diff --git a/pipeline_service/llm_bridge.py b/pipeline_service/llm_bridge.py
index b49e51f..2825c41 100644
--- a/pipeline_service/llm_bridge.py
+++ b/pipeline_service/llm_bridge.py
@@ -16,6 +16,20 @@ logger = logging.getLogger("pipeline.llm_bridge")
 _model_cache: dict = {}
 
 
+def _decrypt_key(encrypted: str) -> str:
+    """Decrypt api_key stored with password_encode."""
+    if not encrypted:
+        return ""
+    try:
+        from appPublic.rc4 import unpassword
+        from appPublic.jsonConfig import getConfig
+        config = getConfig()
+        key = config.password_key
+        return unpassword(key, encrypted)
+    except Exception:
+        return encrypted
+
+
 async def _get_model_config(model_name: str = None) -> dict:
     """Look up model config from llm table. Returns dict with api_base, api_key, model_id."""
     global _model_cache
@@ -38,7 +52,7 @@ async def _get_model_config(model_name: str = None) -> dict:
                 r = recs[0]
                 cfg = {
                     "api_base": getattr(r, "api_base", "") or "",
-                    "api_key": getattr(r, "api_key", "") or "",
+                    "api_key": _decrypt_key(getattr(r, "api_key", "") or ""),
                     "model_id": getattr(r, "model_id", "") or "",
                 }
                 cache_key = model_name or getattr(r, "name", "")