@@ -194,7 +194,7 @@ DDL 以 [src/db/schema.sql](src/db/schema.sql) 为准，共 14 张表，`SCHEMA_
 **管理台（Cookie + RBAC）**：凭证管理、API Key（含六项配额，超限 429 + `Retry-After`，判定异常一律放行并记 warning）、用量统计、月度账单、Playground、模型列表、用户管理、审计、告警、上游状态、任务与配置、服务端日志。**出口 IP 粘性**（`CREDENTIAL_PROXY_POOL`）：按凭证 id 稳定分配出口，推理与后台任务同出口。
 
 - 账号：`GET|POST /api/users`、`PATCH /api/users/{username}`、`PUT /api/users/{username}/policy`（用户级模型白名单 + 配额）、`POST /api/users/{username}/{disable|enable|reset-password}`（**无 DELETE**）；`POST /api/auth/password`；`GET|POST /api/auth/activate`；`GET /api/audit`。
-- 凭证运维：`GET|POST /api/credentials`（列表 / 新增）+ `DELETE /api/credentials/{id}`；动作端点 `checkin`（GET 查状态 / POST 执行）、`toggle`、`revive`、`probe`、`activity`、`pin`、`accounts/select`；`PUT /api/credentials/{id}/limits|tags`、`GET|POST /api/credentials/{id}/growth`、`GET /api/credentials/{id}/credit-events|checkin-events|accounts`。
+- 凭证运维：`GET|POST /api/credentials`（列表 / 新增）+ `DELETE /api/credentials/{id}`；动作端点 `checkin`（GET 查状态 / POST 执行）、`toggle`、`revive`、`probe`、`activity`、`pin`、`accounts/select`、`export`（单条 JSON 导出）；`PUT /api/credentials/{id}/limits|tags`、`GET|POST /api/credentials/{id}/growth`、`GET /api/credentials/{id}/credit-events|checkin-events|accounts`。
 - 模型：`GET /api/model-catalog`、`GET /api/models/availability`、`POST /api/models/probes/{probe,manual}`（`manual=on|off` 人工接管，优先于自动探活）。
 - 批量：`POST /api/credentials/batch`（`probe|toggle|checkin|revive`）。逐条隔离，响应 `{total, succeeded, failed, results[]}`；`toggle`/`revive` 落一条汇总审计。
 - 批量导入：`POST /api/credentials/batch-import`（`items[]`，≤100 条）。逐条校验，响应 `{created[], skipped[], failed[]}` 均带 `index`；同渠道内容完全一致去重；逐条审计 + 入队探测。
 
@@ -375,6 +375,7 @@ claude
 
 - **端点**：`POST /api/credentials/batch`，body `{action: "probe"|"toggle"|"checkin"|"revive", ids: [...], enabled?, force?}`。一次 ≤200 条，重复 id 去重。`force` 只对 `revive` 有效（见下）。
 - **批量导入**：`POST /api/credentials/batch-import`，body `{items: [{provider, credential, nickname?, tags?}]}`。一次 ≤100 条；逐条校验，坏条目只进 `failed`（带 `index` 与原因）；同渠道解密后内容完全一致视为重复，进 `skipped`。管理台凭证页「批量导入」支持粘贴 JSON 数组 / JSONL 或选文件。
+- **单条导出**：`GET /api/credentials/{id}/export` 返回与批量导入**同形**的 JSON（`provider` / `credential` / `nickname` / `tags`），可原样再导入。响应带 `Content-Disposition` 附件头与 `no-store`，内容是**明文凭证**——只对 admin/operator 开放，且落 `credential.export` 审计。管理台入口：凭证行「更多操作 → 导出凭证」。
 - **逐条隔离**：单条失败不影响其余。响应 `{action, total, succeeded, failed, results: [{id, ok, error?, detail?}]}`。
 - **签到失败是结果不是故障**：上游拒绝（账号被禁用 / 登录过期 / 限流）回 `ok=false` + 可读 `message`，不 500——否则管理台只弹「签到失败」，看不出真实原因。
 - **暂停是显式状态而非取反**：`toggle` 的 `enabled` 由请求体给出 → 操作条拆「暂停」/「取消暂停」两按钮。
 
