diff --git a/json/downapp.json b/json/downapp.json
index 5338500..5bad4ef 100644
--- a/json/downapp.json
+++ b/json/downapp.json
@@ -4,6 +4,7 @@
     "params": {
         "sortby":"id",
         "confidential_fields":["secretkey"],
+		"noedit":true,
         "browserfields": {
             "exclouded": ["id", "secretkey" ],
             "alters": {}
@@ -17,7 +18,50 @@
                 "title":"apikey",
                 "subtable":"downapikey"
             }
-        ]
+        ],
+		"toolbar":{
+			"tools":[
+				{
+					"name":"create_apikey",
+					"label":"创建apikey",
+					"icon":"{{entire_url('/imgs/newkey.svg')}}"
+				},
+				{
+					"name":"copy_apikey",
+					"label":"复制apikey",
+					"icon":"{{entire_url('/imgs/copy.svg')}}"
+				}
+			]
+		},
+		"binds":[
+			{
+				"wid":"self",
+				"event":"create_apikey",
+				"actiontype":"urlwidget",
+				"target":"PopupWindow",
+				"popup_options":{
+					"width":"50%",
+					"height":"50%",
+					"archor":"cr"
+				},
+				"options":{
+					"url":"{{entire_url('/dapi/create_apikey.ui')}}"
+				}
+			},
+			{
+				"wid":"self",
+				"event":"copy_apikey",
+				"actiontype":"urlwidget",
+				"target":"PopupWindow",
+				"popup_options":{
+					"width":"50%",
+					"height":"50%",
+					"archor":"cr"
+				},
+				"options":{
+					"url":"{{entire_url('/dapi/copy_apikey.ui')}}"
+				}
+			}
     }
 }
 
diff --git a/wwwroot/copy_apikey.dspy b/wwwroot/copy_apikey.dspy
new file mode 100644
index 0000000..ef45877
--- /dev/null
+++ b/wwwroot/copy_apikey.dspy
@@ -0,0 +1,23 @@
+debug(f'{params_kw=}')
+dbname = get_module_dbname()
+db = DBPools()
+async with db.sqlorContext(dbname) as sor:
+	orgid = await get_userorgid()
+	userid = await get_user()
+	ns = {
+		"id": params_kw.id,
+		"orgid":orgid,
+		"userid":"userid
+	}
+	sql = """select a.*,
+b.apikey
+from downapp a, downapikey b
+where a.id = b.dappid
+	and a.id = ${id}$
+	and a.orgid = ${orgid}$
+	and b.userid = ${userid}$"""
+	recs = await sor.sqlExe(sql, ns)
+	if len(recs):
+		r = recs[0]
+		return UiMessage(title="copy apikey", message=f'appid={r.id}, apikey={r.apikey} secretkey={r.secretkey}')
+return UiError(title='copy apikey', message='copy apikey error')