式锁防止并发刷新 - 优化token刷新错误处理，提供更详细的错误信息和建议 - 修复OpenAI账号token过期检测和自动刷新逻辑 📝 文档更新 - 更新README中Codex使用说明，改为config.toml配置方式 - 优化Cherry Studio等第三方工具接入文档 - 添加详细的配置示例和账号类型说明 🎨 界面优化 - 改进账号创建表单UI，支持手动和OAuth两种模式 - 优化API Key过期时间编辑弹窗，支持激活操作 - 调整教程页面布局，提升移动端响应式体验 💡 代码改进 - 重构token刷新服务，增强错误处理和重试机制 - 优化代理配置处理，确保OAuth请求正确使用代理 - 改进webhook通知，增加token刷新失败告警
2026-01-22 16:43:35 +00:00 · 2025-09-06 17:39:05 +08:00
parent 0e746b1056
commit d2f3f6866c
19 changed files with 1231 additions and 463 deletions
--- a/README.md
+++ b/README.md
@@ -474,50 +474,101 @@ claude
 gemini  # 或其他 Gemini CLI 命令
 ```

-**Codex 设置环境变量：**
+**Codex 配置：**

-```bash
-export OPENAI_BASE_URL="http://127.0.0.1:3000/openai" # 根据实际填写你服务器的ip地址或者域名
-export OPENAI_API_KEY="后台创建的API密钥"  # 使用后台创建的API密钥
-```
-
-**Codex 额外配置：**
-
-需要在 `~/.codex/config.toml` 文件中添加以下配置来禁用响应存储：
+在 `~/.codex/config.toml` 文件中添加以下配置：

 ```toml
+model_provider = "crs"
+model = "gpt-5"
+model_reasoning_effort = "high"
 disable_response_storage = true
+
+[model_providers.crs]
+name = "crs"
+base_url = "http://127.0.0.1:3000/openai"  # 根据实际填写你服务器的ip地址或者域名
+wire_api = "responses"
+```
+
+在 `~/.codex/auth.json` 文件中配置API密钥：
+
+```json
+{
+  "OPENAI_API_KEY": "你的后台创建的API密钥"
+}
 ```

 ### 5. 第三方工具API接入

-本服务支持多种API端点格式，方便接入不同的第三方工具（如Cherry Studio等）：
+本服务支持多种API端点格式，方便接入不同的第三方工具（如Cherry Studio等）。

-**Claude标准格式：**
+#### Cherry Studio 接入示例
+
+Cherry Studio支持多种AI服务的接入，下面是不同账号类型的详细配置：
+
+**1. Claude账号接入：**

 ```
-# 如果工具支持Claude标准格式，请使用该接口
+# API地址
 http://你的服务器:3000/claude/
+
+# 模型ID示例
+claude-sonnet-4-20250514  # Claude Sonnet 4
+claude-opus-4-20250514     # Claude Opus 4
 ```

-**OpenAI兼容格式：**
+配置步骤：
+- 供应商类型选择"Anthropic"
+- API地址填入：`http://你的服务器:3000/claude/`
+- API Key填入：后台创建的API密钥（cr_开头）
+
+**2. Gemini账号接入：**

 ```
-# 适用于需要OpenAI格式的第三方工具
-http://你的服务器:3000/openai/claude/v1/
+# API地址
+http://你的服务器:3000/gemini/
+
+# 模型ID示例
+gemini-2.5-pro             # Gemini 2.5 Pro
 ```

-**接入示例：**
+配置步骤：
+- 供应商类型选择"Gemini"
+- API地址填入：`http://你的服务器:3000/gemini/`
+- API Key填入：后台创建的API密钥（cr_开头）

- **Cherry Studio**: 使用OpenAI格式 `http://你的服务器:3000/openai/claude/v1/` 使用Codex cli API `http://你的服务器:3000/openai/responses`
- **其他支持自定义API的工具**: 根据工具要求选择合适的格式
+**3. Codex接入：**
+
+```
+# API地址
+http://你的服务器:3000/openai/
+
+# 模型ID（固定）
+gpt-5                      # Codex使用固定模型ID
+```
+
+配置步骤：
+- 供应商类型选择"Openai-Response"
+- API地址填入：`http://你的服务器:3000/openai/`
+- API Key填入：后台创建的API密钥（cr_开头）
+- **重要**：Codex只支持Openai-Response标准
+
+#### 其他第三方工具接入
+
+**接入要点：**
+
+- 所有账号类型都使用相同的API密钥（在后台统一创建）
+- 根据不同的路由前缀自动识别账号类型
+- `/claude/` - 使用Claude账号池
+- `/gemini/` - 使用Gemini账号池  
+- `/openai/` - 使用Codex账号（只支持Openai-Response格式）
+- 支持所有标准API端点（messages、models等）

 **重要说明：**

- 所有格式都支持相同的功能，仅是路径不同
- `/api/v1/messages` = `/claude/v1/messages` = `/openai/claude/v1/messages`
- 选择适合你使用工具的格式即可
- 支持所有Claude API端点（messages、models等）
+- 确保在后台已添加对应类型的账号（Claude/Gemini/Codex）
+- API密钥可以通用，系统会根据路由自动选择账号类型
+- 建议为不同用户创建不同的API密钥便于使用统计

 ---

--- a/src/routes/admin.js
+++ b/src/routes/admin.js
@@ -491,7 +491,9 @@ router.post('/api-keys', authenticateAdmin, async (req, res) => {
      allowedClients,
      dailyCostLimit,
      weeklyOpusCostLimit,
-      tags
+      tags,
+      activationDays, // 新增：激活后有效天数
+      expirationMode // 新增：过期模式
    } = req.body

    // 输入验证
@@ -569,6 +571,31 @@ router.post('/api-keys', authenticateAdmin, async (req, res) => {
      return res.status(400).json({ error: 'All tags must be non-empty strings' })
    }

+    // 验证激活相关字段
+    if (expirationMode && !['fixed', 'activation'].includes(expirationMode)) {
+      return res
+        .status(400)
+        .json({ error: 'Expiration mode must be either "fixed" or "activation"' })
+    }
+
+    if (expirationMode === 'activation') {
+      if (
+        !activationDays ||
+        !Number.isInteger(Number(activationDays)) ||
+        Number(activationDays) < 1
+      ) {
+        return res
+          .status(400)
+          .json({ error: 'Activation days must be a positive integer when using activation mode' })
+      }
+      // 激活模式下不应该设置固定过期时间
+      if (expiresAt) {
+        return res
+          .status(400)
+          .json({ error: 'Cannot set fixed expiration date when using activation mode' })
+      }
+    }
+
    const newKey = await apiKeyService.generateApiKey({
      name,
      description,
@@ -590,7 +617,9 @@ router.post('/api-keys', authenticateAdmin, async (req, res) => {
      allowedClients,
      dailyCostLimit,
      weeklyOpusCostLimit,
-      tags
+      tags,
+      activationDays,
+      expirationMode
    })

    logger.success(`🔑 Admin created new API key: ${name}`)
@@ -624,7 +653,9 @@ router.post('/api-keys/batch', authenticateAdmin, async (req, res) => {
      allowedClients,
      dailyCostLimit,
      weeklyOpusCostLimit,
-      tags
+      tags,
+      activationDays,
+      expirationMode
    } = req.body

    // 输入验证
@@ -668,7 +699,9 @@ router.post('/api-keys/batch', authenticateAdmin, async (req, res) => {
          allowedClients,
          dailyCostLimit,
          weeklyOpusCostLimit,
-          tags
+          tags,
+          activationDays,
+          expirationMode
        })

        // 保留原始 API Key 供返回
@@ -1142,6 +1175,85 @@ router.put('/api-keys/:keyId', authenticateAdmin, async (req, res) => {
  }
 })

+// 修改API Key过期时间（包括手动激活功能）
+router.patch('/api-keys/:keyId/expiration', authenticateAdmin, async (req, res) => {
+  try {
+    const { keyId } = req.params
+    const { expiresAt, activateNow } = req.body
+
+    // 获取当前API Key信息
+    const keyData = await redis.getApiKey(keyId)
+    if (!keyData || Object.keys(keyData).length === 0) {
+      return res.status(404).json({ error: 'API key not found' })
+    }
+
+    const updates = {}
+
+    // 如果是激活操作（用于未激活的key）
+    if (activateNow === true) {
+      if (keyData.expirationMode === 'activation' && keyData.isActivated !== 'true') {
+        const now = new Date()
+        const activationDays = parseInt(keyData.activationDays || 30)
+        const newExpiresAt = new Date(now.getTime() + activationDays * 24 * 60 * 60 * 1000)
+
+        updates.isActivated = 'true'
+        updates.activatedAt = now.toISOString()
+        updates.expiresAt = newExpiresAt.toISOString()
+
+        logger.success(
+          `🔓 API key manually activated by admin: ${keyId} (${keyData.name}), expires at ${newExpiresAt.toISOString()}`
+        )
+      } else {
+        return res.status(400).json({
+          error: 'Cannot activate',
+          message: 'Key is either already activated or not in activation mode'
+        })
+      }
+    }
+
+    // 如果提供了新的过期时间（但不是激活操作）
+    if (expiresAt !== undefined && activateNow !== true) {
+      // 验证过期时间格式
+      if (expiresAt && isNaN(Date.parse(expiresAt))) {
+        return res.status(400).json({ error: 'Invalid expiration date format' })
+      }
+
+      // 如果设置了过期时间，确保key是激活状态
+      if (expiresAt) {
+        updates.expiresAt = new Date(expiresAt).toISOString()
+        // 如果之前是未激活状态，现在激活它
+        if (keyData.isActivated !== 'true') {
+          updates.isActivated = 'true'
+          updates.activatedAt = new Date().toISOString()
+        }
+      } else {
+        // 清除过期时间（永不过期）
+        updates.expiresAt = ''
+      }
+    }
+
+    if (Object.keys(updates).length === 0) {
+      return res.status(400).json({ error: 'No valid updates provided' })
+    }
+
+    // 更新API Key
+    await apiKeyService.updateApiKey(keyId, updates)
+
+    logger.success(`📝 Updated API key expiration: ${keyId} (${keyData.name})`)
+    return res.json({
+      success: true,
+      message: 'API key expiration updated successfully',
+      updates
+    })
+  } catch (error) {
+    logger.error('❌ Failed to update API key expiration:', error)
+    return res.status(500).json({
+      error: 'Failed to update API key expiration',
+      message: error.message
+    })
+  }
+})
+
 // 批量删除API Keys（必须在 :keyId 路由之前定义）
 router.delete('/api-keys/batch', authenticateAdmin, async (req, res) => {
  try {
@@ -5633,7 +5745,9 @@ router.post('/openai-accounts', authenticateAdmin, async (req, res) => {
      accountType,
      groupId,
      rateLimitDuration,
-      priority
+      priority,
+      needsImmediateRefresh, // 是否需要立即刷新
+      requireRefreshSuccess // 是否必须刷新成功才能创建
    } = req.body

    if (!name) {
@@ -5642,7 +5756,8 @@ router.post('/openai-accounts', authenticateAdmin, async (req, res) => {
        message: '账户名称不能为空'
      })
    }
-    // 创建账户数据
+
+    // 准备账户数据
    const accountData = {
      name,
      description: description || '',
@@ -5657,7 +5772,83 @@ router.post('/openai-accounts', authenticateAdmin, async (req, res) => {
      schedulable: true
    }

-    // 创建账户
+    // 如果需要立即刷新且必须成功（OpenAI 手动模式）
+    if (needsImmediateRefresh && requireRefreshSuccess) {
+      // 先创建临时账户以测试刷新
+      const tempAccount = await openaiAccountService.createAccount(accountData)
+
+      try {
+        logger.info(`🔄 测试刷新 OpenAI 账户以获取完整 token 信息`)
+
+        // 尝试刷新 token（会自动使用账户配置的代理）
+        await openaiAccountService.refreshAccountToken(tempAccount.id)
+
+        // 刷新成功，获取更新后的账户信息
+        const refreshedAccount = await openaiAccountService.getAccount(tempAccount.id)
+
+        // 检查是否获取到了 ID Token
+        if (!refreshedAccount.idToken || refreshedAccount.idToken === '') {
+          // 没有获取到 ID Token，删除账户
+          await openaiAccountService.deleteAccount(tempAccount.id)
+          throw new Error('无法获取 ID Token，请检查 Refresh Token 是否有效')
+        }
+
+        // 如果是分组类型，添加到分组
+        if (accountType === 'group' && groupId) {
+          await accountGroupService.addAccountToGroup(tempAccount.id, groupId, 'openai')
+        }
+
+        // 清除敏感信息后返回
+        delete refreshedAccount.idToken
+        delete refreshedAccount.accessToken
+        delete refreshedAccount.refreshToken
+
+        logger.success(`✅ 创建并验证 OpenAI 账户成功: ${name} (ID: ${tempAccount.id})`)
+
+        return res.json({
+          success: true,
+          data: refreshedAccount,
+          message: '账户创建成功，并已获取完整 token 信息'
+        })
+      } catch (refreshError) {
+        // 刷新失败，删除临时创建的账户
+        logger.warn(`❌ 刷新失败，删除临时账户: ${refreshError.message}`)
+        await openaiAccountService.deleteAccount(tempAccount.id)
+
+        // 构建详细的错误信息
+        const errorResponse = {
+          success: false,
+          message: '账户创建失败',
+          error: refreshError.message
+        }
+
+        // 添加更详细的错误信息
+        if (refreshError.status) {
+          errorResponse.errorCode = refreshError.status
+        }
+        if (refreshError.details) {
+          errorResponse.errorDetails = refreshError.details
+        }
+        if (refreshError.code) {
+          errorResponse.networkError = refreshError.code
+        }
+
+        // 提供更友好的错误提示
