diff --git a/packages/ui/certd-client/src/style/certd.less b/packages/ui/certd-client/src/style/certd.less
index cf151331..35299775 100644
--- a/packages/ui/certd-client/src/style/certd.less
+++ b/packages/ui/certd-client/src/style/certd.less
@@ -9,6 +9,10 @@
   display: inline-flex;
   justify-content: center;
   align-items: center;
+  .fs-iconify{
+    font-size:18px;
+    margin-right: 5px;
+  }
 }
 
 .cd-icon-button {
diff --git a/packages/ui/certd-client/src/views/certd/open/openkey/api.ts b/packages/ui/certd-client/src/views/certd/open/openkey/api.ts
index 6dac377f..86771e45 100644
--- a/packages/ui/certd-client/src/views/certd/open/openkey/api.ts
+++ b/packages/ui/certd-client/src/views/certd/open/openkey/api.ts
@@ -1,55 +1,53 @@
 import { request } from "/src/api/service";
 
-export function createApi() {
-  const apiPrefix = "/open/key";
-  return {
-    async GetList(query: any) {
-      return await request({
-        url: apiPrefix + "/page",
-        method: "post",
-        data: query
-      });
-    },
+export const OPEN_API_DOC = "https://apifox.com/apidoc/shared-2e76f8c4-7c58-413b-a32d-a1316529af44/254949529e0";
 
-    async AddObj(obj: any) {
-      return await request({
-        url: apiPrefix + "/add",
-        method: "post",
-        data: obj
-      });
-    },
+const apiPrefix = "/open/key";
+export const openkeyApi = {
+  async GetList(query: any) {
+    return await request({
+      url: apiPrefix + "/page",
+      method: "post",
+      data: query
+    });
+  },
 
-    async UpdateObj(obj: any) {
-      return await request({
-        url: apiPrefix + "/update",
-        method: "post",
-        data: obj
-      });
-    },
+  async AddObj(obj: any) {
+    return await request({
+      url: apiPrefix + "/add",
+      method: "post",
+      data: obj
+    });
+  },
 
-    async DelObj(id: number) {
-      return await request({
-        url: apiPrefix + "/delete",
-        method: "post",
-        params: { id }
-      });
-    },
+  async UpdateObj(obj: any) {
+    return await request({
+      url: apiPrefix + "/update",
+      method: "post",
+      data: obj
+    });
+  },
 
-    async GetObj(id: number) {
-      return await request({
-        url: apiPrefix + "/info",
-        method: "post",
-        params: { id }
-      });
-    },
-    async GetApiToken(id: number) {
-      return await request({
-        url: apiPrefix + "/getApiToken",
-        method: "post",
-        data: { id }
-      });
-    }
-  };
-}
+  async DelObj(id: number) {
+    return await request({
+      url: apiPrefix + "/delete",
+      method: "post",
+      params: { id }
+    });
+  },
 
-export const pipelineGroupApi = createApi();
+  async GetObj(id: number) {
+    return await request({
+      url: apiPrefix + "/info",
+      method: "post",
+      params: { id }
+    });
+  },
+  async GetApiToken(id: number) {
+    return await request({
+      url: apiPrefix + "/getApiToken",
+      method: "post",
+      data: { id }
+    });
+  }
+};
diff --git a/packages/ui/certd-client/src/views/certd/open/openkey/crud.tsx b/packages/ui/certd-client/src/views/certd/open/openkey/crud.tsx
index e18ed809..f5bc9be3 100644
--- a/packages/ui/certd-client/src/views/certd/open/openkey/crud.tsx
+++ b/packages/ui/certd-client/src/views/certd/open/openkey/crud.tsx
@@ -1,15 +1,12 @@
 // @ts-ignore
 import { useI18n } from "vue-i18n";
-import { AddReq, CreateCrudOptionsProps, CreateCrudOptionsRet, DelReq, EditReq, UserPageQuery, UserPageRes } from "@fast-crud/fast-crud";
-import { pipelineGroupApi } from "./api";
-import dayjs from "dayjs";
-import { Modal } from "ant-design-vue";
-import CertView from "/@/views/certd/pipeline/cert-view.vue";
+import { AddReq, CreateCrudOptionsProps, CreateCrudOptionsRet, DelReq, dict, EditReq, UserPageQuery, UserPageRes } from "@fast-crud/fast-crud";
+import { OPEN_API_DOC, openkeyApi } from "./api";
 import { useModal } from "/@/use/use-modal";
 
