diff --git a/.github/workflows/validate-plugin-toml.yml b/.github/workflows/validate-plugin-toml.yml
index 4253c01..573faa3 100644
--- a/.github/workflows/validate-plugin-toml.yml
+++ b/.github/workflows/validate-plugin-toml.yml
@@ -1,14 +1,15 @@
 name: Validate Plugin TOML
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - master
     paths:
       - 'plugins/**'
 
 permissions:
-  pull-requests: write
+  contents: read
+  issues: write
 
 jobs:
   validate:
@@ -20,11 +21,12 @@ jobs:
         with:
           submodules: recursive
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Get changed plugins
         id: changed
         run: |
-          CHANGED_PLUGINS=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep '^plugins/' | cut -d'/' -f2 | sort -u | tr '\n' ' ')
+          CHANGED_PLUGINS=$(git diff --name-only origin/${{ github.base_ref }}...${{ github.event.pull_request.head.sha }} | grep '^plugins/' | cut -d'/' -f2 | sort -u | tr '\n' ' ')
           echo "plugins=$CHANGED_PLUGINS" >> $GITHUB_OUTPUT
           echo "Changed plugins: $CHANGED_PLUGINS"
 
@@ -53,8 +55,6 @@ jobs:
         run: |
           pnpm validate ${{ steps.changed.outputs.plugins }}
           echo "result=success" >> $GITHUB_OUTPUT
-        # If validation fails (exit 1), continue-on-error keeps the workflow running
-        # but 'result=success' won't be written to GITHUB_OUTPUT
 
       - name: Post validation comment
         if: always() && steps.changed.outputs.plugins != ''
@@ -72,28 +72,37 @@ jobs:
               body = marker + '\n## Plugin TOML Validation Report\n\n> No validation report generated.';
             }
 
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-
-            const existing = comments.find(c => c.body && c.body.includes(marker));
-
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
+            try {
+              const { data: comments } = await github.rest.issues.listComments({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 issue_number: context.issue.number,
-                body,
               });
+
+              const existing = comments.find(c => c.body && c.body.includes(marker));
+
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  comment_id: existing.id,
+                  body,
+                });
+              } else {
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.issue.number,
+                  body,
+                });
+              }
+            } catch (error) {
+              if (error.status === 403) {
+                core.warning(`Skipping PR comment because the workflow token cannot write comments: ${error.message}`);
+                return;
+              }
+
+              throw error;
             }
 
       - name: Fail if validation failed
diff --git a/.gitmodules b/.gitmodules
index 000015e..626b701 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -31,3 +31,6 @@
 [submodule "plugins/tenant"]
 	path = plugins/tenant
 	url = https://github.com/fastapi-practices/tenant.git
+[submodule "plugins/api_key_ui"]
+	path = plugins/api_key_ui
+	url = https://github.com/yzbf-lin/api_key_ui.git
diff --git a/plugins-data.json b/plugins-data.json
index b5cbca0..f44f090 100644
--- a/plugins-data.json
+++ b/plugins-data.json
@@ -58,6 +58,23 @@
         "branch": "master"
       }
     },
+    {
+      "plugin": {
+        "icon": "https://wu-clan.github.io/picx-images-hosting/logo/fba.svg",
+        "summary": "API Key UI",
+        "version": "0.0.1",
+        "description": "API Key 前端管理插件，提供列表、搜索、新增、编辑、启停与复制能力",
+        "author": "yzbf-lin",
+        "tags": [
+          "auth"
+        ]
+      },
+      "git": {
+        "path": "plugins/api_key_ui",
+        "url": "https://github.com/yzbf-lin/api_key_ui.git",
+        "branch": "master"
+      }
+    },
     {
       "plugin": {
         "icon": "https://wu-clan.github.io/picx-images-hosting/logo/fba.svg",
diff --git a/plugins-data.ts b/plugins-data.ts
index c2433d2..5b14e35 100644
--- a/plugins-data.ts
+++ b/plugins-data.ts
@@ -82,6 +82,23 @@ export const pluginDataList: PluginData[] = [
       "branch": "master"
     }
   },
+  {
+    "plugin": {
+      "icon": "https://wu-clan.github.io/picx-images-hosting/logo/fba.svg",
+      "summary": "API Key UI",
+      "version": "0.0.1",
+      "description": "API Key 前端管理插件，提供列表、搜索、新增、编辑、启停与复制能力",
+      "author": "yzbf-lin",
+      "tags": [
+        "auth"
+      ]
+    },
+    "git": {
+      "path": "plugins/api_key_ui",
+      "url": "https://github.com/yzbf-lin/api_key_ui.git",
+      "branch": "master"
+    }
+  },
   {
     "plugin": {
       "icon": "https://wu-clan.github.io/picx-images-hosting/logo/fba.svg",
diff --git a/plugins/api_key_ui b/plugins/api_key_ui
new file mode 160000
index 0000000..94b983e
--- /dev/null
+++ b/plugins/api_key_ui
@@ -0,0 +1 @@
+Subproject commit 94b983e92c0850f90b312c8b257f18aa22708ed4