+        if (refreshError.message.includes('Refresh Token 无效')) {
+          errorResponse.suggestion = '请检查 Refresh Token 是否正确，或重新通过 OAuth 授权获取'
+        } else if (refreshError.message.includes('代理')) {
+          errorResponse.suggestion = '请检查代理配置是否正确，包括地址、端口和认证信息'
+        } else if (refreshError.message.includes('过于频繁')) {
+          errorResponse.suggestion = '请稍后再试，或更换代理 IP'
+        } else if (refreshError.message.includes('连接')) {
+          errorResponse.suggestion = '请检查网络连接和代理设置'
+        }
+
+        return res.status(400).json(errorResponse)
+      }
+    }
+
+    // 不需要强制刷新的情况（OAuth 模式或其他平台）
    const createdAccount = await openaiAccountService.createAccount(accountData)

    // 如果是分组类型，添加到分组
@@ -5665,6 +5856,17 @@ router.post('/openai-accounts', authenticateAdmin, async (req, res) => {
      await accountGroupService.addAccountToGroup(createdAccount.id, groupId, 'openai')
    }

+    // 如果需要刷新但不强制成功（OAuth 模式可能已有完整信息）
+    if (needsImmediateRefresh && !requireRefreshSuccess) {
+      try {
+        logger.info(`🔄 尝试刷新 OpenAI 账户 ${createdAccount.id}`)
+        await openaiAccountService.refreshAccountToken(createdAccount.id)
+        logger.info(`✅ 刷新成功`)
+      } catch (refreshError) {
+        logger.warn(`⚠️ 刷新失败，但账户已创建: ${refreshError.message}`)
+      }
+    }
+
    logger.success(`✅ 创建 OpenAI 账户成功: ${name} (ID: ${createdAccount.id})`)

    return res.json({
@@ -5686,6 +5888,7 @@ router.put('/openai-accounts/:id', authenticateAdmin, async (req, res) => {
  try {
    const { id } = req.params
    const updates = req.body
+    const { needsImmediateRefresh, requireRefreshSuccess } = updates

    // 验证accountType的有效性
    if (updates.accountType && !['shared', 'dedicated', 'group'].includes(updates.accountType)) {
@@ -5705,6 +5908,93 @@ router.put('/openai-accounts/:id', authenticateAdmin, async (req, res) => {
      return res.status(404).json({ error: 'Account not found' })
    }

+    // 如果更新了 Refresh Token，需要验证其有效性
+    if (updates.openaiOauth?.refreshToken && needsImmediateRefresh && requireRefreshSuccess) {
+      // 先更新 token 信息
+      const tempUpdateData = {}
+      if (updates.openaiOauth.refreshToken) {
+        tempUpdateData.refreshToken = updates.openaiOauth.refreshToken
+      }
+      if (updates.openaiOauth.accessToken) {
+        tempUpdateData.accessToken = updates.openaiOauth.accessToken
+      }
+      // 更新代理配置（如果有）
+      if (updates.proxy !== undefined) {
+        tempUpdateData.proxy = updates.proxy
+      }
+
+      // 临时更新账户以测试新的 token
+      await openaiAccountService.updateAccount(id, tempUpdateData)
+
+      try {
+        logger.info(`🔄 验证更新的 OpenAI token (账户: ${id})`)
+
+        // 尝试刷新 token（会使用账户配置的代理）
+        await openaiAccountService.refreshAccountToken(id)
+
+        // 获取刷新后的账户信息
+        const refreshedAccount = await openaiAccountService.getAccount(id)
+
+        // 检查是否获取到了 ID Token
+        if (!refreshedAccount.idToken || refreshedAccount.idToken === '') {
+          // 恢复原始 token
+          await openaiAccountService.updateAccount(id, {
+            refreshToken: currentAccount.refreshToken,
+            accessToken: currentAccount.accessToken,
+            idToken: currentAccount.idToken
+          })
+
+          return res.status(400).json({
+            success: false,
+            message: '无法获取 ID Token，请检查 Refresh Token 是否有效',
+            error: 'Invalid refresh token'
+          })
+        }
+
+        logger.success(`✅ Token 验证成功，继续更新账户信息`)
+      } catch (refreshError) {
+        // 刷新失败，恢复原始 token
+        logger.warn(`❌ Token 验证失败，恢复原始配置: ${refreshError.message}`)
+        await openaiAccountService.updateAccount(id, {
+          refreshToken: currentAccount.refreshToken,
+          accessToken: currentAccount.accessToken,
+          idToken: currentAccount.idToken,
+          proxy: currentAccount.proxy
+        })
+
+        // 构建详细的错误信息
+        const errorResponse = {
+          success: false,
+          message: '更新失败',
+          error: refreshError.message
+        }
+
+        // 添加更详细的错误信息
+        if (refreshError.status) {
+          errorResponse.errorCode = refreshError.status
+        }
+        if (refreshError.details) {
+          errorResponse.errorDetails = refreshError.details
+        }
+        if (refreshError.code) {
+          errorResponse.networkError = refreshError.code
+        }
+
+        // 提供更友好的错误提示
+        if (refreshError.message.includes('Refresh Token 无效')) {
+          errorResponse.suggestion = '请检查 Refresh Token 是否正确，或重新通过 OAuth 授权获取'
+        } else if (refreshError.message.includes('代理')) {
+          errorResponse.suggestion = '请检查代理配置是否正确，包括地址、端口和认证信息'
+        } else if (refreshError.message.includes('过于频繁')) {
+          errorResponse.suggestion = '请稍后再试，或更换代理 IP'
+        } else if (refreshError.message.includes('连接')) {
+          errorResponse.suggestion = '请检查网络连接和代理设置'
+        }
+
+        return res.status(400).json(errorResponse)
+      }
+    }
+
    // 处理分组的变更
    if (updates.accountType !== undefined) {
      // 如果之前是分组类型，需要从原分组中移除
@@ -5726,9 +6016,7 @@ router.put('/openai-accounts/:id', authenticateAdmin, async (req, res) => {
    // 处理敏感数据加密
    if (updates.openaiOauth) {
      updateData.openaiOauth = updates.openaiOauth
-      if (updates.openaiOauth.idToken) {
-        updateData.idToken = updates.openaiOauth.idToken
-      }
+      // 编辑时不允许直接输入 ID Token，只能通过刷新获取
      if (updates.openaiOauth.accessToken) {
        updateData.accessToken = updates.openaiOauth.accessToken
      }
@@ -5762,6 +6050,17 @@ router.put('/openai-accounts/:id', authenticateAdmin, async (req, res) => {

    const updatedAccount = await openaiAccountService.updateAccount(id, updateData)

+    // 如果需要刷新但不强制成功（非关键更新）
+    if (needsImmediateRefresh && !requireRefreshSuccess) {
+      try {
+        logger.info(`🔄 尝试刷新 OpenAI 账户 ${id}`)
+        await openaiAccountService.refreshAccountToken(id)
+        logger.info(`✅ 刷新成功`)
+      } catch (refreshError) {
+        logger.warn(`⚠️ 刷新失败，但账户信息已更新: ${refreshError.message}`)
+      }
+    }
+
    logger.success(`📝 Admin updated OpenAI account: ${id}`)
    return res.json({ success: true, data: updatedAccount })
  } catch (error) {
--- a/src/routes/openaiRoutes.js
+++ b/src/routes/openaiRoutes.js
@@ -3,7 +3,6 @@ const axios = require('axios')
 const router = express.Router()
 const logger = require('../utils/logger')
 const { authenticateApiKey } = require('../middleware/auth')
-const claudeAccountService = require('../services/claudeAccountService')
 const unifiedOpenAIScheduler = require('../services/unifiedOpenAIScheduler')
 const openaiAccountService = require('../services/openaiAccountService')
 const apiKeyService = require('../services/apiKeyService')
@@ -35,13 +34,31 @@ async function getOpenAIAuthToken(apiKeyData, sessionId = null, requestedModel =
    }

    // 获取账户详情
-    const account = await openaiAccountService.getAccount(result.accountId)
+    let account = await openaiAccountService.getAccount(result.accountId)
    if (!account || !account.accessToken) {
      throw new Error(`OpenAI account ${result.accountId} has no valid accessToken`)
    }

-    // 解密 accessToken
-    const accessToken = claudeAccountService._decryptSensitiveData(account.accessToken)
+    // 检查 token 是否过期并自动刷新（双重保护）
+    if (openaiAccountService.isTokenExpired(account)) {
+      if (account.refreshToken) {
+        logger.info(`🔄 Token expired, auto-refreshing for account ${account.name} (fallback)`)
+        try {
+          await openaiAccountService.refreshAccountToken(result.accountId)
+          // 重新获取更新后的账户
+          account = await openaiAccountService.getAccount(result.accountId)
+          logger.info(`✅ Token refreshed successfully in route handler`)
+        } catch (refreshError) {
+          logger.error(`Failed to refresh token for ${account.name}:`, refreshError)
+          throw new Error(`Token expired and refresh failed: ${refreshError.message}`)
+        }
+      } else {
+        throw new Error(`Token expired and no refresh token available for account ${account.name}`)
+      }
+    }
+
+    // 解密 accessToken（account.accessToken 是加密的）
+    const accessToken = openaiAccountService.decrypt(account.accessToken)
    if (!accessToken) {
      throw new Error('Failed to decrypt OpenAI accessToken')
    }
@@ -161,7 +178,7 @@ router.post('/responses', authenticateApiKey, async (req, res) => {
    // 配置请求选项
    const axiosConfig = {
      headers,
-      timeout: 60000,
+      timeout: 60 * 1000 * 10,
      validateStatus: () => true
    }

--- a/src/services/apiKeyService.js
+++ b/src/services/apiKeyService.js
@@ -34,7 +34,9 @@ class ApiKeyService {
      allowedClients = [],
      dailyCostLimit = 0,
      weeklyOpusCostLimit = 0,
-      tags = []
+      tags = [],
+      activationDays = 0, // 新增：激活后有效天数（0表示不使用此功能）
+      expirationMode = 'fixed' // 新增：过期模式 'fixed'(固定时间) 或 'activation'(首次使用后激活)
    } = options

    // 生成简单的API Key (64字符十六进制)
@@ -67,9 +69,13 @@ class ApiKeyService {
      dailyCostLimit: String(dailyCostLimit || 0),
      weeklyOpusCostLimit: String(weeklyOpusCostLimit || 0),
      tags: JSON.stringify(tags || []),
+      activationDays: String(activationDays || 0), // 新增：激活后有效天数
+      expirationMode: expirationMode || 'fixed', // 新增：过期模式
+      isActivated: expirationMode === 'fixed' ? 'true' : 'false', // 根据模式决定激活状态
+      activatedAt: expirationMode === 'fixed' ? new Date().toISOString() : '', // 激活时间
      createdAt: new Date().toISOString(),
      lastUsedAt: '',
-      expiresAt: expiresAt || '',
+      expiresAt: expirationMode === 'fixed' ? expiresAt || '' : '', // 固定模式才设置过期时间
      createdBy: options.createdBy || 'admin',
      userId: options.userId || '',
      userUsername: options.userUsername || ''
@@ -105,6 +111,10 @@ class ApiKeyService {
      dailyCostLimit: parseFloat(keyData.dailyCostLimit || 0),
      weeklyOpusCostLimit: parseFloat(keyData.weeklyOpusCostLimit || 0),
      tags: JSON.parse(keyData.tags || '[]'),
+      activationDays: parseInt(keyData.activationDays || 0),
+      expirationMode: keyData.expirationMode || 'fixed',
+      isActivated: keyData.isActivated === 'true',
+      activatedAt: keyData.activatedAt,
      createdAt: keyData.createdAt,
      expiresAt: keyData.expiresAt,
      createdBy: keyData.createdBy
@@ -133,6 +143,27 @@ class ApiKeyService {
        return { valid: false, error: 'API key is disabled' }
      }

+      // 处理激活逻辑（仅在 activation 模式下）
+      if (keyData.expirationMode === 'activation' && keyData.isActivated !== 'true') {
+        // 首次使用，需要激活
+        const now = new Date()
+        const activationDays = parseInt(keyData.activationDays || 30) // 默认30天
+        const expiresAt = new Date(now.getTime() + activationDays * 24 * 60 * 60 * 1000)
