diff --git a/docs/deployment/deployment-cluster.md b/docs/deployment/deployment-cluster.md
index 024386c18297..f97ed9873a63 100644
--- a/docs/deployment/deployment-cluster.md
+++ b/docs/deployment/deployment-cluster.md
@@ -13,8 +13,8 @@ This article introduces how to deploy the `Shenyu` gateway in cluster environmen
 
 ### Environmental Preparation
 
-* Two or more Gateway Boostrap servers, these servers must install JDK1.8+.
-* A server for Gateway Admin, this server must install mysql/pgsql/h2 and JDK1.8+.
+* Two or more Gateway Boostrap servers, these servers must install JDK17+.
+* A server for Gateway Admin, this server must install mysql/pgsql/h2 and JDK17+.
 * A server for nginx.
 
 ### Start Apache ShenYu Admin
diff --git a/docs/deployment/deployment-quick.md b/docs/deployment/deployment-quick.md
index 039cc9f87375..462062901920 100644
--- a/docs/deployment/deployment-quick.md
+++ b/docs/deployment/deployment-quick.md
@@ -11,7 +11,7 @@ This article introduces how to quickly start the `Apache ShenYu` gateway in the
 
 ### Environmental preparation
 
-* Install JDK1.8+ locally
+* Install JDK17+ locally
 
 ### Start Apache ShenYu Bootstrap
 
diff --git a/docs/plugin-center/ai/ai-proxy.md b/docs/plugin-center/ai/ai-proxy.md
index 0fac205c90a1..98ee098a3eb6 100644
--- a/docs/plugin-center/ai/ai-proxy.md
+++ b/docs/plugin-center/ai/ai-proxy.md
@@ -54,3 +54,49 @@ curl --location --request POST 'http://localhost:9195/ai/proxy/v1/chat/completio
 ```
 
 ![](/img/shenyu/plugin/ai-proxy/ai-proxy-api.png)
+
+## API Key Management
+
+The aiProxy plugin supports managing proxy API keys through the ShenYu Admin interface. Each proxy API key is scoped to a specific Selector and maps to a real upstream API key.
+
+### Admin Endpoints
+
+Base path: `/selector/{selectorId}/ai-proxy-apikey`
+
+| Method | Path                                                    | Description                        | Permission                      |
+|--------|---------------------------------------------------------|------------------------------------|---------------------------------|
+| POST   | `/selector/{selectorId}/ai-proxy-apikey`                | Create a proxy API key mapping     | `system:aiProxyApiKey:add`      |
+| GET    | `/selector/{selectorId}/ai-proxy-apikey`                | List proxy API key mappings (paged) | `system:aiProxyApiKey:list`     |
+| PUT    | `/selector/{selectorId}/ai-proxy-apikey/{id}`           | Update a proxy API key mapping     | `system:aiProxyApiKey:edit`     |
+| POST   | `/selector/{selectorId}/ai-proxy-apikey/batchDelete`    | Batch delete mappings              | `system:aiProxyApiKey:delete`   |
+| POST   | `/selector/{selectorId}/ai-proxy-apikey/batchEnabled`   | Batch enable or disable mappings   | `system:aiProxyApiKey:disable`  |
+
+### Query Parameters (GET)
+
+| Parameter      | Required | Description                      |
+|----------------|----------|----------------------------------|
+| `currentPage`  | Yes      | Page number                      |
+| `pageSize`     | Yes      | Page size                        |
+| `proxyApiKey`  | No       | Filter by proxy API key value    |
+
+## Proxy API Key Authentication
+
+When `proxyEnabled` is set to `true` in the Selector configuration, the plugin enforces API key authentication on all incoming requests.
+
+### Request Header
+
+Clients must include the following header:
+
+```
+X-API-KEY: <proxy-api-key>
+```
+
+### Authentication Behavior
+
+| Scenario                                         | HTTP Status       | Description                                                                                          |
+|--------------------------------------------------|-------------------|------------------------------------------------------------------------------------------------------|
+| `X-API-KEY` header present and valid             | 200               | Request forwarded; real upstream API key substituted transparently                                   |
+| `X-API-KEY` header missing                       | 401 Unauthorized  | Request rejected                                                                                     |
+| `X-API-KEY` header present but invalid           | 401 Unauthorized  | Request rejected                                                                                     |
+
+> **Note:** When proxy mode is enabled, the real upstream API key is never exposed to the client. The plugin resolves the mapping internally and substitutes the real key before forwarding the request to the LLM provider.