diff --git a/router/api-router.go b/router/api-router.go
index b3d4fe08e..f8d87d645 100644
--- a/router/api-router.go
+++ b/router/api-router.go
@@ -114,7 +114,7 @@ func SetApiRouter(router *gin.Engine) {
 			channelRoute.GET("/models", controller.ChannelListModels)
 			channelRoute.GET("/models_enabled", controller.EnabledListModels)
 			channelRoute.GET("/:id", controller.GetChannel)
-			channelRoute.POST("/:id/key", controller.GetChannelKey)
+			channelRoute.POST("/:id/key", middleware.CriticalRateLimit(), controller.GetChannelKey)
 			channelRoute.GET("/test", controller.TestAllChannels)
 			channelRoute.GET("/test/:id", controller.TestChannel)
 			channelRoute.GET("/update_balance", controller.UpdateAllChannelsBalance)
diff --git a/web/src/components/common/modals/TwoFactorAuthModal.jsx b/web/src/components/common/modals/TwoFactorAuthModal.jsx
index a3884d986..b22719682 100644
--- a/web/src/components/common/modals/TwoFactorAuthModal.jsx
+++ b/web/src/components/common/modals/TwoFactorAuthModal.jsx
@@ -47,8 +47,8 @@ const TwoFactorAuthModal = ({
 }) => {
   const { t } = useTranslation();
 
-  const handleKeyPress = (e) => {
-    if (e.key === 'Enter' && code) {
+  const handleKeyDown = (e) => {
+    if (e.key === 'Enter' && code && !loading) {
       onVerify();
     }
   };
@@ -75,7 +75,7 @@ const TwoFactorAuthModal = ({
           <Button
             type="primary"
             loading={loading}
-            disabled={!code}
+            disabled={!code || loading}
             onClick={onVerify}
           >
             {t('验证')}
@@ -114,7 +114,8 @@ const TwoFactorAuthModal = ({
             onChange={onCodeChange}
             size="large"
             maxLength={8}
-            onKeyPress={handleKeyPress}
+            onKeyDown={handleKeyDown}
+            autoFocus
           />
           <Typography.Text type="tertiary" size="small" className="mt-2 block">
             {t('支持6位TOTP验证码或8位备用码')}