diff --git a/route/dashboard.js b/route/dashboard.js
index e11165c..6c489e3 100644
--- a/route/dashboard.js
+++ b/route/dashboard.js
@@ -65,6 +65,8 @@ router.post('/api/print', KoaBody(), async (c, n) => {
   c.async = true
   let arr = c.request.body
   if (!arr.data) throw 'print data empty'
+  if (config.api.secret && !arr.key) throw 'access key enpty'
+  if (config.api.secret !== arr.key.trim()) throw 'access key error'
 
   let status = await Printer.printerString(arr.data)
 
@@ -117,6 +119,8 @@ router.post('/api/print', KoaBody(), async (c, n) => {
     json.printer.serial = arr.tty
     json.printer.feed = feed
 
+    json.api.secret = arr.secret || ''
+
     let wconfig = await new Promise((resolve, reject) => {
       fs.writeFile(path.resolve(process.env.PROJECT_ROOT, 'config.json'), JSON.stringify(json, null, 2), {
         mode: 0o664,
diff --git a/server.js b/server.js
index 22a5782..0624c5d 100644
--- a/server.js
+++ b/server.js
@@ -103,10 +103,12 @@ let systemStatus = {
     feed: 0
   },
   pcount: 0,
-  lastprint: ''
+  lastprint: '',
+  secret: ''
 }
 
 systemStatus.ble.enable = config.ble.enable
+systemStatus.secret = config.api.secret
 if (config.ble.enable) {
   systemStatus.ble.mac = await getBTAddr()
   systemStatus.ble.service = config.ble.uuid.service
diff --git a/views/dashboard/setting.ejs b/views/dashboard/setting.ejs
index eb7fcce..a880f35 100644
--- a/views/dashboard/setting.ejs
+++ b/views/dashboard/setting.ejs
@@ -27,6 +27,12 @@
           <label for="en-ble">啟用藍芽</label>
         </div>
       </div>
+
+      <h3 class="ui dividing header">WebAPI設定</h3>
+      <div class="field">
+        <label for="api-secret">API密鑰</label>
+        <input type="text" name="api-secret" placeholder="請輸入密鑰，空白不設定" id="api-secret">
+      </div>
   
       <div style="margin-top: 40px; text-align: right;">
         <button class="ui button blue" type="submit">送出設定</button>
@@ -75,7 +81,8 @@
       let json = {
         tty: '',
         feed: 0,
-        ble: ''
+        ble: '',
+        secret: ''
       }
       let dev = getValue(document.querySelector('select#tty'))
       let feed = getValue(document.querySelector('input#feed'))
@@ -85,10 +92,13 @@
   
       if(!dev) return alert('請選擇印表機連接埠')
       if (!isFinite(feed) || feed < 0) return alert('切紙前空行請輸入整數')
+
+      let secret = getValue(document.querySelector('input#api-secret'))
   
       json.tty = dev
       json.feed = Math.floor(parseInt(feed))
       json.ble = ble
+      json.secret = secret
   
       $.ajax({
         url: '/api/write_config',
diff --git a/views/dashboard/statusview.ejs b/views/dashboard/statusview.ejs
index cd4fd53..384b3fc 100644
--- a/views/dashboard/statusview.ejs
+++ b/views/dashboard/statusview.ejs
@@ -2,33 +2,47 @@
   <div class="ui grid">
     <div class="column sixteen wide t-right">
       <div class="ui segment">
-        <button class="ui button mini" type="button" id="gen-qr">GenerateQR</button>
+        <button class="ui button mini" type="button" id="gen-api-qr">Generate API QR</button>
+        <button class="ui button mini" type="button" id="gen-ble-qr">Generate BLE QR</button>
       </div>
     </div>
-    <div class="column eight wide">
+    <div class="column sixteen wide">
       <div class="segment ui">
-        <h4 class="ui header dividing">藍芽狀態</h4>
+        <h4 class="ui header dividing">系統狀態</h4>
         <div class="ui divided list">
           <div class="item">
-            <div class="ui horizontal label basic">啟用狀態</div>
-            <div class="description t-right" id="en-ble">On</div>
-          </div>
-          <div class="item">
-            <div class="ui horizontal label basic">Mac Address</div>
-            <div class="description t-right" id="ble-mac">00:11:22:33:44:55:66</div>
-          </div>
-          <div class="item">
-            <div class="ui horizontal label basic">ServiceUUID</div>
-            <div class="description t-right" id="ble-service">37B2975E-1A4B-4975-9211-9D47142B8183</div>
-          </div>
-          <div class="item">
-            <div class="ui horizontal label basic">CharacteristicUUID</div>
-            <div class="description t-right" id="ble-character">37B2975E-1A4B-4975-9211-9D47142B8183</div>
+            <div class="ui horizontal label basic">API Key</div>
+            <div class="description t-right" id="apikey"></div>
           </div>
+          
         </div>
       </div>
     </div>
 