 export default function ({ crudExpose, context }: CreateCrudOptionsProps): CreateCrudOptionsRet {
   const { t } = useI18n();
-  const api = pipelineGroupApi;
+  const api = openkeyApi;
   const pageRequest = async (query: UserPageQuery): Promise<UserPageRes> => {
     return await api.GetList(query);
   };
@@ -59,17 +56,7 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
       actionbar: {
         buttons: {
           add: {
-            text: "生成新的Key",
-            click() {
-              Modal.confirm({
-                title: "确认",
-                content: "确定要生成新的Key?",
-                async onOk() {
-                  await api.AddObj({});
-                  await crudExpose.doRefresh();
-                }
-              });
-            }
+            text: "生成新的Key"
           }
         }
       },
@@ -82,7 +69,10 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           edit: { show: false },
           remove: { show: true },
           gen: {
-            text: "测试ApiToken",
+            text: " 接口测试",
+            size: "mini",
+            icon: "devicon-plain:vitest",
+            type: "primary",
             async click({ row }) {
               const apiToken = await api.GetApiToken(row.id);
 
@@ -94,7 +84,13 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
                 content: () => {
                   return (
                     <div>
-                      <div class={"m-10 p-10"}>测试ApiKey如下，您可以在3分钟内使用它进行开放接口请求测试</div>
+                      <div class={"m-10 p-10"}>
+                        测试ApiKey如下，您可以在3分钟内使用它进行
+                        <a href={OPEN_API_DOC} target={"_blank"}>
+                          开放接口
+                        </a>
+                        请求测试
+                      </div>
                       <div class={"m-10 p-10"} style={{ border: "1px solid #333" }}>
                         <fs-copyable model-value={apiToken}></fs-copyable>
                       </div>
@@ -126,26 +122,50 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
         },
         keyId: {
           title: "KeyId",
+          type: ["text", "copyable"],
           search: {
             show: false
           },
           form: {
             show: false
           },
-          type: "text",
           column: {
-            width: 200,
+            width: 250,
             sorter: true
           }
         },
         keySecret: {
           title: "KeySecret",
-          type: "text",
+          type: ["text", "copyable"],
           form: {
             show: false
           },
           column: {
-            width: 550,
+            width: 580,
+            sorter: true
+          }
+        },
+        scope: {
+          title: "权限范围",
+          type: "dict-radio",
+          dict: dict({
+            data: [
+              { label: "仅开放接口", value: "open", color: "blue" },
+              { label: "账户所有权限", value: "user", color: "red" }
+            ]
+          }),
+          form: {
+            value: "open",
+            show: true,
+            rules: [{ required: true, message: "此项必填" }],
+            helper: "仅开放接口只可以访问开放接口，账户所有权限可以访问所有接口",
+            component: {
+              vModel: "value"
+            }
+          },
+          column: {
+            width: 120,
+            align: "center",
             sorter: true
           }
         },
diff --git a/packages/ui/certd-client/src/views/certd/open/openkey/index.vue b/packages/ui/certd-client/src/views/certd/open/openkey/index.vue
index 2f5097ac..0fa53b7c 100644
--- a/packages/ui/certd-client/src/views/certd/open/openkey/index.vue
+++ b/packages/ui/certd-client/src/views/certd/open/openkey/index.vue
@@ -2,16 +2,20 @@
   <fs-page>
     <template #header>
       <div class="title">开放接口密钥管理</div>
+      <div class="more">
+        <a :href="OPEN_API_DOC" target="_blank">开放接口文档</a>
+      </div>
     </template>
     <fs-crud ref="crudRef" v-bind="crudBinding"> </fs-crud>
   </fs-page>
 </template>
 
