diff --git a/app/platforms/base.py b/app/platforms/base.py
index e53d702..73d8528 100644
--- a/app/platforms/base.py
+++ b/app/platforms/base.py
@@ -87,6 +87,12 @@ class TikHubClient:
                     )
                 time.sleep(2**attempt)
                 continue
+            if response.status_code == 401:
+                raise PlatformAPIError(
+                    "TikHub 鉴权失败，请检查 TIKHUB_API_KEY 是否有效",
+                    error_type="auth_error",
+                    status_code=response.status_code,
+                )
             if response.is_error:
                 raise PlatformAPIError(
                     f"External API returned HTTP {response.status_code}",
diff --git a/tests/unit/test_comment_pagination.py b/tests/unit/test_comment_pagination.py
index 2bf6179..f2df7b2 100644
--- a/tests/unit/test_comment_pagination.py
+++ b/tests/unit/test_comment_pagination.py
@@ -51,3 +51,17 @@ def test_tikhub_client_raises_structured_error_after_retries(monkeypatch):
     assert exc_info.value.status_code == 429
     assert "secret-token" not in str(exc_info.value)
     assert sleeps == [1, 2, 4]
+
+
+def test_tikhub_client_reports_401_as_auth_error_without_leaking_token():
+    transport = SequenceTransport([httpx.Response(401, json={"message": "Unauthorized"})])
+    http_client = httpx.Client(transport=httpx.MockTransport(transport))
+    client = TikHubClient(base_url="https://api.test", api_key="secret-token", http_client=http_client)
+
+    with pytest.raises(PlatformAPIError) as exc_info:
+        client.get("/demo")
+
+    assert exc_info.value.error_type == "auth_error"
+    assert exc_info.value.status_code == 401
+    assert str(exc_info.value) == "TikHub 鉴权失败，请检查 TIKHUB_API_KEY 是否有效"
+    assert "secret-token" not in str(exc_info.value)