diff --git a/public/index.html b/public/index.html
index 106de11..785ff15 100644
--- a/public/index.html
+++ b/public/index.html
@@ -100,13 +100,30 @@
     }
 
     async function setup() {
+      // 检查是否已有 key
+      const savedKey = localStorage.getItem('myoss_api_key');
+      if (savedKey) {
+        apiKey = savedKey;
+        location.reload();
+        return;
+      }
+      
       const name = document.getElementById('setup-name').value;
-      const res = await fetch(API_BASE + '/api/keys/bootstrap', {
+      const res = await fetch('/api/keys/bootstrap', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ name })
       });
       const data = await res.json();
+      if (data.error) {
+        // 已初始化过，提示用户输入已有 key
+        const key = prompt('服务已初始化，请输入已有的 API Key:');
+        if (key) {
+          localStorage.setItem('myoss_api_key', key);
+          location.reload();
+        }
+        return;
+      }
       apiKey = data.key;
       localStorage.setItem('myoss_api_key', apiKey);
       location.reload();
@@ -143,10 +160,14 @@
       for (const file of files) {
         const formData = new FormData();
         formData.append('file', file);
-        await request('/api/files', {
+        const data = await request('/api/files', {
           method: 'POST',
           body: formData
         });
+        if (data.error) {
+          alert(data.error);
+          return;
+        }
       }
       alert('上传成功');
       loadFiles();
@@ -154,6 +175,10 @@
 
     async function loadFiles() {
       const files = await request('/api/files');
+      renderFiles(files);
+    }
+
+    function renderFiles(files) {
       const tbody = document.getElementById('files-tbody');
       if (!files || !files.length) {
         tbody.innerHTML = '<tr><td colspan="3" class="empty">暂无文件</td></tr>';
@@ -167,7 +192,7 @@
           </td>
           <td>${formatSize(f.size)}</td>
           <td class="actions">
-            <a href="${API_BASE}/api/files/${f.fileKey}/download" target="_blank">下载</a>
+            <a href="/api/files/${f.fileKey}/download?key=${apiKey}" target="_blank">下载</a>
             <button class="danger" onclick="deleteFile('${f.fileKey}')">删除</button>
           </td>
         </tr>
@@ -189,20 +214,34 @@
 
     async function init() {
       if (!apiKey) {
+        // 先检查是否已有 bootstrap key
+        try {
+          const res = await fetch('/api/files', { 
+            headers: { 'X-API-Key': 'check' } 
+          });
+          if (res.status === 401 || res.status === 404) {
+            document.getElementById('setup-card').classList.remove('hidden');
+            return;
+          }
+        } catch (e) {}
         document.getElementById('setup-card').classList.remove('hidden');
         return;
       }
       
-      const res = await fetch(API_BASE + '/api/files', { 
-        headers: { 'X-API-Key': apiKey } 
-      });
-      
-      document.getElementById('main-card').classList.remove('hidden');
-      document.getElementById('upload-card').classList.remove('hidden');
-      document.getElementById('files-card').classList.remove('hidden');
-      document.getElementById('current-key').textContent = apiKey;
-      
-      loadFiles();
+      try {
+        const files = await request('/api/files');
+        if (!files) {
+          document.getElementById('setup-card').classList.remove('hidden');
+          return;
+        }
+        document.getElementById('main-card').classList.remove('hidden');
+        document.getElementById('upload-card').classList.remove('hidden');
+        document.getElementById('files-card').classList.remove('hidden');
+        document.getElementById('current-key').textContent = apiKey;
+        renderFiles(files);
+      } catch (e) {
+        document.getElementById('setup-card').classList.remove('hidden');
+      }
     }
 
     init();
diff --git a/src/middleware/auth.js b/src/middleware/auth.js
index aaf50c9..e82d636 100644
--- a/src/middleware/auth.js
+++ b/src/middleware/auth.js
@@ -1,7 +1,7 @@
 const { APIKey } = require('../models');
 
 const authMiddleware = async (req, res, next) => {
-  const apiKey = req.headers['x-api-key'];
+  const apiKey = req.headers['x-api-key'] || req.query.key;
   if (!apiKey) {
     return res.status(401).json({ error: 'Missing X-API-Key header' });
   }
diff --git a/src/models/index.js b/src/models/index.js
index 66924f2..424a51c 100644
--- a/src/models/index.js
+++ b/src/models/index.js
@@ -1,10 +1,12 @@
 const { Sequelize, DataTypes } = require('sequelize');
 const config = require('../../config');
+const BetterSqlite3 = require('better-sqlite3');
 
 const sequelize = new Sequelize({
   dialect: 'sqlite',
   storage: config.storage.databasePath,
   logging: false,
+  dialectModule: BetterSqlite3,
 });
 
 const APIKey = sequelize.define('APIKey', {