@@ -16,9 +16,11 @@
 
 import httpx
 from fastapi import APIRouter, Depends
+from fastapi.responses import JSONResponse
 
 from ..audit.actions import (
     ACTION_CREDENTIAL_DELETE,
+    ACTION_CREDENTIAL_EXPORT,
     ACTION_CREDENTIAL_IMPORT,
     ACTION_CREDENTIAL_LIMITS,
     ACTION_CREDENTIAL_PIN,
@@ -630,6 +632,31 @@ async def checkin_events_history(credential_id: str, limit: int = 20,
             raise InvalidRequest("credential not found")
         return {"events": services.checkin_events.recent(credential_id, limit=limit)}
 
+    @router.get("/api/credentials/{credential_id}/export")
+    async def export_credential(credential_id: str,
+                                principal=Depends(principal_from_request)):
+        """单条凭证导出（JSON）：与「批量导入」的条目同形，可原样再导入。
+
+        导出**明文凭证**，因此只对 admin/operator 开放，并落一条
+        `credential.export` 审计（谁把哪个号的令牌带出了系统）。响应带
+        `Content-Disposition` 便于浏览器直接存文件，`no-store` 防中间层缓存。
+        """
+        require_operator(principal)
+        entry = services.credentials.export_entry(credential_id)
+        if entry is None:
+            raise InvalidRequest("credential not found")
+        services.audit.record(actor=principal.username,
+                              action=ACTION_CREDENTIAL_EXPORT,
+                              target=credential_id,
+                              detail=f"上游 {entry['provider']}")
+        logger.info("管理员 %s 导出凭证 %s（上游 %s）", principal.username,
+                    credential_id, entry["provider"])
+        return JSONResponse(entry, headers={
+            "Content-Disposition":
+                f'attachment; filename="coding2api-credential-{credential_id}.json"',
+            "Cache-Control": "no-store",
+        })
+
     @router.get("/api/credentials/{credential_id}/growth")
     async def growth_history(credential_id: str, limit: int = 20,
                              principal=Depends(principal_from_request)):
 
@@ -25,6 +25,7 @@
 ACTION_CREDENTIAL_SWITCH_ACCOUNT = "credential.switch_account"
 ACTION_CREDENTIAL_LIMITS = "credential.limits"
 ACTION_CREDENTIAL_TAGS = "credential.tags"
+ACTION_CREDENTIAL_EXPORT = "credential.export"
 ACTION_API_KEY_QUOTA = "api_key.quota"
 ACTION_API_KEY_CREATE = "api_key.create"
 ACTION_API_KEY_DELETE = "api_key.delete"
@@ -45,7 +46,7 @@
     ACTION_USER_PASSWORD_CHANGE, ACTION_USER_PASSWORD_RESET, ACTION_USER_DELETE,
     ACTION_CREDENTIAL_IMPORT, ACTION_CREDENTIAL_DELETE, ACTION_CREDENTIAL_TOGGLE,
     ACTION_CREDENTIAL_PIN, ACTION_CREDENTIAL_REVIVE, ACTION_CREDENTIAL_SWITCH_ACCOUNT,
-    ACTION_CREDENTIAL_LIMITS, ACTION_CREDENTIAL_TAGS,
+    ACTION_CREDENTIAL_LIMITS, ACTION_CREDENTIAL_TAGS, ACTION_CREDENTIAL_EXPORT,
     ACTION_USER_POLICY,
     ACTION_API_KEY_QUOTA,
     ACTION_API_KEY_CREATE, ACTION_API_KEY_DELETE,
@@ -78,6 +79,7 @@
     ACTION_CREDENTIAL_SWITCH_ACCOUNT: "切换账号",
     ACTION_CREDENTIAL_LIMITS: "设置限额",
     ACTION_CREDENTIAL_TAGS: "设置标签",
+    ACTION_CREDENTIAL_EXPORT: "导出凭证",
     ACTION_API_KEY_QUOTA: "设置 Key 配额",
     ACTION_API_KEY_CREATE: "创建 API Key",
     ACTION_API_KEY_DELETE: "删除 API Key",
 
@@ -716,6 +716,23 @@ def credential_data(self, credential_id: str) -> dict[str, Any] | None:
         plaintext = self._cipher.decrypt(row["data_enc"])
         return json.loads(plaintext.decode("utf-8"))
 