+
+        // 更新激活状态和过期时间
+        keyData.isActivated = 'true'
+        keyData.activatedAt = now.toISOString()
+        keyData.expiresAt = expiresAt.toISOString()
+        keyData.lastUsedAt = now.toISOString()
+
+        // 保存到Redis
+        await redis.setApiKey(keyData.id, keyData)
+
+        logger.success(
+          `🔓 API key activated: ${keyData.id} (${keyData.name}), will expire in ${activationDays} days at ${expiresAt.toISOString()}`
+        )
+      }
+
      // 检查是否过期
      if (keyData.expiresAt && new Date() > new Date(keyData.expiresAt)) {
        return { valid: false, error: 'API key has expired' }
@@ -261,6 +292,10 @@ class ApiKeyService {
        key.weeklyOpusCostLimit = parseFloat(key.weeklyOpusCostLimit || 0)
        key.dailyCost = (await redis.getDailyCost(key.id)) || 0
        key.weeklyOpusCost = (await redis.getWeeklyOpusCost(key.id)) || 0
+        key.activationDays = parseInt(key.activationDays || 0)
+        key.expirationMode = key.expirationMode || 'fixed'
+        key.isActivated = key.isActivated === 'true'
+        key.activatedAt = key.activatedAt || null

        // 获取当前时间窗口的请求次数、Token使用量和费用
        if (key.rateLimitWindow > 0) {
@@ -362,6 +397,10 @@ class ApiKeyService {
        'bedrockAccountId', // 添加 Bedrock 账号ID
        'permissions',
        'expiresAt',
+        'activationDays', // 新增：激活后有效天数
+        'expirationMode', // 新增：过期模式
+        'isActivated', // 新增：是否已激活
+        'activatedAt', // 新增：激活时间
        'enableModelRestriction',
        'restrictedModels',
        'enableClientRestriction',
@@ -380,9 +419,16 @@ class ApiKeyService {
          if (field === 'restrictedModels' || field === 'allowedClients' || field === 'tags') {
            // 特殊处理数组字段
            updatedData[field] = JSON.stringify(value || [])
-          } else if (field === 'enableModelRestriction' || field === 'enableClientRestriction') {
+          } else if (
+            field === 'enableModelRestriction' ||
+            field === 'enableClientRestriction' ||
+            field === 'isActivated'
+          ) {
            // 布尔值转字符串
            updatedData[field] = String(value)
+          } else if (field === 'expiresAt' || field === 'activatedAt') {
+            // 日期字段保持原样，不要toString()
+            updatedData[field] = value || ''
          } else {
            updatedData[field] = (value !== null && value !== undefined ? value : '').toString()
          }
--- a/src/services/openaiAccountService.js
+++ b/src/services/openaiAccountService.js
@@ -14,7 +14,7 @@ const {
  logRefreshSkipped
 } = require('../utils/tokenRefreshLogger')
 const LRUCache = require('../utils/lruCache')
-// const tokenRefreshService = require('./tokenRefreshService')
+const tokenRefreshService = require('./tokenRefreshService')

 // 加密相关常量
 const ALGORITHM = 'aes-256-cbc'
@@ -57,7 +57,17 @@ function encrypt(text) {

 // 解密函数
 function decrypt(text) {
-  if (!text) {
+  if (!text || text === '') {
+    return ''
+  }
+
+  // 检查是否是有效的加密格式（至少需要 32 个字符的 IV + 冒号 + 加密文本）
+  if (text.length < 33 || text.charAt(32) !== ':') {
+    logger.warn('Invalid encrypted text format, returning empty string', {
+      textLength: text ? text.length : 0,
+      char32: text && text.length > 32 ? text.charAt(32) : 'N/A',
+      first50: text ? text.substring(0, 50) : 'N/A'
+    })
    return ''
  }

@@ -135,6 +145,7 @@ async function refreshAccessToken(refreshToken, proxy = null) {
    const proxyAgent = ProxyHelper.createProxyAgent(proxy)
    if (proxyAgent) {
      requestOptions.httpsAgent = proxyAgent
+      requestOptions.proxy = false // 重要：禁用 axios 的默认代理，强制使用我们的 httpsAgent
      logger.info(
        `🌐 Using proxy for OpenAI token refresh: ${ProxyHelper.getProxyDescription(proxy)}`
      )
@@ -143,6 +154,7 @@ async function refreshAccessToken(refreshToken, proxy = null) {
    }

    // 发送请求
+    logger.info('🔍 发送 token 刷新请求，使用代理:', !!requestOptions.httpsAgent)
    const response = await axios(requestOptions)

    if (response.status === 200 && response.data) {
@@ -164,22 +176,73 @@ async function refreshAccessToken(refreshToken, proxy = null) {
  } catch (error) {
    if (error.response) {
      // 服务器响应了错误状态码
+      const errorData = error.response.data || {}
      logger.error('OpenAI token refresh failed:', {
        status: error.response.status,
-        data: error.response.data,
+        data: errorData,
        headers: error.response.headers
      })
-      throw new Error(
-        `Token refresh failed: ${error.response.status} - ${JSON.stringify(error.response.data)}`
-      )
+
+      // 构建详细的错误信息
+      let errorMessage = `OpenAI 服务器返回错误 (${error.response.status})`
+
+      if (error.response.status === 400) {
+        if (errorData.error === 'invalid_grant') {
+          errorMessage = 'Refresh Token 无效或已过期，请重新授权'
+        } else if (errorData.error === 'invalid_request') {
+          errorMessage = `请求参数错误：${errorData.error_description || errorData.error}`
+        } else {
+          errorMessage = `请求错误：${errorData.error_description || errorData.error || '未知错误'}`
+        }
+      } else if (error.response.status === 401) {
+        errorMessage = '认证失败：Refresh Token 无效'
+      } else if (error.response.status === 403) {
+        errorMessage = '访问被拒绝：可能是 IP 被封或账户被禁用'
+      } else if (error.response.status === 429) {
+        errorMessage = '请求过于频繁，请稍后重试'
+      } else if (error.response.status >= 500) {
+        errorMessage = 'OpenAI 服务器内部错误，请稍后重试'
+      } else if (errorData.error_description) {
+        errorMessage = errorData.error_description
+      } else if (errorData.error) {
+        errorMessage = errorData.error
+      } else if (errorData.message) {
+        errorMessage = errorData.message
+      }
+
+      const fullError = new Error(errorMessage)
+      fullError.status = error.response.status
+      fullError.details = errorData
+      throw fullError
    } else if (error.request) {
      // 请求已发出但没有收到响应
      logger.error('OpenAI token refresh no response:', error.message)
-      throw new Error(`Token refresh failed: No response from server - ${error.message}`)
+
+      let errorMessage = '无法连接到 OpenAI 服务器'
+      if (proxy) {
+        errorMessage += `（代理: ${ProxyHelper.getProxyDescription(proxy)}）`
+      }
+      if (error.code === 'ECONNREFUSED') {
+        errorMessage += ' - 连接被拒绝'
+      } else if (error.code === 'ETIMEDOUT') {
+        errorMessage += ' - 连接超时'
+      } else if (error.code === 'ENOTFOUND') {
+        errorMessage += ' - 无法解析域名'
+      } else if (error.code === 'EPROTO') {
+        errorMessage += ' - 协议错误（可能是代理配置问题）'
+      } else if (error.message) {
+        errorMessage += ` - ${error.message}`
+      }
+
+      const fullError = new Error(errorMessage)
+      fullError.code = error.code
+      throw fullError
    } else {
      // 设置请求时发生错误
      logger.error('OpenAI token refresh error:', error.message)
-      throw new Error(`Token refresh failed: ${error.message}`)
+      const fullError = new Error(`请求设置错误: ${error.message}`)
+      fullError.originalError = error
+      throw fullError
    }
  }
 }
@@ -192,34 +255,71 @@ function isTokenExpired(account) {
  return new Date(account.expiresAt) <= new Date()
 }

-// 刷新账户的 access token
+// 刷新账户的 access token（带分布式锁）
 async function refreshAccountToken(accountId) {
-  const account = await getAccount(accountId)
-  if (!account) {
-    throw new Error('Account not found')
-  }
-
-  const accountName = account.name || accountId
-  logRefreshStart(accountId, accountName, 'openai')
-
-  // 检查是否有 refresh token
-  const refreshToken = account.refreshToken ? decrypt(account.refreshToken) : null
-  if (!refreshToken) {
-    logRefreshSkipped(accountId, accountName, 'openai', 'No refresh token available')
-    throw new Error('No refresh token available')
-  }
-
-  // 获取代理配置
-  let proxy = null
-  if (account.proxy) {
-    try {
-      proxy = typeof account.proxy === 'string' ? JSON.parse(account.proxy) : account.proxy
-    } catch (e) {
-      logger.warn(`Failed to parse proxy config for account ${accountId}:`, e)
-    }
-  }
+  let lockAcquired = false
+  let account = null
+  let accountName = accountId

  try {
+    account = await getAccount(accountId)
+    if (!account) {
+      throw new Error('Account not found')
+    }
+
+    accountName = account.name || accountId
+
+    // 检查是否有 refresh token
+    // account.refreshToken 在 getAccount 中已经被解密了，直接使用即可
+    const refreshToken = account.refreshToken || null
+
+    if (!refreshToken) {
+      logRefreshSkipped(accountId, accountName, 'openai', 'No refresh token available')
+      throw new Error('No refresh token available')
+    }
+
+    // 尝试获取分布式锁
+    lockAcquired = await tokenRefreshService.acquireRefreshLock(accountId, 'openai')
+
+    if (!lockAcquired) {
+      // 如果无法获取锁，说明另一个进程正在刷新
+      logger.info(
+        `🔒 Token refresh already in progress for OpenAI account: ${accountName} (${accountId})`
+      )
+      logRefreshSkipped(accountId, accountName, 'openai', 'already_locked')
+
+      // 等待一段时间后返回，期望其他进程已完成刷新
+      await new Promise((resolve) => setTimeout(resolve, 2000))
+
+      // 重新获取账户数据（可能已被其他进程刷新）
+      const updatedAccount = await getAccount(accountId)
+      if (updatedAccount && !isTokenExpired(updatedAccount)) {
+        return {
+          access_token: decrypt(updatedAccount.accessToken),
+          id_token: updatedAccount.idToken,
+          refresh_token: updatedAccount.refreshToken,
+          expires_in: 3600,
+          expiry_date: new Date(updatedAccount.expiresAt).getTime()
+        }
+      }
+
+      throw new Error('Token refresh in progress by another process')
+    }
+
+    // 获取锁成功，开始刷新
+    logRefreshStart(accountId, accountName, 'openai')
+    logger.info(`🔄 Starting token refresh for OpenAI account: ${accountName} (${accountId})`)
+
+    // 获取代理配置
+    let proxy = null
+    if (account.proxy) {
+      try {
+        proxy = typeof account.proxy === 'string' ? JSON.parse(account.proxy) : account.proxy
+      } catch (e) {
+        logger.warn(`Failed to parse proxy config for account ${accountId}:`, e)
+      }
+    }
+
    const newTokens = await refreshAccessToken(refreshToken, proxy)
    if (!newTokens) {
      throw new Error('Failed to refresh token')
@@ -231,9 +331,51 @@ async function refreshAccountToken(accountId) {
      expiresAt: new Date(newTokens.expiry_date).toISOString()
    }

-    // 如果有新的 ID token，也更新它
+    // 如果有新的 ID token，也更新它（这对于首次未提供 ID Token 的账户特别重要）
    if (newTokens.id_token) {
      updates.idToken = encrypt(newTokens.id_token)
+
+      // 如果之前没有 ID Token，尝试解析并更新用户信息
+      if (!account.idToken || account.idToken === '') {
+        try {
+          const idTokenParts = newTokens.id_token.split('.')
