diff --git a/pipeline_service/llm_bridge.py b/pipeline_service/llm_bridge.py
index 0e94db5..37124c7 100644
--- a/pipeline_service/llm_bridge.py
+++ b/pipeline_service/llm_bridge.py
@@ -24,8 +24,10 @@ def _decrypt_key(encrypted: str) -> str:
         from appPublic.rc4 import unpassword
         from appPublic.jsonConfig import getConfig
         config = getConfig()
-        key = config.password_key
-        return unpassword(key, encrypted)
+        # 与 ahserver.globalEnv.get_password_key() 一致：password_key 为空时用默认 key
+        key = config.password_key or 'QRIVSRHrthhwyjy176556332'
+        # unpassword(code, key)：code=密文，key=密钥（之前参数顺序写反了）
+        return unpassword(encrypted, key)
     except Exception:
         return encrypted  # already plaintext or decrypt failed