+    def export_entry(self, credential_id: str) -> dict[str, Any] | None:
+        """单条凭证导出：与 `POST /api/credentials` 的导入项同形，可原样再导入。
+
+        复用 `import_credential` 接受的结构（`provider` + `credential` +
+        `nickname` + `tags`），因此导出的文件既能备份，也能直接粘进「批量导入」。
+        解密失败照旧抛 `CredentialDecryptError`，与 `credential_data` 同一口径。
+        """
+        row = self._db.connect().execute(
+            "SELECT provider, nickname, tags, data_enc FROM credentials WHERE id = ?",
+            (credential_id,)).fetchone()
+        if row is None:
+            return None
+        plaintext = self._cipher.decrypt(row["data_enc"])
+        return {"provider": row["provider"], "nickname": row["nickname"],
+                "tags": tags_value(row["tags"]),
+                "credential": json.loads(plaintext.decode("utf-8"))}
+
     def nickname_of(self, credential_id: str) -> str | None:
         """单条凭证昵称（供实时流按需补名字，避免每事件拉整份列表）。
 
 
@@ -119,6 +119,33 @@ def test_credential_account_endpoints_unsupported_for_trae(admin_client):
                        json={"account_id": "a"}).status_code == 400
     assert client.get("/api/credentials/ghost/accounts").status_code == 400
 
+
+def test_credential_export_returns_importable_json_and_audits(admin_client):
+    """单条导出：与批量导入同形的明文条目 + 存文件头 + 审计留痕。"""
+    from src.audit.actions import ACTION_CREDENTIAL_EXPORT
+
+    app, client = admin_client
+    credential_id = app.state.credentials.add(
+        provider="codebuddy", credential_data={"bearer_token": "secret-token"},
+        nickname="主账号", tags=["团队", "备用"])
+    response = client.get(f"/api/credentials/{credential_id}/export")
+    assert response.status_code == 200
+    assert response.headers["cache-control"] == "no-store"
+    assert response.headers["content-disposition"].startswith("attachment;")
+    assert response.json() == {
+        "provider": "codebuddy", "nickname": "主账号", "tags": ["团队", "备用"],
+        "credential": {"bearer_token": "secret-token"},
+    }
+    rows = app.state.services.audit.query(action=ACTION_CREDENTIAL_EXPORT)
+    assert len(rows) == 1
+    assert rows[0]["actor"] == "root" and rows[0]["target"] == credential_id
+
+    assert client.get("/api/credentials/ghost/export").status_code == 400
+
+    # viewer 不能把令牌带出系统（与写操作同一道 require_operator）
+    client.cookies.set("coding2api_session", create_session_token("guest", SECRET))
+    assert client.get(f"/api/credentials/{credential_id}/export").status_code == 403
+
 def test_select_account_rejects_vanished_credential(admin_client):
     """provider 支持切换但持锁后凭证已消失 → 400，不拿 None 去打上游。"""
     app, client = admin_client
 
@@ -258,6 +258,23 @@ export const api = {
       method: "POST",
       ...json({ provider, credential, nickname }),
     }),
+  /** 单条凭证导出：返回 JSON 文件内容，页面触发下载（含明文令牌）。 */
+  exportCredential: async (id: string) => {
+    const response = await fetch(
+      `/api/credentials/${encodeURIComponent(id)}/export`,
+      { credentials: "same-origin" });
+    if (!response.ok) {
+      let message = `导出失败（HTTP ${response.status}）`;
+      try {
+        const body = await response.json();
+        if (body?.error?.message) message = body.error.message;
+      } catch {
+        // 非 JSON 错误体：保留 HTTP 状态提示
+      }
+      throw new ApiError(response.status, "export_failed", message);
+    }
+    return { blob: await response.blob() };
+  },
   // ---------------------------------------------------------------- 备份
   backups: () => request<BackupListResponse>("/api/backups"),
   createBackup: () =>
 