 <script lang="ts" setup>
-import { defineComponent, onActivated, onMounted } from "vue";
+import { onActivated, onMounted } from "vue";
 import { useFs } from "@fast-crud/fast-crud";
 import createCrudOptions from "./crud";
-import { createApi } from "./api";
+import { OPEN_API_DOC } from "/@/views/certd/open/openkey/api";
+
 defineOptions({
   name: "OpenKey"
 });
diff --git a/packages/ui/certd-server/db/migration/v10020__open.sql b/packages/ui/certd-server/db/migration/v10020__open.sql
index b8312115..14d0ee67 100644
--- a/packages/ui/certd-server/db/migration/v10020__open.sql
+++ b/packages/ui/certd-server/db/migration/v10020__open.sql
@@ -4,6 +4,7 @@ CREATE TABLE "cd_open_key"
   "user_id"     integer,
   "key_id"      varchar(50),
   "key_secret"  varchar(100),
+  "scope"       varchar(50),
   "disabled"    boolean  NOT NULL DEFAULT (false),
   "create_time" datetime NOT NULL DEFAULT (CURRENT_TIMESTAMP),
   "update_time" datetime NOT NULL DEFAULT (CURRENT_TIMESTAMP)
diff --git a/packages/ui/certd-server/src/controller/user/open/open-key-controller.ts b/packages/ui/certd-server/src/controller/user/open/open-key-controller.ts
index 49702ffe..9cf0597c 100644
--- a/packages/ui/certd-server/src/controller/user/open/open-key-controller.ts
+++ b/packages/ui/certd-server/src/controller/user/open/open-key-controller.ts
@@ -37,10 +37,9 @@ export class OpenKeyController extends CrudController<OpenKeyService> {
   }
 
   @Post('/add', { summary: Constants.per.authOnly })
-  async add() {
-    const bean: any = {};
-    bean.userId = this.getUserId();
-    const res = await this.service.add(bean);
+  async add(@Body(ALL) body: any) {
+    body.userId = this.getUserId();
+    const res = await this.service.add(body);
     return this.ok(res);
   }
 
diff --git a/packages/ui/certd-server/src/middleware/authority.ts b/packages/ui/certd-server/src/middleware/authority.ts
index fcd61f06..01bdcfd5 100644
--- a/packages/ui/certd-server/src/middleware/authority.ts
+++ b/packages/ui/certd-server/src/middleware/authority.ts
@@ -4,8 +4,8 @@ import jwt from 'jsonwebtoken';
 import { Constants, SysPrivateSettings, SysSettingsService } from '@certd/lib-server';
 import { logger } from '@certd/basic';
 import { AuthService } from '../modules/sys/authority/service/auth-service.js';
-import { Next } from 'koa';
 import { OpenKeyService } from '../modules/open/service/open-key-service.js';
+import { RoleService } from '../modules/sys/authority/service/role-service.js';
 
 /**
  * 权限校验
@@ -18,6 +18,8 @@ export class AuthorityMiddleware implements IWebMiddleware {
   @Inject()
   authService: AuthService;
   @Inject()
+  roleService: RoleService;
+  @Inject()
   openKeyService: OpenKeyService;
   @Inject()
   sysSettingsService: SysSettingsService;
@@ -50,10 +52,6 @@ export class AuthorityMiddleware implements IWebMiddleware {
         return;
       }
 
-      if (permission === Constants.per.open) {
-        return this.doOpenHandler(ctx, next);
-      }
-
       let token = ctx.get('Authorization') || '';
       token = token.replace('Bearer ', '').trim();
       if (!token) {
@@ -64,41 +62,61 @@ export class AuthorityMiddleware implements IWebMiddleware {
         //尝试从query中获取token
         token = (ctx.query.token as string) || '';
       }
-      try {
-        ctx.user = jwt.verify(token, this.secret);
-      } catch (err) {
-        logger.error('token verify error: ', err);
-        ctx.status = 401;
-        ctx.body = Constants.res.auth;
+
+      if (token) {
+        try {
+          ctx.user = jwt.verify(token, this.secret);
+        } catch (err) {
+          logger.error('token verify error: ', err);
+          return this.notAuth(ctx);
+        }
+      } else {
+        //找找openKey
+        const openKey = await this.doOpenHandler(ctx);
+        if (!openKey) {
+          return this.notAuth(ctx);
+        }
+        if (permission === Constants.per.open) {
+          await next();
+          return;
+        } else if (openKey.scope === 'open') {
+          return this.notAuth(ctx);
+        }
+      }
+
+      if (permission === Constants.per.authOnly) {
+        await next();
         return;
       }
 
