diff --git a/packages/client/src/composables/useSpeech.ts b/packages/client/src/composables/useSpeech.ts
index 7f20826..a335d0c 100644
--- a/packages/client/src/composables/useSpeech.ts
+++ b/packages/client/src/composables/useSpeech.ts
@@ -1,5 +1,6 @@
 import { ref, computed, onUnmounted } from 'vue'
 import { generateSpeech, playAudioBlob } from '@/api/hermes/tts'
+import { getApiKey } from '@/api/client'
 
 export interface SpeechOptions {
   lang?: string      // 语言 'zh-CN', 'en-US' 等
@@ -286,6 +287,10 @@ export function useSpeech() {
     }
     if (opts.apiKey) {
       headers['Authorization'] = `Bearer ${opts.apiKey}`
+    } else if (opts.baseUrl.startsWith('/')) {
+      // 本地代理请求自动附加 JWT
+      const jwt = getApiKey()
+      if (jwt) headers['Authorization'] = `Bearer ${jwt}`
     }
 
     try {
diff --git a/packages/server/src/routes/index.ts b/packages/server/src/routes/index.ts
index 84cf174..8e0e563 100644
--- a/packages/server/src/routes/index.ts
+++ b/packages/server/src/routes/index.ts
@@ -43,13 +43,13 @@ export function registerRoutes(app: any, authMiddleware: Array<(ctx: Context, ne
   app.use(healthRoutes.routes())
   app.use(webhookRoutes.routes())
   app.use(authPublicRoutes.routes())
-  app.use(ttsRoutes.routes())              // TTS proxy/generation — must be before auth
 
   // --- Auth middleware: all routes below require authentication ---
   authMiddleware.forEach((middleware) => app.use(middleware))
 
   // --- Protected routes (auth required) ---
   app.use(authProtectedRoutes.routes())
+  app.use(ttsRoutes.routes())
   app.use(uploadRoutes.routes())
   app.use(updateRoutes.routes())           // Must be before proxy (proxy catch-all matches everything)
   app.use(sessionRoutes.routes())