+          if (idTokenParts.length === 3) {
+            const payload = JSON.parse(Buffer.from(idTokenParts[1], 'base64').toString())
+            const authClaims = payload['https://api.openai.com/auth'] || {}
+
+            // 更新账户信息 - 使用正确的字段名
+            // OpenAI ID Token中用户ID在chatgpt_account_id、chatgpt_user_id和user_id字段
+            if (authClaims.chatgpt_account_id) {
+              updates.accountId = authClaims.chatgpt_account_id
+            }
+            if (authClaims.chatgpt_user_id) {
+              updates.chatgptUserId = authClaims.chatgpt_user_id
+            } else if (authClaims.user_id) {
+              // 有些情况下可能只有user_id字段
+              updates.chatgptUserId = authClaims.user_id
+            }
+            if (authClaims.organizations?.[0]?.id) {
+              updates.organizationId = authClaims.organizations[0].id
+            }
+            if (authClaims.organizations?.[0]?.role) {
+              updates.organizationRole = authClaims.organizations[0].role
+            }
+            if (authClaims.organizations?.[0]?.title) {
+              updates.organizationTitle = authClaims.organizations[0].title
+            }
+            if (payload.email) {
+              updates.email = encrypt(payload.email)
+            }
+            if (payload.email_verified !== undefined) {
+              updates.emailVerified = payload.email_verified
+            }
+
+            logger.info(`Updated user info from ID Token for account ${accountId}`)
+          }
+        } catch (e) {
+          logger.warn(`Failed to parse ID Token for account ${accountId}:`, e)
+        }
+      }
    }

    // 如果返回了新的 refresh token，更新它
@@ -248,8 +390,34 @@ async function refreshAccountToken(accountId) {
    logRefreshSuccess(accountId, accountName, 'openai', newTokens.expiry_date)
    return newTokens
  } catch (error) {
-    logRefreshError(accountId, accountName, 'openai', error.message)
+    logRefreshError(accountId, account?.name || accountName, 'openai', error.message)
+
+    // 发送 Webhook 通知（如果启用）
+    try {
+      const webhookNotifier = require('../utils/webhookNotifier')
+      await webhookNotifier.sendAccountAnomalyNotification({
+        accountId,
+        accountName: account?.name || accountName,
+        platform: 'openai',
+        status: 'error',
+        errorCode: 'OPENAI_TOKEN_REFRESH_FAILED',
+        reason: `Token refresh failed: ${error.message}`,
+        timestamp: new Date().toISOString()
+      })
+      logger.info(
+        `📢 Webhook notification sent for OpenAI account ${account?.name || accountName} refresh failure`
+      )
+    } catch (webhookError) {
+      logger.error('Failed to send webhook notification:', webhookError)
+    }
+
    throw error
+  } finally {
+    // 确保释放锁
+    if (lockAcquired) {
+      await tokenRefreshService.releaseRefreshLock(accountId, 'openai')
+      logger.debug(`🔓 Released refresh lock for OpenAI account ${accountId}`)
+    }
  }
 }

@@ -270,6 +438,10 @@ async function createAccount(accountData) {
  // 处理账户信息
  const accountInfo = accountData.accountInfo || {}

+  // 检查邮箱是否已经是加密格式（包含冒号分隔的32位十六进制字符）
+  const isEmailEncrypted =
+    accountInfo.email && accountInfo.email.length >= 33 && accountInfo.email.charAt(32) === ':'
+
  const account = {
    id: accountId,
    name: accountData.name,
@@ -282,19 +454,25 @@ async function createAccount(accountData) {
        ? accountData.rateLimitDuration
        : 60,
    // OAuth相关字段（加密存储）
-    idToken: encrypt(oauthData.idToken || ''),
-    accessToken: encrypt(oauthData.accessToken || ''),
-    refreshToken: encrypt(oauthData.refreshToken || ''),
+    // ID Token 现在是可选的，如果没有提供会在首次刷新时自动获取
+    idToken: oauthData.idToken && oauthData.idToken.trim() ? encrypt(oauthData.idToken) : '',
+    accessToken:
+      oauthData.accessToken && oauthData.accessToken.trim() ? encrypt(oauthData.accessToken) : '',
+    refreshToken:
+      oauthData.refreshToken && oauthData.refreshToken.trim()
+        ? encrypt(oauthData.refreshToken)
+        : '',
    openaiOauth: encrypt(JSON.stringify(oauthData)),
-    // 账户信息字段
+    // 账户信息字段 - 确保所有字段都被保存，即使是空字符串
    accountId: accountInfo.accountId || '',
    chatgptUserId: accountInfo.chatgptUserId || '',
    organizationId: accountInfo.organizationId || '',
    organizationRole: accountInfo.organizationRole || '',
    organizationTitle: accountInfo.organizationTitle || '',
    planType: accountInfo.planType || '',
-    email: encrypt(accountInfo.email || ''),
-    emailVerified: accountInfo.emailVerified || false,
+    // 邮箱字段：检查是否已经加密，避免双重加密
+    email: isEmailEncrypted ? accountInfo.email : encrypt(accountInfo.email || ''),
+    emailVerified: accountInfo.emailVerified === true ? 'true' : 'false',
    // 过期时间
    expiresAt: oauthData.expires_in
      ? new Date(Date.now() + oauthData.expires_in * 1000).toISOString()
@@ -339,9 +517,10 @@ async function getAccount(accountId) {
  if (accountData.idToken) {
    accountData.idToken = decrypt(accountData.idToken)
  }
-  if (accountData.accessToken) {
-    accountData.accessToken = decrypt(accountData.accessToken)
-  }
+  // 注意：accessToken 在 openaiRoutes.js 中会被单独解密，这里不解密
+  // if (accountData.accessToken) {
+  //   accountData.accessToken = decrypt(accountData.accessToken)
+  // }
  if (accountData.refreshToken) {
    accountData.refreshToken = decrypt(accountData.refreshToken)
  }
@@ -391,7 +570,7 @@ async function updateAccount(accountId, updates) {
  if (updates.accessToken) {
    updates.accessToken = encrypt(updates.accessToken)
  }
-  if (updates.refreshToken) {
+  if (updates.refreshToken && updates.refreshToken.trim()) {
    updates.refreshToken = encrypt(updates.refreshToken)
  }
  if (updates.email) {
@@ -476,6 +655,9 @@ async function getAllAccounts() {
        accountData.email = decrypt(accountData.email)
      }

+      // 先保存 refreshToken 是否存在的标记
+      const hasRefreshTokenFlag = !!accountData.refreshToken
+
      // 屏蔽敏感信息（token等不应该返回给前端）
      delete accountData.idToken
      delete accountData.accessToken
@@ -512,7 +694,7 @@ async function getAllAccounts() {
        scopes:
          accountData.scopes && accountData.scopes.trim() ? accountData.scopes.split(' ') : [],
        // 添加 hasRefreshToken 标记
-        hasRefreshToken: !!accountData.refreshToken,
+        hasRefreshToken: hasRefreshTokenFlag,
        // 添加限流状态信息（统一格式）
        rateLimitStatus: rateLimitInfo
          ? {
@@ -640,6 +822,26 @@ async function setAccountRateLimited(accountId, isLimited) {

  await updateAccount(accountId, updates)
  logger.info(`Set rate limit status for OpenAI account ${accountId}: ${updates.rateLimitStatus}`)
+
+  // 如果被限流，发送 Webhook 通知
+  if (isLimited) {
+    try {
+      const account = await getAccount(accountId)
+      const webhookNotifier = require('../utils/webhookNotifier')
+      await webhookNotifier.sendAccountAnomalyNotification({
+        accountId,
+        accountName: account.name || accountId,
+        platform: 'openai',
+        status: 'blocked',
+        errorCode: 'OPENAI_RATE_LIMITED',
+        reason: 'Account rate limited (429 error). Estimated reset in 1 hour',
+        timestamp: new Date().toISOString()
+      })
+      logger.info(`📢 Webhook notification sent for OpenAI account ${account.name} rate limit`)
+    } catch (webhookError) {
+      logger.error('Failed to send rate limit webhook notification:', webhookError)
+    }
+  }
 }

 // 切换账户调度状态
--- a/src/services/unifiedOpenAIScheduler.js
+++ b/src/services/unifiedOpenAIScheduler.js
@@ -167,7 +167,7 @@ class UnifiedOpenAIScheduler {

    // 获取所有OpenAI账户（共享池）
    const openaiAccounts = await openaiAccountService.getAllAccounts()
-    for (const account of openaiAccounts) {
+    for (let account of openaiAccounts) {
      if (
        account.isActive &&
        account.status !== 'error' &&
@@ -176,13 +176,27 @@ class UnifiedOpenAIScheduler {
      ) {
        // 检查是否可调度

-        // 检查token是否过期
+        // 检查token是否过期并自动刷新
        const isExpired = openaiAccountService.isTokenExpired(account)
-        if (isExpired && !account.refreshToken) {
-          logger.warn(
-            `⚠️ OpenAI account ${account.name} token expired and no refresh token available`
-          )
-          continue
+        if (isExpired) {
+          if (!account.refreshToken) {
+            logger.warn(
+              `⚠️ OpenAI account ${account.name} token expired and no refresh token available`
+            )
+            continue
+          }
+
+          // 自动刷新过期的 token
+          try {
+            logger.info(`🔄 Auto-refreshing expired token for OpenAI account ${account.name}`)
+            await openaiAccountService.refreshAccountToken(account.id)
+            // 重新获取更新后的账户信息
+            account = await openaiAccountService.getAccount(account.id)
+            logger.info(`✅ Token refreshed successfully for ${account.name}`)
+          } catch (refreshError) {
+            logger.error(`❌ Failed to refresh token for ${account.name}:`, refreshError.message)
+            continue // 刷新失败，跳过此账户
+          }
        }

        // 检查模型支持（仅在明确设置了supportedModels且不为空时才检查）
--- a/src/utils/webhookNotifier.js
+++ b/src/utils/webhookNotifier.js
@@ -81,6 +81,12 @@ class WebhookNotifier {
        error: 'GEMINI_ERROR',
        unauthorized: 'GEMINI_UNAUTHORIZED',
        disabled: 'GEMINI_MANUALLY_DISABLED'
+      },
+      openai: {
+        error: 'OPENAI_ERROR',
+        unauthorized: 'OPENAI_UNAUTHORIZED',
+        blocked: 'OPENAI_RATE_LIMITED',
+        disabled: 'OPENAI_MANUALLY_DISABLED'
      }
    }

--- a/web/admin-spa/src/assets/styles/global.css
+++ b/web/admin-spa/src/assets/styles/global.css
@@ -17,7 +17,7 @@
  --bg-gradient-mid: #764ba2;
  --bg-gradient-end: #f093fb;
  --input-bg: rgba(255, 255, 255, 0.9);
-  --input-border: rgba(255, 255, 255, 0.3);
+  --input-border: rgba(209, 213, 219, 0.8);
  --modal-bg: rgba(0, 0, 0, 0.4);
  --table-bg: rgba(255, 255, 255, 0.95);
  --table-hover: rgba(102, 126, 234, 0.05);
--- a/web/admin-spa/src/components/accounts/AccountForm.vue
+++ b/web/admin-spa/src/components/accounts/AccountForm.vue
@@ -176,7 +176,7 @@
              >
              <input
                v-model="form.name"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                :class="{ 'border-red-500': errors.name }"
                placeholder="为账户设置一个易识别的名称"
                required
@@ -193,7 +193,7 @@
              >
              <textarea
                v-model="form.description"
-                class="form-input w-full resize-none dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full resize-none border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                placeholder="账户用途说明..."
                rows="3"
              />
@@ -300,7 +300,7 @@
              >
              <input
                v-model="form.projectId"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                placeholder="例如：verdant-wares-464411-k9"
                type="text"
              />
@@ -351,7 +351,7 @@
                >
                <input
                  v-model="form.accessKeyId"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.accessKeyId }"
                  placeholder="请输入 AWS Access Key ID"
                  required
@@ -368,7 +368,7 @@
                >
                <input
                  v-model="form.secretAccessKey"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.secretAccessKey }"
                  placeholder="请输入 AWS Secret Access Key"
                  required
@@ -385,7 +385,7 @@
                >
                <input
                  v-model="form.region"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.region }"
                  placeholder="例如：us-east-1"
                  required
@@ -419,7 +419,7 @@
                >
                <input
                  v-model="form.sessionToken"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  placeholder="如果使用临时凭证，请输入会话令牌"
                  type="password"
                />
@@ -434,7 +434,7 @@
                >
                <input
                  v-model="form.defaultModel"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  placeholder="例如：us.anthropic.claude-sonnet-4-20250514-v1:0"
                  type="text"
                />
@@ -463,7 +463,7 @@
                >
                <input
                  v-model="form.smallFastModel"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  placeholder="例如：us.anthropic.claude-3-5-haiku-20241022-v1:0"
                  type="text"
                />
@@ -481,7 +481,7 @@
                >
                <input
                  v-model="form.azureEndpoint"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.azureEndpoint }"
                  placeholder="https://your-resource.openai.azure.com"
                  required
@@ -501,7 +501,7 @@
                >
                <input
                  v-model="form.apiVersion"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  placeholder="2024-02-01"
                  type="text"
                />
@@ -516,7 +516,7 @@
                >
                <input
                  v-model="form.deploymentName"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.deploymentName }"
                  placeholder="gpt-4"
                  required
@@ -536,7 +536,7 @@
                >
                <input
                  v-model="form.apiKey"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.apiKey }"
                  placeholder="请输入 Azure OpenAI API Key"
                  required
@@ -610,7 +610,7 @@
                  >
                  <input
                    v-model.number="form.rateLimitDuration"
-                    class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    min="1"
                    placeholder="默认60分钟"
                    type="number"
@@ -630,7 +630,7 @@
                >
                <input
                  v-model="form.apiUrl"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.apiUrl }"
                  placeholder="例如：https://api.example.com"
                  required
@@ -647,7 +647,7 @@
                >
                <input
                  v-model="form.apiKey"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.apiKey }"
                  placeholder="请输入API Key"
                  required
@@ -666,7 +666,7 @@
                  </label>
                  <input
                    v-model.number="form.dailyQuota"
-                    class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+                    class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
                    min="0"
                    placeholder="0 表示不限制"
                    step="0.01"
@@ -683,7 +683,7 @@
                  </label>
                  <input
                    v-model="form.quotaResetTime"
-                    class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+                    class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
                    placeholder="00:00"
                    type="time"
                  />
@@ -713,14 +713,14 @@
                  >
                    <input
                      v-model="mapping.from"
-                      class="form-input flex-1 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                      class="form-input flex-1 border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                      placeholder="原始模型名称"
                      type="text"
                    />
                    <i class="fas fa-arrow-right text-gray-400 dark:text-gray-500" />
                    <input
                      v-model="mapping.to"
-                      class="form-input flex-1 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                      class="form-input flex-1 border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                      placeholder="映射后的模型名称"
                      type="text"
                    />
@@ -794,7 +794,7 @@
                >
                <input
                  v-model="form.userAgent"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  placeholder="留空则透传客户端 User-Agent"
                  type="text"
                />
@@ -827,7 +827,7 @@
                  >
                  <input
                    v-model.number="form.rateLimitDuration"
-                    class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    min="1"
                    placeholder="默认60分钟"
                    type="number"
@@ -941,7 +941,7 @@
              >
              <input
                v-model.number="form.priority"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                max="100"
                min="1"
                placeholder="数字越小优先级越高，默认50"
@@ -1033,34 +1033,29 @@
                </div>
              </div>

-              <!-- OpenAI 平台需要 ID Token -->
              <div v-if="form.platform === 'openai'">
                <label class="mb-3 block text-sm font-semibold text-gray-700 dark:text-gray-300"
-                  >ID Token *</label
+                  >Access Token (可选)</label
                >
                <textarea
-                  v-model="form.idToken"
-                  class="form-input w-full resize-none font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
-                  :class="{ 'border-red-500': errors.idToken }"
-                  placeholder="请输入 ID Token (JWT 格式)..."
