diff --git a/CloudBuilder/CloudBuilder.Master.Service/DmsFileService.auto.cs b/CloudBuilder/CloudBuilder.Master.Service/DmsFileService.auto.cs
index f157a8a..1cd241c 100644
--- a/CloudBuilder/CloudBuilder.Master.Service/DmsFileService.auto.cs
+++ b/CloudBuilder/CloudBuilder.Master.Service/DmsFileService.auto.cs
@@ -1167,8 +1167,19 @@ namespace CloudBuilder.Master.Service
 
                 using var client = new System.Net.Http.HttpClient();
                 client.Timeout = TimeSpan.FromSeconds(ServiceSettingsPolicy.GetIdCardOcrTimeoutSeconds(service));
+
+                //识别服务已启用 Bearer Token 鉴权（appsettings 配置 API_TOKENS 中 win-service 的 Token）
+                var apiKey = ServiceSettingsPolicy.GetIdCardOcrApiKey(service);
+                if (!string.IsNullOrWhiteSpace(apiKey))
+                    client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", apiKey);
+
                 using var response = client.PostAsync(apiUrl, form).GetAwaiter().GetResult();
                 string json = response.Content.ReadAsStringAsync().GetAwaiter().GetResult();
+                if (!response.IsSuccessStatusCode)
+                {
+                    Console.WriteLine($"[UploadIdCardFile] OCR service returned HTTP {(int)response.StatusCode}: {json}");
+                    return data;
+                }
                 if (string.IsNullOrWhiteSpace(json)) return data;
 
                 using var doc = System.Text.Json.JsonDocument.Parse(json);
diff --git a/CloudBuilder/CloudBuilder.Security/Policy/ServiceSettingsPolicy.cs b/CloudBuilder/CloudBuilder.Security/Policy/ServiceSettingsPolicy.cs
index b8a8421..cbe4114 100644
--- a/CloudBuilder/CloudBuilder.Security/Policy/ServiceSettingsPolicy.cs
+++ b/CloudBuilder/CloudBuilder.Security/Policy/ServiceSettingsPolicy.cs
@@ -26,6 +26,7 @@ namespace CloudBuilder.Security.Policy
 
         // 身份证 OCR 识别服务（server-to-server 调用，地址来自 appsettings.json，避免写死）
         public const string IdCardOcrApiUrl = "IdCardOcr:ApiUrl";
+        public const string IdCardOcrApiKey = "IdCardOcr:ApiKey";
         public const string IdCardOcrSide = "IdCardOcr:Side";
         public const string IdCardOcrTimeoutSeconds = "IdCardOcr:TimeoutSeconds";
 
@@ -34,6 +35,12 @@ namespace CloudBuilder.Security.Policy
             return service.Configuration[IdCardOcrApiUrl];
         }
 
+        // OCR 服务已启用 Bearer Token 鉴权（API_TOKENS 中 win-service 专用 Token），未配置时返回空串表示不带认证头
+        public static string GetIdCardOcrApiKey(IApplicationService service)
+        {
+            return service.Configuration[IdCardOcrApiKey];
+        }
+
         public static string GetIdCardOcrSide(IApplicationService service)
         {
             var side = service.Configuration[IdCardOcrSide];
diff --git a/CloudBuilder/CloudBuilder.Web.Entry/appsettings.json b/CloudBuilder/CloudBuilder.Web.Entry/appsettings.json
index 03471e5..94e2113 100644
--- a/CloudBuilder/CloudBuilder.Web.Entry/appsettings.json
+++ b/CloudBuilder/CloudBuilder.Web.Entry/appsettings.json
@@ -74,7 +74,8 @@
     "Arguments": "-i {0}{1} -c:v libx264 -preset veryfast -crf 26 -profile:v main -level 3.1 -vf \"scale='min(1280,iw)':-2\" -maxrate 1500k -bufsize 2400k -c:a aac -b:a 96k -ac 2 -ar 44100 -start_number 0 -hls_time 3 -hls_list_size 0 -hls_flags independent_segments -f hls {2}" //0-源路径，1-切片秒数，2-目标路径
   },
   "IdCardOcr": {
-    "ApiUrl": "https://web.youjiala.com/api/v1/idcard/recognize", //身份证 OCR 识别服务（同 docker 内网，server-to-server 调用，无浏览器跨域）
+    "ApiUrl": "https://web.youjiala.com/api/v1/idcard/recognize", //身份证 OCR 识别服务（server-to-server 调用，无浏览器跨域）
+    "ApiKey": "3444df79189bbf16e872d109c5d56bc7684e24645c39b416", //API_TOKENS 中 win-service 的 Bearer Token（服务端调用专用，frontend 的不可用）
     "Side": "auto", //识别面：auto/front/back
     "TimeoutSeconds": 30
   },