diff --git a/main.py b/main.py
index 40ee2fd..a1392af 100644
--- a/main.py
+++ b/main.py
@@ -34,7 +34,29 @@ from cards import CARDS
 
 API_BASE = os.getenv("MODELHUB_API_BASE", "https://www.modelhub.org.cn").rstrip("/")
 STRATEGY_ID = os.getenv("STRATEGY_ID", "")
-XC_TOKEN = os.getenv("XC_TOKEN") or os.getenv("EXTERNAL_SERVICE_TOKEN") or ""
+TOKEN_ENV_KEYS = ("XC_TOKEN", "EXTERNAL_SERVICE_TOKEN", "MODELHUB_TOKEN", "SERVICE_TOKEN",
+                  "XC_SERVICE_TOKEN", "API_TOKEN", "AGENT_TOKEN")
+TOKEN_FILE_CANDIDATES = ("/etc/xc/token", "/etc/modelhub/token", "/var/run/secrets/xc/token",
+                         "/var/run/secrets/modelhub/token", "/token", "/app/token")
+
+
+def _read_token() -> str:
+    for key in TOKEN_ENV_KEYS:
+        val = os.getenv(key, "").strip()
+        if val:
+            return val
+    for path in TOKEN_FILE_CANDIDATES:
+        try:
+            with open(path, "r", encoding="utf-8") as fh:
+                val = fh.read().strip()
+            if val:
+                return val
+        except Exception:
+            continue
+    return ""
+
+
+XC_TOKEN = _read_token()
 # 平台在 pod 内可能用不同方式鉴权：依次尝试 Xc-Token → Authorization: Bearer → 无鉴权
 AUTH_MODES = ("xctoken", "bearer", "none")
 AUTH_MODE = None  # 运行期探测到的可用方式
@@ -363,8 +385,27 @@ def _handle_signal(signum: int, _frame) -> None:
     STOP.set()
 
 
+def _diagnose() -> None:
+    """打印运行环境的令牌线索（脱敏），便于排查 401。"""
+    log("---- env diagnose ----")
+    for key in sorted(os.environ):
+        if any(k in key.upper() for k in ("TOKEN", "STRATEGY", "XC", "SECRET", "KEY", "PASS", "API")):
+            val = os.environ[key]
+            log(f"env {key} = {val[:6]}...(len={len(val)})")
+    log(f"resolved token: {'yes len=' + str(len(XC_TOKEN)) if XC_TOKEN else 'NO'}")
+    for path in TOKEN_FILE_CANDIDATES:
+        log(f"file {path} exists={os.path.exists(path)}")
+    for root in ("/var/run/secrets", "/etc/xc", "/etc/modelhub"):
+        try:
+            log(f"dir {root}: {os.listdir(root)[:10]}")
+        except Exception as exc:
+            log(f"dir {root}: {type(exc).__name__}")
+    log("---- env diagnose end ----")
+
+
 def main() -> None:
     signal.signal(signal.SIGTERM, _handle_signal)
+    _diagnose()
     signal.signal(signal.SIGINT, _handle_signal)
 
     thread = threading.Thread(target=worker, name="submit-worker", daemon=True)