-                  required
+                  v-model="form.accessToken"
+                  class="form-input w-full resize-none border-gray-300 font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  placeholder="可选：如果不填写，系统会自动通过 Refresh Token 获取..."
                  rows="4"
                />
-                <p v-if="errors.idToken" class="mt-1 text-xs text-red-500">
-                  {{ errors.idToken }}
-                </p>
                <p class="mt-2 text-xs text-gray-500 dark:text-gray-400">
-                  ID Token 是 OpenAI OAuth 认证返回的 JWT token，包含用户信息和组织信息
+                  <i class="fas fa-info-circle mr-1" />
+                  Access Token 可选填。如果不提供，系统会通过 Refresh Token 自动获取。
                </p>
              </div>

-              <div>
+              <div v-else>
                <label class="mb-3 block text-sm font-semibold text-gray-700 dark:text-gray-300"
                  >Access Token *</label
                >
                <textarea
                  v-model="form.accessToken"
-                  class="form-input w-full resize-none font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full resize-none border-gray-300 font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  :class="{ 'border-red-500': errors.accessToken }"
                  placeholder="请输入 Access Token..."
                  required
@@ -1071,13 +1066,34 @@
                </p>
              </div>

-              <div>
+              <div v-if="form.platform === 'openai'">
+                <label class="mb-3 block text-sm font-semibold text-gray-700 dark:text-gray-300"
+                  >Refresh Token *</label
+                >
+                <textarea
+                  v-model="form.refreshToken"
+                  class="form-input w-full resize-none border-gray-300 font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  :class="{ 'border-red-500': errors.refreshToken }"
+                  placeholder="请输入 Refresh Token（必填）..."
+                  required
+                  rows="4"
+                />
+                <p v-if="errors.refreshToken" class="mt-1 text-xs text-red-500">
+                  {{ errors.refreshToken }}
+                </p>
+                <p class="mt-2 text-xs text-gray-500 dark:text-gray-400">
+                  <i class="fas fa-info-circle mr-1" />
+                  系统将使用 Refresh Token 自动获取 Access Token 和用户信息
+                </p>
+              </div>
+
+              <div v-else>
                <label class="mb-3 block text-sm font-semibold text-gray-700 dark:text-gray-300"
                  >Refresh Token (可选)</label
                >
                <textarea
                  v-model="form.refreshToken"
-                  class="form-input w-full resize-none font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full resize-none border-gray-300 font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  placeholder="请输入 Refresh Token..."
                  rows="4"
                />
@@ -1265,7 +1281,7 @@
                              </label>
                              <textarea
                                v-model="setupTokenAuthCode"
-                                class="form-input w-full resize-none font-mono text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                                class="form-input w-full resize-none border-gray-300 font-mono text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                                placeholder="粘贴从Claude Code授权页面获取的Authorization Code..."
                                rows="3"
                              />
@@ -1313,7 +1329,7 @@
            >
            <input
              v-model="form.name"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              placeholder="为账户设置一个易识别的名称"
              required
              type="text"
@@ -1326,7 +1342,7 @@
            >
            <textarea
              v-model="form.description"
-              class="form-input w-full resize-none dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full resize-none border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              placeholder="账户用途说明..."
              rows="3"
            />
@@ -1433,7 +1449,7 @@
            >
            <input
              v-model="form.projectId"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              placeholder="例如：verdant-wares-464411-k9"
              type="text"
            />
@@ -1544,7 +1560,7 @@
            >
            <input
              v-model.number="form.priority"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              max="100"
              min="1"
              placeholder="数字越小优先级越高"
@@ -1587,7 +1603,7 @@
                </label>
                <input
                  v-model.number="form.dailyQuota"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
                  min="0"
                  placeholder="0 表示不限制"
                  step="0.01"
@@ -1604,7 +1620,7 @@
                </label>
                <input
                  v-model="form.quotaResetTime"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
                  placeholder="00:00"
                  type="time"
                />
@@ -1910,7 +1926,7 @@
              >
              <input
                v-model="form.azureEndpoint"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                :class="{ 'border-red-500': errors.azureEndpoint }"
                placeholder="https://your-resource.openai.azure.com"
                type="url"
@@ -1926,7 +1942,7 @@
              >
              <input
                v-model="form.apiVersion"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                placeholder="2024-02-01"
                type="text"
              />
@@ -1941,7 +1957,7 @@
              >
              <input
                v-model="form.deploymentName"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                :class="{ 'border-red-500': errors.deploymentName }"
                placeholder="gpt-4"
                type="text"
@@ -1957,7 +1973,7 @@
              >
              <input
                v-model="form.apiKey"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                :class="{ 'border-red-500': errors.apiKey }"
                placeholder="留空表示不更新"
                type="password"
@@ -2032,7 +2048,7 @@
                >
                <textarea
                  v-model="form.accessToken"
-                  class="form-input w-full resize-none font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full resize-none border-gray-300 font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  placeholder="留空表示不更新..."
                  rows="4"
                />
@@ -2044,7 +2060,7 @@
                >
                <textarea
                  v-model="form.refreshToken"
-                  class="form-input w-full resize-none font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                  class="form-input w-full resize-none border-gray-300 font-mono text-xs dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                  placeholder="留空表示不更新..."
                  rows="4"
                />
@@ -2180,7 +2196,6 @@ const form = ref({
  groupId: '',
  groupIds: [],
  projectId: props.account?.projectId || '',
-  idToken: '',
  accessToken: '',
  refreshToken: '',
  proxy: initProxyConfig(),
@@ -2249,7 +2264,7 @@ const initModelMappings = () => {
 // 表单验证错误
 const errors = ref({
  name: '',
-  idToken: '',
+  refreshToken: '',
  accessToken: '',
  apiUrl: '',
  apiKey: '',
@@ -2530,7 +2545,35 @@ const handleOAuthSuccess = async (tokenInfo) => {

    emit('success', result)
  } catch (error) {
-    showToast(error.message || '账户创建失败', 'error')
+    // 显示详细的错误信息
+    const errorMessage = error.response?.data?.error || error.message || '账户创建失败'
+    const suggestion = error.response?.data?.suggestion || ''
+    const errorDetails = error.response?.data?.errorDetails || null
+
+    // 构建完整的错误提示
+    let fullMessage = errorMessage
+    if (suggestion) {
+      fullMessage += `\n${suggestion}`
+    }
+
+    // 如果有详细的 OAuth 错误信息，也显示出来
+    if (errorDetails && errorDetails.error_description) {
+      fullMessage += `\n详细信息: ${errorDetails.error_description}`
+    } else if (errorDetails && errorDetails.error && errorDetails.error.message) {
+      // 处理 OpenAI 格式的错误
+      fullMessage += `\n详细信息: ${errorDetails.error.message}`
+    }
+
+    showToast(fullMessage, 'error', '', 8000)
+
+    // 在控制台打印完整的错误信息以便调试
+    console.error('账户创建失败:', {
+      message: errorMessage,
+      suggestion,
+      errorDetails,
+      errorCode: error.response?.data?.errorCode,
+      networkError: error.response?.data?.networkError
+    })
  } finally {
    loading.value = false
  }
@@ -2591,17 +2634,19 @@ const createAccount = async () => {
    }
  } else if (form.value.addType === 'manual') {
    // 手动模式验证
-    if (!form.value.accessToken || form.value.accessToken.trim() === '') {
-      errors.value.accessToken = '请填写 Access Token'
-      hasError = true
-    }
-    // OpenAI 平台需要验证 ID Token
-    if (
-      form.value.platform === 'openai' &&
-      (!form.value.idToken || form.value.idToken.trim() === '')
-    ) {
-      errors.value.idToken = '请填写 ID Token'
-      hasError = true
+    if (form.value.platform === 'openai') {
+      // OpenAI 平台必须有 Refresh Token
+      if (!form.value.refreshToken || form.value.refreshToken.trim() === '') {
+        errors.value.refreshToken = '请填写 Refresh Token'
+        hasError = true
+      }
+      // Access Token 可选，如果没有会通过 Refresh Token 获取
+    } else {
+      // 其他平台（Gemini）需要 Access Token
+      if (!form.value.accessToken || form.value.accessToken.trim() === '') {
+        errors.value.accessToken = '请填写 Access Token'
+        hasError = true
+      }
    }
  }

@@ -2695,14 +2740,14 @@ const createAccount = async () => {
        : 365 * 24 * 60 * 60 * 1000 // 1年

      data.openaiOauth = {
-        idToken: form.value.idToken, // 使用用户输入的 ID Token
-        accessToken: form.value.accessToken,
-        refreshToken: form.value.refreshToken || '',
+        idToken: '', // 不再需要用户输入，系统会自动获取
+        accessToken: form.value.accessToken || '', // Access Token 可选
+        refreshToken: form.value.refreshToken, // Refresh Token 必填
        expires_in: Math.floor(expiresInMs / 1000) // 转换为秒
      }

-      // 手动模式下，尝试从 ID Token 解析用户信息
-      let accountInfo = {
+      // 账户信息将在首次刷新时自动获取
+      data.accountInfo = {
        accountId: '',
        chatgptUserId: '',
        organizationId: '',
@@ -2713,31 +2758,9 @@ const createAccount = async () => {
        emailVerified: false
      }

-      // 尝试解析 ID Token (JWT)
-      if (form.value.idToken) {
-        try {
-          const idTokenParts = form.value.idToken.split('.')
