diff --git a/backend/app/utils/calc_engine.py b/backend/app/utils/calc_engine.py
index 0d539091..4e4df23e 100644
--- a/backend/app/utils/calc_engine.py
+++ b/backend/app/utils/calc_engine.py
@@ -5,7 +5,7 @@ from app.database import get_session_local
 from app.models import KPIDefinition, KPIValue
 
 ERP_API = "http://127.0.0.1:8300"
-ERP_KEY = os.environ.get("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
+ERP_KEY = os.environ.get("ERP_API_KEY", "")
 
 async def _get(url: str, params: dict = None):
     async with httpx.AsyncClient(timeout=20) as c:
diff --git a/backend/app/utils/cost_engine.py b/backend/app/utils/cost_engine.py
index ed5c60ba..a624b6b7 100644
--- a/backend/app/utils/cost_engine.py
+++ b/backend/app/utils/cost_engine.py
@@ -11,7 +11,7 @@ from app.models import StandardCost, ActualCost, AbcActivity, AbcAllocation, KPI
 logger = logging.getLogger("cma.cost")
 
 ERP_API = "http://127.0.0.1:8300"
-ERP_KEY = os.environ.get("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
+ERP_KEY = os.environ.get("ERP_API_KEY", "")
 
 
 # ============================================================
diff --git a/backend/scripts/_do_all_tasks.py b/backend/scripts/_do_all_tasks.py
index d35a4daa..e69d258b 100644
--- a/backend/scripts/_do_all_tasks.py
+++ b/backend/scripts/_do_all_tasks.py
@@ -28,7 +28,7 @@ try:
     else:
         s = DataSourceConfig(name='ERP系统 - 博海网络', source_type='erp',
             api_endpoint='http://127.0.0.1:8300/api/v1',
-            api_key='erp-gateway-key-bhwl-2026', sync_type='batch', status='active')
+            api_key=os.getenv("ERP_API_KEY", ""), sync_type='batch', status='active')
         db.add(s); db.commit(); db.refresh(s)
         print(f"  [OK] 插入成功: id={s.id}")
     for r in db.query(DataSourceConfig).all():
diff --git a/backend/scripts/_full_task.py b/backend/scripts/_full_task.py
index 618a386c..ed8fd547 100644
--- a/backend/scripts/_full_task.py
+++ b/backend/scripts/_full_task.py
@@ -31,7 +31,7 @@ try:
             name='ERP系统 - 博海网络',
             source_type='erp',
             api_endpoint='http://127.0.0.1:8300/api/v1',
-            api_key='erp-gateway-key-bhwl-2026',
+            api_key=os.getenv("ERP_API_KEY", ""),
             sync_type='batch',
             status='active',
         )
diff --git a/backend/scripts/_run_all_tasks.py b/backend/scripts/_run_all_tasks.py
index 269a3917..d39979a1 100644
--- a/backend/scripts/_run_all_tasks.py
+++ b/backend/scripts/_run_all_tasks.py
@@ -35,7 +35,7 @@ try:
             name='ERP系统 - 博海网络',
             source_type='erp',
             api_endpoint='http://127.0.0.1:8300/api/v1',
-            api_key='erp-gateway-key-bhwl-2026',
+            api_key=os.getenv("ERP_API_KEY", ""),
             sync_type='batch',
             status='active',
         )
diff --git a/backend/scripts/_task14_complete.py b/backend/scripts/_task14_complete.py
index 18ca4c61..7c3339be 100644
--- a/backend/scripts/_task14_complete.py
+++ b/backend/scripts/_task14_complete.py
@@ -36,7 +36,7 @@ try:
             name='ERP系统 - 博海网络',
             source_type='erp',
             api_endpoint='http://127.0.0.1:8300/api/v1',
-            api_key='erp-gateway-key-bhwl-2026',
+            api_key=os.getenv("ERP_API_KEY", ""),
             sync_type='batch',
             status='active',
         )
diff --git a/backend/scripts/_task1_insert_source.py b/backend/scripts/_task1_insert_source.py
index 3c8d3065..b1da6124 100644
--- a/backend/scripts/_task1_insert_source.py
+++ b/backend/scripts/_task1_insert_source.py
@@ -25,7 +25,7 @@ try:
             name='ERP系统 - 博海网络',
             source_type='erp',
             api_endpoint='http://127.0.0.1:8300/api/v1',
-            api_key='erp-gateway-key-bhwl-2026',
+            api_key=os.getenv("ERP_API_KEY", ""),
             sync_type='batch',
             status='active',
         )
diff --git a/backend/scripts/collect_erp_schema.py b/backend/scripts/collect_erp_schema.py
index aa60ce92..b0fafa19 100644
--- a/backend/scripts/collect_erp_schema.py
+++ b/backend/scripts/collect_erp_schema.py
@@ -21,7 +21,7 @@ logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(me
 logger = logging.getLogger("erp_schema_collect")
 
 ERP_API_BASE = "http://127.0.0.1:8300/api/v1"
-ERP_API_KEY = os.getenv("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
+ERP_API_KEY = os.getenv("ERP_API_KEY", "")
 
 HEADERS = {
     "X-API-Key": ERP_API_KEY,
diff --git a/backend/scripts/collect_erp_schema_v2.py b/backend/scripts/collect_erp_schema_v2.py
index 44dabf18..81f62198 100644
--- a/backend/scripts/collect_erp_schema_v2.py
+++ b/backend/scripts/collect_erp_schema_v2.py
@@ -14,7 +14,7 @@ logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(me
 logger = logging.getLogger("erp_schema_v2")
 
 API_BASE = "http://127.0.0.1:8300/api/v1"
-API_KEY = os.getenv("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
+API_KEY = os.getenv("ERP_API_KEY", "")
 HEADERS = {"X-API-Key": API_KEY}
 
 
diff --git a/backend/scripts/erp_sync.py b/backend/scripts/erp_sync.py
index bf9110a9..91f939e0 100644
--- a/backend/scripts/erp_sync.py
+++ b/backend/scripts/erp_sync.py
@@ -28,7 +28,7 @@ logger = logging.getLogger("erp_sync")
 
 # ERP API 配置
 ERP_API_BASE = os.getenv("ERP_API_BASE", "http://127.0.0.1:8300/api/v1")
-ERP_API_KEY = os.getenv("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
+ERP_API_KEY = os.getenv("ERP_API_KEY", "")
 
 # 无DB会话时使用的静态映射（保底，使用真实KPI编码）
 # 对应 data_source_config 表的 active 端点（id=1,2,3,4）
diff --git a/backend/scripts/fix_erp_schema.py b/backend/scripts/fix_erp_schema.py
index 85d5a89e..7ba6528a 100644
--- a/backend/scripts/fix_erp_schema.py
+++ b/backend/scripts/fix_erp_schema.py
@@ -9,7 +9,7 @@ logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(me
 logger = logging.getLogger("schema_fix")
 
 API_BASE = "http://127.0.0.1:8300/api/v1"
-API_KEY = os.getenv("ERP_API_KEY", "erp-gateway-key-bhwl-2026")
+API_KEY = os.getenv("ERP_API_KEY", "")
 HEADERS = {"X-API-Key": API_KEY}
 
 def api_get(path):