diff --git a/app/api/v1/card_keys.py b/app/api/v1/card_keys.py
index 032abe7..89b3511 100644
--- a/app/api/v1/card_keys.py
+++ b/app/api/v1/card_keys.py
@@ -2,7 +2,7 @@
 
 from fastapi import APIRouter
 
-from app.dependencies import CurrentUser, DbSession
+from app.dependencies import DbSession
 from app.schemas.card_key import CardKeyActivateRequest, CardKeyActivateResponse
 from app.schemas.common import ApiResponse
 from app.services import card_key_activate as activate_service
@@ -13,13 +13,12 @@ router = APIRouter(prefix="/card-keys", tags=["卡密"])
 @router.post("/activate", response_model=ApiResponse[CardKeyActivateResponse])
 async def activate_card_key(
     body: CardKeyActivateRequest,
-    current_user: CurrentUser,
     db: DbSession,
 ) -> ApiResponse[CardKeyActivateResponse]:
     try:
         data = await activate_service.activate_card_key(
             db,
-            user=current_user,
+            username=body.username,
             serial_number=body.serial_number,
         )
     except activate_service.CardKeyActivateError as exc:
diff --git a/app/schemas/card_key.py b/app/schemas/card_key.py
index 4d92ff0..74f6f28 100644
--- a/app/schemas/card_key.py
+++ b/app/schemas/card_key.py
@@ -7,8 +7,17 @@ CardKeyType = Literal["时长", "点数"]
 
 
 class CardKeyActivateRequest(BaseModel):
+    username: str = Field(min_length=1, max_length=64)
     serial_number: str = Field(min_length=1, max_length=64)
 
+    @field_validator("username")
+    @classmethod
+    def normalize_username(cls, value: str) -> str:
+        stripped = value.strip()
+        if not stripped:
+            raise ValueError("请输入用户名")
+        return stripped
+
     @field_validator("serial_number")
     @classmethod
     def normalize_serial(cls, value: str) -> str:
diff --git a/app/services/card_key_activate.py b/app/services/card_key_activate.py
index 3197699..1c2a68f 100644
--- a/app/services/card_key_activate.py
+++ b/app/services/card_key_activate.py
@@ -38,9 +38,13 @@ def _extend_vip_end_time(current: datetime | None, days: int) -> datetime:
 async def activate_card_key(
     db: AsyncSession,
     *,
-    user: User,
+    username: str,
     serial_number: str,
 ) -> CardKeyActivateResponse:
+    user = await db.scalar(select(User).where(User.username == username))
+    if user is None:
+        raise CardKeyActivateError("用户不存在")
+
     result = await db.execute(
         select(CardKey)
         .where(CardKey.serial_number == serial_number)