+    <div class="column eight wide">
+        <div class="segment ui">
+          <h4 class="ui header dividing">藍芽狀態</h4>
+          <div class="ui divided list">
+            <div class="item">
+              <div class="ui horizontal label basic">啟用狀態</div>
+              <div class="description t-right" id="en-ble">On</div>
+            </div>
+            <div class="item">
+              <div class="ui horizontal label basic">Mac Address</div>
+              <div class="description t-right" id="ble-mac">00:11:22:33:44:55:66</div>
+            </div>
+            <div class="item">
+              <div class="ui horizontal label basic">ServiceUUID</div>
+              <div class="description t-right" id="ble-service">37B2975E-1A4B-4975-9211-9D47142B8183</div>
+            </div>
+            <div class="item">
+              <div class="ui horizontal label basic">CharacteristicUUID</div>
+              <div class="description t-right" id="ble-character">37B2975E-1A4B-4975-9211-9D47142B8183</div>
+            </div>
+          </div>
+        </div>
+      </div>
+
     <div class="column eight wide">
       <div class="segment ui">
         <h4 class="ui header dividing">印表機狀態</h4>
@@ -83,6 +97,8 @@
     characteristic: ''
   }
 
+  var apikey = ''
+
   var ws = new WebSocket('ws://' + location.host)
   ws.onmessage = msg => {
     // console.log(msg)
@@ -106,6 +122,9 @@
         setting.service = d.ble.service
         setting.characteristic = d.ble.characteristic
 
+        apikey = d.secret
+        $('#apikey').text(apikey)
+
         $('#prt-con').text(d.printer.connect ? 'Connected' : 'Disconnected')
         $('#prt-port').text(d.printer.serial)
         $('#prt-feed').text(d.printer.feed)
@@ -117,11 +136,11 @@
     }
   }
 
-  $('#gen-qr').click(function () {
+  $('#gen-ble-qr, #gen-api-qr').click(function () {
     let qrdiv = document.querySelector('div#qr')
     qrdiv.innerHTML = ''
     let qr = new QRCode(qrdiv, {
-      text: JSON.stringify(setting, null, 2),
+      text: this.id === 'gen-ble-qr' ? JSON.stringify(setting, null, 2) : JSON.stringify({apikey}, null, 2),
       colorDark: "#000000",
       colorLight: "#ffffff",
       correctLevel: QRCode.CorrectLevel.L
diff --git a/views/install/index.ejs b/views/install/index.ejs
index bdda728..b2d3631 100644
--- a/views/install/index.ejs
+++ b/views/install/index.ejs
@@ -29,6 +29,12 @@
       </div>
     </div>
 
+    <h3 class="ui dividing header">WebAPI設定</h3>
+    <div class="field">
+      <label for="api-secret">API密鑰</label>
+      <input type="text" name="api-secret" placeholder="請輸入密鑰，空白不設定" id="api-secret">
+    </div>
+
     <div style="margin-top: 40px; text-align: right;">
       <button class="ui button blue" type="submit">送出設定</button>
     </div>
@@ -76,7 +82,8 @@
     let json = {
       tty: '',
       feed: 0,
-      ble: ''
+      ble: '',
+      secret: ''
     }
     let dev = getValue(document.querySelector('select#tty'))
     let feed = getValue(document.querySelector('input#feed'))
@@ -87,9 +94,12 @@
     if(!dev) return alert('請選擇印表機連接埠')
     if (!isFinite(feed) || feed < 0) return alert('切紙前空行請輸入整數')
 
+    let secret = getValue(document.querySelector('input#api-secret'))
+
     json.tty = dev
     json.feed = Math.floor(parseInt(feed))
     json.ble = ble
+    json.secret = secret
 
     $.ajax({
       url: '/install/write_config',