diff --git a/README.md b/README.md
index a73ffb0e..ecaacac1 100644
--- a/README.md
+++ b/README.md
@@ -141,7 +141,7 @@ It only supports Safetensors models with the `.st` extension now. Models saved w
 ## 📙Currently Available APIs
 
 The API service starts at port 65530, and the data input and output format follow the Openai API specification.
-Note that some APIs like `chat` and `completions` have additional optional fields for advanced functionalities. Visit http://localhost:65530/swagger-ui for API schema.
+Note that some APIs like `chat` and `completions` have additional optional fields for advanced functionalities. Visit http://localhost:65530/api-docs for API schema.
 
 *   `/api/oai/v1/models`
 *   `/api/oai/models`
diff --git a/README.zh.md b/README.zh.md
index 0b55dbe5..49b894e3 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -123,7 +123,7 @@
 ## 📙目前可用的API
 
 API 服务开启于 65530 端口, 数据输入输出格式遵循 Openai API 规范。
-有一些 API，比如`chat`和`completions`有一些可选的额外字段，这些额外字段是为高级功能准备的。可以访问 http://localhost:65530/swagger-ui 查看具体的 API 参数。
+有一些 API，比如`chat`和`completions`有一些可选的额外字段，这些额外字段是为高级功能准备的。可以访问 http://localhost:65530/api-docs 查看具体的 API 参数。
 
 - `/api/oai/v1/models`
 - `/api/oai/models`
diff --git a/assets/configs/Config.toml b/assets/configs/Config.toml
index 5b1b38ce..2921d7a7 100644
--- a/assets/configs/Config.toml
+++ b/assets/configs/Config.toml
@@ -44,8 +44,8 @@ slot = "permisionkey"
 tls = false
 
 [[listen.app_keys]] # Allow mutiple app keys.
-app_id = "JUSTAISERVER"
-secret_key = "JUSTSECRET_KEY"
+app_id = "admin"
+secret_key = "ai00_is_good"
 
 [web] # Remove this to disable WebUI.
 path = "assets/www/index.zip" # Path to the WebUI.
diff --git a/assets/www/index.zip b/assets/www/index.zip
index 59f925d9..d7eb9e15 100644
--- a/assets/www/index.zip
+++ b/assets/www/index.zip
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:df48bf2278e8d15b2523451d612cf0d53aad330b83004946c904ae8c902f9592
-size 3544264
+oid sha256:2dad8582a2f894e98d9d5f20f007b9746feef77879857f84e8c01e613bc5d9a0
+size 3543094
diff --git a/crates/ai00-server/src/main.rs b/crates/ai00-server/src/main.rs
index 3fc0670a..7cd54e35 100644
--- a/crates/ai00-server/src/main.rs
+++ b/crates/ai00-server/src/main.rs
@@ -140,9 +140,13 @@ async fn main() {
 
     let serve_path = match config.web {
         Some(web) => {
-            let path = tempfile::tempdir()
-                .expect("create temp dir failed")
-                .into_path();
+            if Path::new("assets/temp").exists() {
+                std::fs::remove_dir_all("assets/temp").expect("delete temp dir failed");
+            }
+
+            std::fs::create_dir("assets/temp").expect("create plugins dir failed");
+            let path = PathBuf::from("assets/temp");
+
             load_web(web.path, &path)
                 .await
                 .expect("load frontend failed");
@@ -189,29 +193,30 @@ async fn main() {
         .allow_headers(AllowHeaders::any())
         .into_handler();
 
-    let auth_handler: JwtAuth<JwtClaims, _> =
+    let admin_auth: JwtAuth<JwtClaims, _> =
         JwtAuth::new(ConstDecoder::from_secret(config.listen.slot.as_bytes()))
             .finders(vec![
                 Box::new(HeaderFinder::new()),
-                Box::new(QueryFinder::new("_token")),
+                Box::new(QueryFinder::new("admin_token")),
                 // Box::new(CookieFinder::new("jwt_token")),
             ])
             .force_passed(listen.force_pass.unwrap_or_default());
 
-    let api_router = Router::with_hoop(auth_handler)
-        .push(Router::with_path("/adapters").get(api::adapter::adapters))
-        .push(Router::with_path("/models/info").get(api::model::info))
+    let admin_router = Router::with_hoop(admin_auth)
         .push(Router::with_path("/models/save").post(api::model::save))
         .push(Router::with_path("/models/load").post(api::model::load))
         .push(Router::with_path("/models/unload").get(api::model::unload))
         .push(Router::with_path("/models/state/load").post(api::model::load_state))
-        .push(Router::with_path("/models/state").get(api::model::state))
-        .push(Router::with_path("/models/list").get(api::file::models))
         .push(Router::with_path("/files/unzip").post(api::file::unzip))
         .push(Router::with_path("/files/dir").post(api::file::dir))
         .push(Router::with_path("/files/ls").post(api::file::dir))
         .push(Router::with_path("/files/config/load").post(api::file::load_config))
-        .push(Router::with_path("/files/config/save").post(api::file::save_config))
+        .push(Router::with_path("/files/config/save").post(api::file::save_config));
+    let api_router = Router::new()
+        .push(Router::with_path("/adapters").get(api::adapter::adapters))
+        .push(Router::with_path("/models/info").get(api::model::info))
+        .push(Router::with_path("/models/list").get(api::file::models))
+        .push(Router::with_path("/models/state").get(api::model::state))
         .push(Router::with_path("/oai/models").get(api::oai::models))
         .push(Router::with_path("/oai/v1/models").get(api::oai::models))
         .push(Router::with_path("/oai/completions").post(api::oai::completions))
@@ -237,13 +242,14 @@ async fn main() {
             Router::with_path("/api")
                 .push(Router::with_path("/auth/exchange").post(api::auth::exchange))
                 .push(api_router),
-        );
+        )
+        .push(Router::with_path("/admin").push(admin_router));
 
     let doc = OpenApi::new(bin_name, version).merge_router(&app);
 
     let app = app
-        .push(doc.into_router("/api-doc/openapi.json"))
-        .push(SwaggerUi::new("/api-doc/openapi.json").into_router("swagger-ui"));
+        .push(doc.into_router("/api-docs/openapi.json"))
+        .push(SwaggerUi::new("/api-docs/openapi.json").into_router("api-docs"));
     // this static serve should be after `swagger`
     let app = match serve_path {
         Some(path) => app