-          if (idTokenParts.length === 3) {
-            const payload = JSON.parse(atob(idTokenParts[1]))
-            const authClaims = payload['https://api.openai.com/auth'] || {}
-
-            accountInfo = {
-              accountId: authClaims.accountId || '',
-              chatgptUserId: authClaims.chatgptUserId || '',
-              organizationId: authClaims.organizationId || '',
-              organizationRole: authClaims.organizationRole || '',
-              organizationTitle: authClaims.organizationTitle || '',
-              planType: authClaims.planType || '',
-              email: payload.email || '',
-              emailVerified: payload.email_verified || false
-            }
-          }
-        } catch (e) {
-          console.warn('Failed to parse ID Token:', e)
-        }
-      }
-
-      data.accountInfo = accountInfo
+      // OpenAI 手动模式必须刷新以获取完整信息（包括 ID Token）
+      data.needsImmediateRefresh = true
+      data.requireRefreshSuccess = true // 必须刷新成功才能创建账户
      data.priority = form.value.priority || 50
    } else if (form.value.platform === 'claude-console') {
      // Claude Console 账户特定数据
@@ -2797,7 +2820,35 @@ const createAccount = async () => {

    emit('success', result)
  } catch (error) {
-    showToast(error.message || '账户创建失败', 'error')
+    // 显示详细的错误信息
+    const errorMessage = error.response?.data?.error || error.message || '账户创建失败'
+    const suggestion = error.response?.data?.suggestion || ''
+    const errorDetails = error.response?.data?.errorDetails || null
+
+    // 构建完整的错误提示
+    let fullMessage = errorMessage
+    if (suggestion) {
+      fullMessage += `\n${suggestion}`
+    }
+
+    // 如果有详细的 OAuth 错误信息，也显示出来
+    if (errorDetails && errorDetails.error_description) {
+      fullMessage += `\n详细信息: ${errorDetails.error_description}`
+    } else if (errorDetails && errorDetails.error && errorDetails.error.message) {
+      // 处理 OpenAI 格式的错误
+      fullMessage += `\n详细信息: ${errorDetails.error.message}`
+    }
+
+    showToast(fullMessage, 'error', '', 8000)
+
+    // 在控制台打印完整的错误信息以便调试
+    console.error('账户创建失败:', {
+      message: errorMessage,
+      suggestion,
+      errorDetails,
+      errorCode: error.response?.data?.errorCode,
+      networkError: error.response?.data?.networkError
+    })
  } finally {
    loading.value = false
  }
@@ -2901,11 +2952,17 @@ const updateAccount = async () => {
          : 365 * 24 * 60 * 60 * 1000 // 1年

        data.openaiOauth = {
-          idToken: form.value.idToken || '', // 更新时使用用户输入的 ID Token
+          idToken: '', // 不需要用户输入
          accessToken: form.value.accessToken || '',
          refreshToken: form.value.refreshToken || '',
          expires_in: Math.floor(expiresInMs / 1000) // 转换为秒
        }
+
+        // 编辑 OpenAI 账户时，如果更新了 Refresh Token，也需要验证
+        if (form.value.refreshToken && form.value.refreshToken !== props.account.refreshToken) {
+          data.needsImmediateRefresh = true
+          data.requireRefreshSuccess = true
+        }
      }
    }

@@ -3012,7 +3069,35 @@ const updateAccount = async () => {

    emit('success')
  } catch (error) {
-    showToast(error.message || '账户更新失败', 'error')
+    // 显示详细的错误信息
+    const errorMessage = error.response?.data?.error || error.message || '账户更新失败'
+    const suggestion = error.response?.data?.suggestion || ''
+    const errorDetails = error.response?.data?.errorDetails || null
+
+    // 构建完整的错误提示
+    let fullMessage = errorMessage
+    if (suggestion) {
+      fullMessage += `\n${suggestion}`
+    }
+
+    // 如果有详细的 OAuth 错误信息，也显示出来
+    if (errorDetails && errorDetails.error_description) {
+      fullMessage += `\n详细信息: ${errorDetails.error_description}`
+    } else if (errorDetails && errorDetails.error && errorDetails.error.message) {
+      // 处理 OpenAI 格式的错误
+      fullMessage += `\n详细信息: ${errorDetails.error.message}`
+    }
+
+    showToast(fullMessage, 'error', '', 8000)
+
+    // 在控制台打印完整的错误信息以便调试
+    console.error('账户更新失败:', {
+      message: errorMessage,
+      suggestion,
+      errorDetails,
+      errorCode: error.response?.data?.errorCode,
+      networkError: error.response?.data?.networkError
+    })
  } finally {
    loading.value = false
  }
--- a/web/admin-spa/src/components/accounts/ProxyConfig.vue
+++ b/web/admin-spa/src/components/accounts/ProxyConfig.vue
@@ -36,7 +36,7 @@
        >
        <select
          v-model="proxy.type"
-          class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+          class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
        >
          <option value="socks5">SOCKS5</option>
          <option value="http">HTTP</option>
@@ -51,7 +51,7 @@
          >
          <input
            v-model="proxy.host"
-            class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+            class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
            placeholder="例如: 192.168.1.100"
            type="text"
          />
@@ -62,7 +62,7 @@
          >
          <input
            v-model="proxy.port"
-            class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+            class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
            placeholder="例如: 1080"
            type="number"
          />
@@ -92,7 +92,7 @@
            >
            <input
              v-model="proxy.username"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              placeholder="代理用户名"
              type="text"
            />
@@ -104,7 +104,7 @@
            <div class="relative">
              <input
                v-model="proxy.password"
-                class="form-input w-full pr-10 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 pr-10 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                placeholder="代理密码"
                :type="showPassword ? 'text' : 'password'"
              />
--- a/web/admin-spa/src/components/apikeys/BatchEditApiKeyModal.vue
+++ b/web/admin-spa/src/components/apikeys/BatchEditApiKeyModal.vue
@@ -127,7 +127,7 @@
                  <div class="flex gap-2">
                    <input
                      v-model="newTag"
-                      class="form-input flex-1 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                      class="form-input flex-1 border-gray-300 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
                      placeholder="输入新标签名称"
                      type="text"
                      @keypress.enter.prevent="addTag"
@@ -166,7 +166,7 @@
                  </label>
                  <input
                    v-model="form.rateLimitWindow"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
                    min="1"
                    placeholder="不修改"
                    type="number"
@@ -179,7 +179,7 @@
                  >
                  <input
                    v-model="form.rateLimitRequests"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
                    min="1"
                    placeholder="不修改"
                    type="number"
@@ -192,7 +192,7 @@
                  >
                  <input
                    v-model="form.rateLimitCost"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
                    min="0"
                    placeholder="不修改"
                    step="0.01"
@@ -210,7 +210,7 @@
            </label>
            <input
              v-model="form.dailyCostLimit"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
              min="0"
              placeholder="不修改 (0 表示无限制)"
              step="0.01"
@@ -225,7 +225,7 @@
            </label>
            <input
              v-model="form.weeklyOpusCostLimit"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
              min="0"
              placeholder="不修改 (0 表示无限制)"
              step="0.01"
@@ -243,7 +243,7 @@
            >
            <input
              v-model="form.concurrencyLimit"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
              min="0"
              placeholder="不修改 (0 表示无限制)"
              type="number"
@@ -330,7 +330,7 @@
                >
                <select
                  v-model="form.claudeAccountId"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
                  :disabled="form.permissions === 'gemini' || form.permissions === 'openai'"
                >
                  <option value="">不修改</option>
@@ -365,7 +365,7 @@
                >
                <select
                  v-model="form.geminiAccountId"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
                  :disabled="form.permissions === 'claude' || form.permissions === 'openai'"
                >
                  <option value="">不修改</option>
@@ -396,7 +396,7 @@
                >
                <select
                  v-model="form.openaiAccountId"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
                  :disabled="form.permissions === 'claude' || form.permissions === 'gemini'"
                >
                  <option value="">不修改</option>
@@ -427,7 +427,7 @@
                >
                <select
                  v-model="form.bedrockAccountId"
-                  class="form-input w-full dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
                  :disabled="form.permissions === 'gemini' || form.permissions === 'openai'"
                >
                  <option value="">不修改</option>
--- a/web/admin-spa/src/components/apikeys/CreateApiKeyModal.vue
+++ b/web/admin-spa/src/components/apikeys/CreateApiKeyModal.vue
@@ -81,7 +81,7 @@
                  <div class="flex items-center gap-2">
                    <input
                      v-model.number="form.batchCount"
-                      class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                      class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                      max="500"
                      min="2"
                      placeholder="输入数量 (2-500)"
@@ -112,7 +112,7 @@
            >
            <input
              v-model="form.name"
-              class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              :class="{ 'border-red-500': errors.name }"
              :placeholder="
                form.createType === 'batch'
@@ -184,7 +184,7 @@
                <div class="flex gap-2">
                  <input
                    v-model="newTag"
-                    class="form-input flex-1 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input flex-1 border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    placeholder="输入新标签名称"
                    type="text"
                    @keypress.enter.prevent="addTag"
@@ -228,7 +228,7 @@
                  >
                  <input
                    v-model="form.rateLimitWindow"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    min="1"
                    placeholder="无限制"
                    type="number"
@@ -242,7 +242,7 @@
                  >
                  <input
                    v-model="form.rateLimitRequests"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    min="1"
                    placeholder="无限制"
                    type="number"
@@ -256,7 +256,7 @@
                  >
                  <input
                    v-model="form.rateLimitCost"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    min="0"
                    placeholder="无限制"
                    step="0.01"
@@ -321,7 +321,7 @@
              </div>
              <input
                v-model="form.dailyCostLimit"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                min="0"
                placeholder="0 表示无限制"
                step="0.01"
@@ -370,7 +370,7 @@
              </div>
              <input
                v-model="form.weeklyOpusCostLimit"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                min="0"
                placeholder="0 表示无限制"
                step="0.01"
@@ -388,7 +388,7 @@
            >
            <input
              v-model="form.concurrencyLimit"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              min="0"
              placeholder="0 表示无限制"
              type="number"
@@ -404,7 +404,7 @@
            >
            <textarea
              v-model="form.description"
-              class="form-input w-full resize-none text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full resize-none border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              placeholder="描述此 API Key 的用途..."
              rows="2"
            />
@@ -412,34 +412,103 @@

          <div>
            <label class="mb-2 block text-sm font-semibold text-gray-700 dark:text-gray-300"
-              >有效期限</label
+              >过期设置</label
            >
-            <select
-              v-model="form.expireDuration"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
-              @change="updateExpireAt"
+            <!-- 过期模式选择 -->
+            <div
+              class="mb-3 rounded-lg border border-gray-200 bg-gray-50 p-3 dark:border-gray-700 dark:bg-gray-800"
            >
-              <option value="">永不过期</option>
-              <option value="1d">1 天</option>
-              <option value="7d">7 天</option>
-              <option value="30d">30 天</option>
-              <option value="90d">90 天</option>
-              <option value="180d">180 天</option>
-              <option value="365d">365 天</option>
-              <option value="custom">自定义日期</option>
-            </select>
-            <div v-if="form.expireDuration === 'custom'" class="mt-3">
-              <input
-                v-model="form.customExpireDate"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
-                :min="minDateTime"
-                type="datetime-local"
-                @change="updateCustomExpireAt"
-              />
+              <div class="flex items-center gap-4">
+                <label class="flex cursor-pointer items-center">
+                  <input
+                    v-model="form.expirationMode"
+                    class="mr-2 text-blue-600 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-700"
+                    type="radio"
+                    value="fixed"
+                  />
+                  <span class="text-sm text-gray-700 dark:text-gray-300">固定时间过期</span>
+                </label>
+                <label class="flex cursor-pointer items-center">
+                  <input
+                    v-model="form.expirationMode"
+                    class="mr-2 text-blue-600 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-700"
+                    type="radio"
+                    value="activation"
+                  />
+                  <span class="text-sm text-gray-700 dark:text-gray-300">首次使用后激活</span>
+                </label>
+              </div>
+              <p class="mt-2 text-xs text-gray-500 dark:text-gray-400">
+                <span v-if="form.expirationMode === 'fixed'">
+                  <i class="fas fa-info-circle mr-1" />
+                  固定时间模式：Key 创建后立即生效，按设定时间过期
+                </span>
+                <span v-else>
+                  <i class="fas fa-info-circle mr-1" />
+                  激活模式：Key 首次使用时激活，激活后按设定天数过期（适合批量销售）
+                </span>
+              </p>
+            </div>
+
+            <!-- 固定时间模式 -->
+            <div v-if="form.expirationMode === 'fixed'">
+              <select
+                v-model="form.expireDuration"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+                @change="updateExpireAt"
+              >
+                <option value="">永不过期</option>
+                <option value="1d">1 天</option>
+                <option value="7d">7 天</option>