-      if (permission !== Constants.per.authOnly) {
-        const pass = await this.authService.checkPermission(ctx, permission);
-        if (!pass) {
-          logger.info('not permission: ', ctx.req.url);
-          ctx.status = 401;
-          ctx.body = Constants.res.permission;
-          return;
-        }
+      const pass = await this.authService.checkPermission(ctx, permission);
+      if (!pass) {
+        logger.info('not permission: ', ctx.req.url);
+        ctx.status = 401;
+        ctx.body = Constants.res.permission;
+        return;
       }
-      await next();
     };
   }
 
-  async doOpenHandler(ctx: IMidwayKoaContext, next: Next) {
+  private notAuth(ctx: IMidwayKoaContext) {
+    ctx.status = 401;
+    ctx.body = Constants.res.auth;
+    return;
+  }
+
+  async doOpenHandler(ctx: IMidwayKoaContext) {
     //开放接口
-    const openKey = ctx.get('x-api-token') || '';
+    const openKey = ctx.get('x-certd-token') || '';
     if (!openKey) {
-      ctx.status = 401;
-      ctx.body = Constants.res.auth;
-      return;
+      return null;
     }
 
     //校验 openKey
     const openKeyRes = await this.openKeyService.verifyOpenKey(openKey);
-    ctx.user = { id: openKeyRes.userId };
+    const roles = await this.roleService.getRoleIdsByUserId(openKeyRes.userId);
+    ctx.user = { id: openKeyRes.userId, roles };
     ctx.openKey = openKeyRes;
-    await next();
+    return openKeyRes;
   }
 }
diff --git a/packages/ui/certd-server/src/modules/open/entity/open-key.ts b/packages/ui/certd-server/src/modules/open/entity/open-key.ts
index fbc988d2..6c774ce3 100644
--- a/packages/ui/certd-server/src/modules/open/entity/open-key.ts
+++ b/packages/ui/certd-server/src/modules/open/entity/open-key.ts
@@ -14,6 +14,9 @@ export class OpenKeyEntity {
   @Column({ name: 'key_secret', comment: 'keySecret' })
   keySecret: string;
 
+  @Column({ name: 'scope', comment: '权限范围' })
+  scope: string; // open 仅开放接口、 user 用户所有权限
+
   @Column({ name: 'create_time', comment: '创建时间', default: () => 'CURRENT_TIMESTAMP' })
   createTime: Date;
 
diff --git a/packages/ui/certd-server/src/modules/open/service/open-key-service.ts b/packages/ui/certd-server/src/modules/open/service/open-key-service.ts
index d894e661..8b5d78c3 100644
--- a/packages/ui/certd-server/src/modules/open/service/open-key-service.ts
+++ b/packages/ui/certd-server/src/modules/open/service/open-key-service.ts
@@ -12,6 +12,7 @@ export type OpenKey = {
   keyId: string;
   keySecret: string;
   encrypt: boolean;
+  scope: string;
 };
 @Provide()
 @Scope(ScopeEnum.Request, { allowDowngrade: true })
@@ -29,10 +30,10 @@ export class OpenKeyService extends BaseService<OpenKeyEntity> {
   }
 
   async add(bean: OpenKeyEntity) {
-    return await this.generate(bean.userId);
+    return await this.generate(bean.userId, bean.scope);
   }
 
-  async generate(userId: number) {
+  async generate(userId: number, scope: string) {
     const keyId = utils.id.simpleNanoId(18) + '_key';
     const secretKey = crypto.randomBytes(32);
     const keySecret = Buffer.from(secretKey).toString('hex');
@@ -40,6 +41,7 @@ export class OpenKeyService extends BaseService<OpenKeyEntity> {
     entity.userId = userId;
     entity.keyId = keyId;
     entity.keySecret = keySecret;
+    entity.scope = scope ?? 'open';
     await this.repository.save(entity);
     return entity;
   }
@@ -84,6 +86,7 @@ export class OpenKeyService extends BaseService<OpenKeyEntity> {
       keyId: entity.keyId,
       keySecret: entity.keySecret,
       encrypt: encrypt,
+      scope: entity.scope,
     };
   }