@@ -11,6 +11,7 @@ import {
   CircleCheck,
   Coins,
   Database,
+  Download,
   Flame,
   Gauge,
   HeartPulse,
@@ -331,6 +332,7 @@ interface Actions {
   checkinLog: (credential: Credential) => void;
   limits: (credential: Credential) => void;
   tags: (credential: Credential) => void;
+  export: (credential: Credential) => void;
 }
 
 export function CredentialsPage() {
@@ -735,6 +737,25 @@ export function CredentialsPage() {
     // 只开对话框；保存与刷新由对话框自己回调（见 CredentialLimitsDialog）
     limits: (credential) => setLimitsFor(credential.id),
     tags: (credential) => setTagsFor(credential.id),
+    // 单条导出：文件内容与「批量导入」的条目同形，可原样再导入。
+    export: (credential) =>
+      void (async () => {
+        try {
+          const { blob } = await api.exportCredential(credential.id);
+          const url = URL.createObjectURL(blob);
+          const anchor = document.createElement("a");
+          anchor.href = url;
+          anchor.download =
+            `coding2api-credential-${credential.provider}-${credential.id}.json`;
+          document.body.appendChild(anchor);
+          anchor.click();
+          anchor.remove();
+          URL.revokeObjectURL(url);
+          showNotice("已导出凭证 JSON（含明文令牌，请妥善保管）");
+        } catch (caught) {
+          showError(caught instanceof Error ? caught.message : "导出凭证失败");
+        }
+      })(),
   };
 
   if (isLoading) return <PageSkeleton variant="cards" />;
@@ -2000,6 +2021,12 @@ function Row({
                       <Tag className="size-4" />
                       {credential.tags.length ? "编辑标签" : "设置标签"}
                     </DropdownMenuItem>
+                    <DropdownMenuItem
+                      onSelect={() => actions.export(credential)}
+                      title="导出为 JSON（含明文令牌，可原样再导入；操作会记审计）"
+                    >
+                      <Download className="size-4" /> 导出凭证
+                    </DropdownMenuItem>
                     <DropdownMenuSeparator />
                     <DropdownMenuItem
                       onSelect={() => onConfirmDelete(credential.id)}
 
@@ -1,5 +1,5 @@
 import { screen, waitFor, within } from "@testing-library/react";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { CredentialsPage } from "../CredentialsPage";
 import {
   expandCredentialGroups, jsonResponse, makeCredential, renderPage, settle, userEvent,
@@ -27,6 +27,12 @@ async function openAddDialog() {
   await screen.findByTestId("add-credential-dialog");
 }
 
+// 导出用例会替换全局 URL（createObjectURL 在 jsdom 缺失）；不在用例末尾
+// 手动恢复的话，后续 describe 的 useSearchParams 会拿到残缺的 URL 构造器。
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
 describe("CredentialsPage", () => {
   beforeEach(() => {
     vi.unstubAllGlobals();
@@ -1706,6 +1712,36 @@ describe("CredentialsPage", () => {
     expect(screen.getByTestId("tags-cred_1")).toBeInTheDocument();
     expect(screen.getByTestId("credential-tag-filter")).toBeInTheDocument();
   });
+
+  it("导出凭证：请求 export 端点并落盘 JSON", async () => {
+    const blobs: string[] = [];
+    vi.stubGlobal("URL", {
+      ...URL,
+      createObjectURL: () => { blobs.push("blob"); return "blob:x"; },
+      revokeObjectURL: () => undefined,
+    });
+    const fetchSpy = mockFetch({
+      "/export": {
+        provider: "trae", nickname: "主账号", tags: ["生产"],
+        credential: { accessToken: "secret" },
+      },
+      "/api/credentials": listBody([makeCredential({ id: "cred_1", provider: "trae" })]),
+    });
+    renderPage(<CredentialsPage />, ADMIN);
+    await settle();
+    await expandCredentialGroups();
+
+    await userEvent.click(screen.getByTestId("actions-cred_1"));
+    await userEvent.click(screen.getByRole("menuitem", { name: "导出凭证" }));
+
+    await waitFor(() => {
+      expect(fetchSpy.mock.calls.some(([url]) =>
+        String(url).includes("/api/credentials/cred_1/export"))).toBe(true);
+    });
+    await waitFor(() => expect(blobs).toHaveLength(1));
+    expect(await screen.findByTestId("credentials-notice"))
+      .toHaveTextContent("已导出凭证 JSON");
+  });
 });