+                <option value="30d">30 天</option>
+                <option value="90d">90 天</option>
+                <option value="180d">180 天</option>
+                <option value="365d">365 天</option>
+                <option value="custom">自定义日期</option>
+              </select>
+              <div v-if="form.expireDuration === 'custom'" class="mt-3">
+                <input
+                  v-model="form.customExpireDate"
+                  class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+                  :min="minDateTime"
+                  type="datetime-local"
+                  @change="updateCustomExpireAt"
+                />
+              </div>
+              <p v-if="form.expiresAt" class="mt-2 text-xs text-gray-500 dark:text-gray-400">
+                将于 {{ formatExpireDate(form.expiresAt) }} 过期
+              </p>
+            </div>
+
+            <!-- 激活模式 -->
+            <div v-else>
+              <div class="flex items-center gap-2">
+                <input
+                  v-model.number="form.activationDays"
+                  class="form-input flex-1 border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+                  max="3650"
+                  min="1"
+                  placeholder="输入天数"
+                  type="number"
+                />
+                <span class="text-sm text-gray-600 dark:text-gray-400">天</span>
+              </div>
+              <div class="mt-2 flex flex-wrap gap-2">
+                <button
+                  v-for="days in [30, 90, 180, 365]"
+                  :key="days"
+                  class="rounded-md border border-gray-300 px-3 py-1 text-xs hover:bg-gray-100 dark:border-gray-600 dark:hover:bg-gray-700"
+                  type="button"
+                  @click="form.activationDays = days"
+                >
+                  {{ days }}天
+                </button>
+              </div>
+              <p class="mt-2 text-xs text-gray-500 dark:text-gray-400">
+                <i class="fas fa-clock mr-1" />
+                Key 将在首次使用后激活，激活后 {{ form.activationDays || 30 }} 天过期
+              </p>
            </div>
-            <p v-if="form.expiresAt" class="mt-2 text-xs text-gray-500 dark:text-gray-400">
-              将于 {{ formatExpireDate(form.expiresAt) }} 过期
-            </p>
          </div>

          <div>
@@ -794,6 +863,8 @@ const form = reactive({
  expireDuration: '',
  customExpireDate: '',
  expiresAt: null,
+  expirationMode: 'fixed', // 过期模式：fixed(固定) 或 activation(激活)
+  activationDays: 30, // 激活后有效天数
  permissions: 'all',
  claudeAccountId: '',
  geminiAccountId: '',
@@ -1082,7 +1153,9 @@ const createApiKey = async () => {
        form.weeklyOpusCostLimit !== '' && form.weeklyOpusCostLimit !== null
          ? parseFloat(form.weeklyOpusCostLimit)
          : 0,
-      expiresAt: form.expiresAt || undefined,
+      expiresAt: form.expirationMode === 'fixed' ? form.expiresAt || undefined : undefined,
+      expirationMode: form.expirationMode,
+      activationDays: form.expirationMode === 'activation' ? form.activationDays : undefined,
      permissions: form.permissions,
      tags: form.tags.length > 0 ? form.tags : undefined,
      enableModelRestriction: form.enableModelRestriction,
--- a/web/admin-spa/src/components/apikeys/EditApiKeyModal.vue
+++ b/web/admin-spa/src/components/apikeys/EditApiKeyModal.vue
@@ -34,7 +34,7 @@
            >
            <input
              v-model="form.name"
-              class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              maxlength="100"
              placeholder="请输入API Key名称"
              required
@@ -53,7 +53,7 @@
            >
            <select
              v-model="form.ownerId"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
            >
              <option v-for="user in availableUsers" :key="user.id" :value="user.id">
                {{ user.displayName }} ({{ user.username }})
@@ -122,7 +122,7 @@
                <div class="flex gap-2">
                  <input
                    v-model="newTag"
-                    class="form-input flex-1 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input flex-1 border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    placeholder="输入新标签名称"
                    type="text"
                    @keypress.enter.prevent="addTag"
@@ -166,7 +166,7 @@
                  >
                  <input
                    v-model="form.rateLimitWindow"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    min="1"
                    placeholder="无限制"
                    type="number"
@@ -180,7 +180,7 @@
                  >
                  <input
                    v-model="form.rateLimitRequests"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    min="1"
                    placeholder="无限制"
                    type="number"
@@ -194,7 +194,7 @@
                  >
                  <input
                    v-model="form.rateLimitCost"
-                    class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                    class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                    min="0"
                    placeholder="无限制"
                    step="0.01"
@@ -259,7 +259,7 @@
              </div>
              <input
                v-model="form.dailyCostLimit"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                min="0"
                placeholder="0 表示无限制"
                step="0.01"
@@ -308,7 +308,7 @@
              </div>
              <input
                v-model="form.weeklyOpusCostLimit"
-                class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                min="0"
                placeholder="0 表示无限制"
                step="0.01"
@@ -326,7 +326,7 @@
            >
            <input
              v-model="form.concurrencyLimit"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
              min="0"
              placeholder="0 表示无限制"
              type="number"
@@ -558,7 +558,7 @@
                  <div class="flex gap-2">
                    <input
                      v-model="form.modelInput"
-                      class="form-input flex-1 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                      class="form-input flex-1 border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                      placeholder="输入模型名称，按回车添加"
                      type="text"
                      @keydown.enter.prevent="addRestrictedModel"
--- a/web/admin-spa/src/components/apikeys/ExpiryEditModal.vue
+++ b/web/admin-spa/src/components/apikeys/ExpiryEditModal.vue
@@ -39,11 +39,18 @@
          >
            <div class="flex items-center justify-between">
              <div>
-                <p class="mb-1 text-xs font-medium text-gray-600 dark:text-gray-400">
-                  当前过期时间
-                </p>
+                <p class="mb-1 text-xs font-medium text-gray-600 dark:text-gray-400">当前状态</p>
                <p class="text-sm font-semibold text-gray-800 dark:text-gray-200">
-                  <template v-if="apiKey.expiresAt">
+                  <!-- 未激活状态 -->
+                  <template v-if="apiKey.expirationMode === 'activation' && !apiKey.isActivated">
+                    <i class="fas fa-pause-circle mr-1 text-blue-500" />
+                    未激活
+                    <span class="ml-2 text-xs font-normal text-gray-600">
+                      (激活后 {{ apiKey.activationDays || 30 }} 天过期)
+                    </span>
+                  </template>
+                  <!-- 已设置过期时间 -->
+                  <template v-else-if="apiKey.expiresAt">
                    {{ formatExpireDate(apiKey.expiresAt) }}
                    <span
                      v-if="getExpiryStatus(apiKey.expiresAt)"
@@ -53,6 +60,7 @@
                      ({{ getExpiryStatus(apiKey.expiresAt).text }})
                    </span>
                  </template>
+                  <!-- 永不过期 -->
                  <template v-else>
                    <i class="fas fa-infinity mr-1 text-gray-500" />
                    永不过期
@@ -74,6 +82,21 @@
            </div>
          </div>

+          <!-- 激活按钮（仅在未激活状态显示） -->
+          <div v-if="apiKey.expirationMode === 'activation' && !apiKey.isActivated" class="mb-4">
+            <button
+              class="w-full rounded-lg bg-gradient-to-r from-blue-500 to-blue-600 px-4 py-3 font-semibold text-white transition-all hover:from-blue-600 hover:to-blue-700 hover:shadow-lg"
+              @click="handleActivateNow"
+            >
+              <i class="fas fa-rocket mr-2" />
+              立即激活 (激活后 {{ apiKey.activationDays || 30 }} 天过期)
+            </button>
+            <p class="mt-2 text-xs text-gray-500 dark:text-gray-400">
+              <i class="fas fa-info-circle mr-1" />
+              点击立即激活此 API Key，激活后将在 {{ apiKey.activationDays || 30 }} 天后过期
+            </p>
+          </div>
+
          <!-- 快捷选项 -->
          <div>
            <label class="mb-3 block text-sm font-semibold text-gray-700 dark:text-gray-300"
@@ -115,7 +138,7 @@
            >
            <input
              v-model="localForm.customExpireDate"
-              class="form-input w-full dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+              class="form-input w-full border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
              :min="minDateTime"
              type="datetime-local"
              @change="updateCustomExpiryPreview"
@@ -370,6 +393,35 @@ const handleSave = () => {
  })
 }

+// 立即激活
+const handleActivateNow = async () => {
+  // 使用确认弹窗
+  let confirmed = true
+  if (window.showConfirm) {
+    confirmed = await window.showConfirm(
+      '激活 API Key',
+      `确定要立即激活此 API Key 吗？激活后将在 ${props.apiKey.activationDays || 30} 天后自动过期。`,
+      '确定激活',
+      '取消'
+    )
+  } else {
+    // 降级方案
+    confirmed = confirm(
+      `确定要立即激活此 API Key 吗？激活后将在 ${props.apiKey.activationDays || 30} 天后自动过期。`
+    )
+  }
+
+  if (!confirmed) {
+    return
+  }
+
+  saving.value = true
+  emit('save', {
+    keyId: props.apiKey.id,
+    activateNow: true
+  })
+}
+
 // 重置保存状态
 const resetSaving = () => {
  saving.value = false
--- a/web/admin-spa/src/components/common/AccountSelector.vue
+++ b/web/admin-spa/src/components/common/AccountSelector.vue
@@ -2,7 +2,7 @@
  <div ref="triggerRef" class="relative">
    <!-- 选择器主体 -->
    <div
-      class="form-input flex w-full cursor-pointer items-center justify-between dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
+      class="form-input flex w-full cursor-pointer items-center justify-between border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200"
      :class="{ 'opacity-50': disabled }"
      @click="!disabled && toggleDropdown()"
    >
@@ -40,7 +40,7 @@
              <input
                ref="searchInput"
                v-model="searchQuery"
-                class="form-input w-full text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
+                class="form-input w-full border-gray-300 text-sm dark:border-gray-600 dark:bg-gray-700 dark:text-gray-200 dark:placeholder-gray-400"
                placeholder="搜索账号名称..."
                style="padding-left: 40px; padding-right: 36px"
                type="text"
--- a/web/admin-spa/src/config/api.js
+++ b/web/admin-spa/src/config/api.js
@@ -82,7 +82,16 @@ class ApiClient {

      // 如果响应不成功，抛出错误
      if (!response.ok) {
-        throw new Error(data.message || `HTTP ${response.status}`)
+        // 创建一个包含完整错误信息的错误对象
+        const error = new Error(data.message || `HTTP ${response.status}`)
+        // 保留完整的响应数据，以便错误处理时可以访问详细信息
+        error.response = {
+          status: response.status,
+          data: data
+        }
+        // 为了向后兼容，也保留原始的 message
+        error.message = data.message || error.message
+        throw error
      }

      return data
--- a/web/admin-spa/src/utils/toast.js
+++ b/web/admin-spa/src/utils/toast.js
@@ -31,6 +31,9 @@ export function showToast(message, type = 'info', title = '', duration = 3000) {
    info: 'fas fa-info-circle'
  }

+  // 处理消息中的换行符，转换为 HTML 换行
+  const formattedMessage = message.replace(/\n/g, '<br>')
+
  toast.innerHTML = `
    <div class="flex items-start gap-3">
      <div class="flex-shrink-0 mt-0.5">
@@ -38,7 +41,7 @@ export function showToast(message, type = 'info', title = '', duration = 3000) {
      </div>
      <div class="flex-1 min-w-0">
        ${title ? `<h4 class="font-semibold text-sm mb-1">${title}</h4>` : ''}
-        <p class="text-sm opacity-90 leading-relaxed">${message}</p>
+        <p class="text-sm opacity-90 leading-relaxed">${formattedMessage}</p>
      </div>
      <button onclick="this.parentElement.parentElement.remove()" 
              class="flex-shrink-0 text-white/70 hover:text-white transition-colors ml-2">
--- a/web/admin-spa/src/views/ApiKeysView.vue
+++ b/web/admin-spa/src/views/ApiKeysView.vue
@@ -570,7 +570,16 @@
                    </td>
                    <td class="whitespace-nowrap px-3 py-4 text-sm">
                      <div class="inline-flex items-center gap-1.5">
-                        <span v-if="key.expiresAt">
+                        <!-- 未激活状态 -->
+                        <span
+                          v-if="key.expirationMode === 'activation' && !key.isActivated"
+                          class="inline-flex items-center text-blue-600 dark:text-blue-400"
+                        >
+                          <i class="fas fa-pause-circle mr-1" />
+                          未激活 ({{ key.activationDays || 30 }}天)
+                        </span>
+                        <!-- 已设置过期时间 -->
+                        <span v-else-if="key.expiresAt">
                          <span
                            v-if="isApiKeyExpired(key.expiresAt)"
                            class="inline-flex items-center text-red-600"
@@ -589,6 +598,7 @@
                            {{ formatExpireDate(key.expiresAt) }}
                          </span>
                        </span>
+                        <!-- 永不过期 -->
                        <span
                          v-else
                          class="inline-flex items-center text-gray-400 dark:text-gray-500"
@@ -2650,18 +2660,29 @@ const closeExpiryEdit = () => {
 }

 // 保存过期时间
-const handleSaveExpiry = async ({ keyId, expiresAt }) => {
+const handleSaveExpiry = async ({ keyId, expiresAt, activateNow }) => {
  try {
-    const data = await apiClient.put(`/admin/api-keys/${keyId}`, {
-      expiresAt: expiresAt || null
+    // 使用新的PATCH端点来修改过期时间
+    const data = await apiClient.patch(`/admin/api-keys/${keyId}/expiration`, {
+      expiresAt: expiresAt || null,
+      activateNow: activateNow || false
    })

    if (data.success) {
-      showToast('过期时间已更新', 'success')
+      showToast(activateNow ? 'API Key已激活' : '过期时间已更新', 'success')
      // 更新本地数据
      const key = apiKeys.value.find((k) => k.id === keyId)
      if (key) {
-        key.expiresAt = expiresAt || null
+        if (activateNow && data.updates) {
+          key.isActivated = true
+          key.activatedAt = data.updates.activatedAt
+          key.expiresAt = data.updates.expiresAt
+        } else {
+          key.expiresAt = expiresAt || null
+          if (expiresAt && !key.isActivated) {
+            key.isActivated = true
+          }
+        }
      }
      closeExpiryEdit()
    } else {
--- a/web/admin-spa/src/views/TutorialView.vue
+++ b/web/admin-spa/src/views/TutorialView.vue
@@ -420,74 +420,42 @@
          </p>

          <div class="space-y-4">
-            <div class="rounded-lg border border-indigo-200 bg-white p-3 sm:p-4">
