From b2d36c0e68e0b42e3982d3f5161577c9de2d9316 Mon Sep 17 00:00:00 2001
From: jxxghp <jxxghp@gmail.com>
Date: Wed, 19 Nov 2025 13:42:53 +0800
Subject: [PATCH] Update API key documentation to clarify retrieval methods in
 security.py and mcp-api.md

---
 app/core/security.py | 2 +-
 docs/mcp-api.md      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/core/security.py b/app/core/security.py
index 4a01b7e8..5d67555e 100644
--- a/app/core/security.py
+++ b/app/core/security.py
@@ -261,7 +261,7 @@ def verify_apitoken(token: Annotated[str, Security(__get_api_token)]) -> str:
 def verify_apikey(apikey: Annotated[str, Security(__get_api_key)]) -> str:
     """
     使用 API Key 进行身份认证
-    :param apikey: API Key，从 URL 查询参数中获取 apikey=xxx
+    :param apikey: API Key，从 URL 查询参数中获取 apikey=xxx，或请求头中获取 X-API-KEY=xxx
     :return: 返回校验通过的 API Key
     """
     return __verify_key(apikey, settings.API_TOKEN, "apikey")
diff --git a/docs/mcp-api.md b/docs/mcp-api.md
index 4d9f564f..d96b849d 100644
--- a/docs/mcp-api.md
+++ b/docs/mcp-api.md
@@ -12,7 +12,7 @@ MoviePilot的智能体工具已通过HTTP API暴露，可以通过RESTful API调
 
 获取所有可用的MCP工具列表。
 
-**认证**: 需要API KEY，?api_key=MoviePilot设置中的API Key
+**认证**: 需要API KEY，从 URL 查询参数中获取 `apikey=xxx`，或请求头中获取 `X-API-KEY`
 
 **响应示例**:
 ```json