-              <h6 class="mb-2 text-sm font-medium text-gray-800 dark:text-gray-600 sm:text-base">
-                PowerShell 设置方法
-              </h6>
-              <p class="mb-3 text-sm text-gray-600">在 PowerShell 中运行以下命令：</p>
+            <div class="rounded-lg border border-yellow-200 bg-yellow-50 p-3 sm:p-4">
+              <h6 class="mb-2 font-medium text-yellow-800">Codex 配置文件</h6>
+              <p class="mb-3 text-sm text-yellow-700">
+                在
+                <code class="rounded bg-yellow-100 px-1">~/.codex/config.toml</code>
+                文件中添加以下配置：
+              </p>
              <div
                class="overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
              >
-                <div class="whitespace-nowrap text-gray-300">
-                  $env:OPENAI_BASE_URL = "{{ openaiBaseUrl }}"
-                </div>
-                <div class="whitespace-nowrap text-gray-300">
-                  $env:OPENAI_API_KEY = "你的API密钥"
-                </div>
+                <div class="whitespace-nowrap text-gray-300">model_provider = "crs"</div>
+                <div class="whitespace-nowrap text-gray-300">model = "gpt-5"</div>
+                <div class="whitespace-nowrap text-gray-300">model_reasoning_effort = "high"</div>
+                <div class="whitespace-nowrap text-gray-300">disable_response_storage = true</div>
+                <div class="mt-2"></div>
+                <div class="whitespace-nowrap text-gray-300">[model_providers.crs]</div>
+                <div class="whitespace-nowrap text-gray-300">name = "crs"</div>
+                <div class="whitespace-nowrap text-gray-300">base_url = "{{ openaiBaseUrl }}"</div>
+                <div class="whitespace-nowrap text-gray-300">wire_api = "responses"</div>
+              </div>
+              <p class="mt-3 text-sm text-yellow-700">
+                在
+                <code class="rounded bg-yellow-100 px-1">~/.codex/auth.json</code>
+                文件中配置API密钥：
+              </p>
+              <div
+                class="mt-2 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
+              >
+                <div class="whitespace-nowrap text-gray-300">{</div>
+                <div class="whitespace-nowrap text-gray-300">"OPENAI_API_KEY": "你的API密钥"</div>
+                <div class="whitespace-nowrap text-gray-300">}</div>
              </div>
              <p class="mt-2 text-xs text-yellow-700">
                💡 使用与 Claude Code 相同的 API 密钥即可，格式如 cr_xxxxxxxxxx。
              </p>
            </div>
-
-            <div class="rounded-lg border border-indigo-200 bg-white p-3 sm:p-4">
-              <h6 class="mb-2 text-sm font-medium text-gray-800 dark:text-gray-600 sm:text-base">
-                PowerShell 永久设置（用户级）
-              </h6>
-              <p class="mb-3 text-sm text-gray-600">在 PowerShell 中运行以下命令：</p>
-              <div
-                class="mb-3 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="mb-2"># 设置用户级环境变量（永久生效）</div>
-                <div class="whitespace-nowrap text-gray-300">
-                  [System.Environment]::SetEnvironmentVariable("OPENAI_BASE_URL", "{{
-                    openaiBaseUrl
-                  }}", [System.EnvironmentVariableTarget]::User)
-                </div>
-                <div class="whitespace-nowrap text-gray-300">
-                  [System.Environment]::SetEnvironmentVariable("OPENAI_API_KEY", "你的API密钥",
-                  [System.EnvironmentVariableTarget]::User)
-                </div>
-              </div>
-              <p class="mt-2 text-xs text-blue-700">
-                💡 设置后需要重新打开 PowerShell 窗口才能生效。
-              </p>
-            </div>
-
-            <div class="rounded-lg border border-indigo-200 bg-indigo-50 p-3 sm:p-4">
-              <h6 class="mb-2 font-medium text-indigo-800">验证 Codex 环境变量</h6>
-              <p class="mb-3 text-sm text-indigo-700">在 PowerShell 中验证：</p>
-              <div
-                class="space-y-1 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="whitespace-nowrap text-gray-300">echo $env:OPENAI_BASE_URL</div>
-                <div class="whitespace-nowrap text-gray-300">echo $env:OPENAI_API_KEY</div>
-              </div>
-            </div>
-
-            <div class="rounded-lg border border-yellow-200 bg-yellow-50 p-3 sm:p-4">
-              <h6 class="mb-2 font-medium text-yellow-800">Codex 额外配置</h6>
-              <p class="mb-3 text-sm text-yellow-700">
-                需要在
-                <code class="rounded bg-yellow-100 px-1">~/.codex/config.toml</code>
-                文件中添加以下配置来禁用响应存储：
-              </p>
-              <div
-                class="overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="whitespace-nowrap text-gray-300">disable_response_storage = true</div>
-              </div>
-            </div>
          </div>
        </div>
      </div>
@@ -938,81 +906,42 @@
          </p>

          <div class="space-y-4">
-            <div class="rounded-lg border border-indigo-200 bg-white p-3 sm:p-4">
-              <h6 class="mb-2 text-sm font-medium text-gray-800 dark:text-gray-600 sm:text-base">
-                Terminal 设置方法
-              </h6>
-              <p class="mb-3 text-sm text-gray-600">在 Terminal 中运行以下命令：</p>
+            <div class="rounded-lg border border-yellow-200 bg-yellow-50 p-3 sm:p-4">
+              <h6 class="mb-2 font-medium text-yellow-800">Codex 配置文件</h6>
+              <p class="mb-3 text-sm text-yellow-700">
+                在
+                <code class="rounded bg-yellow-100 px-1">~/.codex/config.toml</code>
+                文件中添加以下配置：
+              </p>
              <div
                class="overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
              >
-                <div class="whitespace-nowrap text-gray-300">
-                  export OPENAI_BASE_URL="{{ openaiBaseUrl }}"
-                </div>
-                <div class="whitespace-nowrap text-gray-300">
-                  export OPENAI_API_KEY="你的API密钥"
-                </div>
+                <div class="whitespace-nowrap text-gray-300">model_provider = "crs"</div>
+                <div class="whitespace-nowrap text-gray-300">model = "gpt-5"</div>
+                <div class="whitespace-nowrap text-gray-300">model_reasoning_effort = "high"</div>
+                <div class="whitespace-nowrap text-gray-300">disable_response_storage = true</div>
+                <div class="mt-2"></div>
+                <div class="whitespace-nowrap text-gray-300">[model_providers.crs]</div>
+                <div class="whitespace-nowrap text-gray-300">name = "crs"</div>
+                <div class="whitespace-nowrap text-gray-300">base_url = "{{ openaiBaseUrl }}"</div>
+                <div class="whitespace-nowrap text-gray-300">wire_api = "responses"</div>
+              </div>
+              <p class="mt-3 text-sm text-yellow-700">
+                在
+                <code class="rounded bg-yellow-100 px-1">~/.codex/auth.json</code>
+                文件中配置API密钥：
+              </p>
+              <div
+                class="mt-2 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
+              >
+                <div class="whitespace-nowrap text-gray-300">{</div>
+                <div class="whitespace-nowrap text-gray-300">"OPENAI_API_KEY": "你的API密钥"</div>
+                <div class="whitespace-nowrap text-gray-300">}</div>
              </div>
              <p class="mt-2 text-xs text-yellow-700">
                💡 使用与 Claude Code 相同的 API 密钥即可，格式如 cr_xxxxxxxxxx。
              </p>
            </div>
-
-            <div class="rounded-lg border border-indigo-200 bg-white p-3 sm:p-4">
-              <h6 class="mb-2 text-sm font-medium text-gray-800 dark:text-gray-600 sm:text-base">
-                永久设置方法
-              </h6>
-              <p class="mb-3 text-sm text-gray-600">添加到你的 shell 配置文件：</p>
-              <div
-                class="mb-3 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="mb-2"># 对于 zsh (默认)</div>
-                <div class="whitespace-nowrap text-gray-300">
-                  echo 'export OPENAI_BASE_URL="{{ openaiBaseUrl }}"' >> ~/.zshrc
-                </div>
-                <div class="whitespace-nowrap text-gray-300">
-                  echo 'export OPENAI_API_KEY="你的API密钥"' >> ~/.zshrc
-                </div>
-                <div class="whitespace-nowrap text-gray-300">source ~/.zshrc</div>
-              </div>
-              <div
-                class="overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="mb-2"># 对于 bash</div>
-                <div class="whitespace-nowrap text-gray-300">
-                  echo 'export OPENAI_BASE_URL="{{ openaiBaseUrl }}"' >> ~/.bash_profile
-                </div>
-                <div class="whitespace-nowrap text-gray-300">
-                  echo 'export OPENAI_API_KEY="你的API密钥"' >> ~/.bash_profile
-                </div>
-                <div class="whitespace-nowrap text-gray-300">source ~/.bash_profile</div>
-              </div>
-            </div>
-
-            <div class="rounded-lg border border-indigo-200 bg-indigo-50 p-3 sm:p-4">
-              <h6 class="mb-2 font-medium text-indigo-800">验证 Codex 环境变量</h6>
-              <p class="mb-3 text-sm text-indigo-700">在 Terminal 中验证：</p>
-              <div
-                class="space-y-1 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="whitespace-nowrap text-gray-300">echo $OPENAI_BASE_URL</div>
-                <div class="whitespace-nowrap text-gray-300">echo $OPENAI_API_KEY</div>
-              </div>
-            </div>
-
-            <div class="rounded-lg border border-yellow-200 bg-yellow-50 p-3 sm:p-4">
-              <h6 class="mb-2 font-medium text-yellow-800">Codex 额外配置</h6>
-              <p class="mb-3 text-sm text-yellow-700">
-                需要在
-                <code class="rounded bg-yellow-100 px-1">~/.codex/config.toml</code>
-                文件中添加以下配置来禁用响应存储：
-              </p>
-              <div
-                class="overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="whitespace-nowrap text-gray-300">disable_response_storage = true</div>
-              </div>
-            </div>
          </div>
        </div>
      </div>
@@ -1454,81 +1383,42 @@
          </p>

          <div class="space-y-4">
-            <div class="rounded-lg border border-indigo-200 bg-white p-3 sm:p-4">
-              <h6 class="mb-2 text-sm font-medium text-gray-800 dark:text-gray-600 sm:text-base">
-                终端设置方法
-              </h6>
-              <p class="mb-3 text-sm text-gray-600">在终端中运行以下命令：</p>
+            <div class="rounded-lg border border-yellow-200 bg-yellow-50 p-3 sm:p-4">
+              <h6 class="mb-2 font-medium text-yellow-800">Codex 配置文件</h6>
+              <p class="mb-3 text-sm text-yellow-700">
+                在
+                <code class="rounded bg-yellow-100 px-1">~/.codex/config.toml</code>
+                文件中添加以下配置：
+              </p>
              <div
                class="overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
              >
-                <div class="whitespace-nowrap text-gray-300">
-                  export OPENAI_BASE_URL="{{ openaiBaseUrl }}"
-                </div>
-                <div class="whitespace-nowrap text-gray-300">
-                  export OPENAI_API_KEY="你的API密钥"
-                </div>
+                <div class="whitespace-nowrap text-gray-300">model_provider = "crs"</div>
+                <div class="whitespace-nowrap text-gray-300">model = "gpt-5"</div>
+                <div class="whitespace-nowrap text-gray-300">model_reasoning_effort = "high"</div>
+                <div class="whitespace-nowrap text-gray-300">disable_response_storage = true</div>
+                <div class="mt-2"></div>
+                <div class="whitespace-nowrap text-gray-300">[model_providers.crs]</div>
+                <div class="whitespace-nowrap text-gray-300">name = "crs"</div>
+                <div class="whitespace-nowrap text-gray-300">base_url = "{{ openaiBaseUrl }}"</div>
+                <div class="whitespace-nowrap text-gray-300">wire_api = "responses"</div>
+              </div>
+              <p class="mt-3 text-sm text-yellow-700">
+                在
+                <code class="rounded bg-yellow-100 px-1">~/.codex/auth.json</code>
+                文件中配置API密钥：
+              </p>
+              <div
+                class="mt-2 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
+              >
+                <div class="whitespace-nowrap text-gray-300">{</div>
+                <div class="whitespace-nowrap text-gray-300">"OPENAI_API_KEY": "你的API密钥"</div>
+                <div class="whitespace-nowrap text-gray-300">}</div>
              </div>
              <p class="mt-2 text-xs text-yellow-700">
                💡 使用与 Claude Code 相同的 API 密钥即可，格式如 cr_xxxxxxxxxx。
              </p>
            </div>
-
-            <div class="rounded-lg border border-indigo-200 bg-white p-3 sm:p-4">
-              <h6 class="mb-2 text-sm font-medium text-gray-800 dark:text-gray-600 sm:text-base">
-                永久设置方法
-              </h6>
-              <p class="mb-3 text-sm text-gray-600">添加到你的 shell 配置文件：</p>
-              <div
-                class="mb-3 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="mb-2"># 对于 bash (默认)</div>
-                <div class="whitespace-nowrap text-gray-300">
-                  echo 'export OPENAI_BASE_URL="{{ openaiBaseUrl }}"' >> ~/.bashrc
-                </div>
-                <div class="whitespace-nowrap text-gray-300">
-                  echo 'export OPENAI_API_KEY="你的API密钥"' >> ~/.bashrc
-                </div>
-                <div class="whitespace-nowrap text-gray-300">source ~/.bashrc</div>
-              </div>
-              <div
-                class="overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="mb-2"># 对于 zsh</div>
-                <div class="whitespace-nowrap text-gray-300">
-                  echo 'export OPENAI_BASE_URL="{{ openaiBaseUrl }}"' >> ~/.zshrc
-                </div>
-                <div class="whitespace-nowrap text-gray-300">
-                  echo 'export OPENAI_API_KEY="你的API密钥"' >> ~/.zshrc
-                </div>
-                <div class="whitespace-nowrap text-gray-300">source ~/.zshrc</div>
-              </div>
-            </div>
-
-            <div class="rounded-lg border border-indigo-200 bg-indigo-50 p-3 sm:p-4">
-              <h6 class="mb-2 font-medium text-indigo-800">验证 Codex 环境变量</h6>
-              <p class="mb-3 text-sm text-indigo-700">在终端中验证：</p>
-              <div
-                class="space-y-1 overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="whitespace-nowrap text-gray-300">echo $OPENAI_BASE_URL</div>
-                <div class="whitespace-nowrap text-gray-300">echo $OPENAI_API_KEY</div>
-              </div>
-            </div>
-
-            <div class="rounded-lg border border-yellow-200 bg-yellow-50 p-3 sm:p-4">
-              <h6 class="mb-2 font-medium text-yellow-800">Codex 额外配置</h6>
-              <p class="mb-3 text-sm text-yellow-700">
-                需要在
-                <code class="rounded bg-yellow-100 px-1">~/.codex/config.toml</code>
-                文件中添加以下配置来禁用响应存储：
-              </p>
-              <div
-                class="overflow-x-auto rounded bg-gray-900 p-2 font-mono text-xs text-green-400 sm:p-3 sm:text-sm"
-              >
-                <div class="whitespace-nowrap text-gray-300">disable_response_storage = true</div>
-              </div>
-            </div>
          </div>
        </div>
      </div>