diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
new file mode 100644
index 0000000..a26354e
--- /dev/null
+++ b/.github/workflows/preview.yml
@@ -0,0 +1,129 @@
+name: Preview Deployment
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  pull_request_target:
+    types: [closed]
+
+jobs:
+  deploy-preview:
+    if: github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    name: Deploy Preview
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Build
+        run: cargo install -q worker-build && worker-build --release
+
+      - name: Deploy to Cloudflare Workers
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: deploy --name firefly-api-pr-${{ github.event.number }} --compatibility-date 2025-06-22
+          workingDirectory: '.'
+        env:
+          FIREFLY_API_AUTHN_TOKEN: ${{ secrets.FIREFLY_API_AUTHN_TOKEN }}
+          BILIBILI_SESSDATA: ${{ secrets.BILIBILI_SESSDATA }}
+          SPOTIFY_WEB_API_CLIENT_ID: ${{ secrets.SPOTIFY_WEB_API_CLIENT_ID }}
+          SPOTIFY_WEB_API_CLIENT_SECRET: ${{ secrets.SPOTIFY_WEB_API_CLIENT_SECRET }}
+          SPOTIFY_WEB_API_REDIRECT_URI: ${{ secrets.SPOTIFY_WEB_API_REDIRECT_URI }}
+      - name: Comment PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = context.issue.number;
+            const previewUrl = `https://firefly-api-pr-${prNumber}.eikasia30.workers.dev`;
+            
+            // Find existing preview comment
+            const comments = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+            
+            const botComment = comments.data.find(comment => 
+              comment.user.type === 'Bot' && 
+              comment.body.includes('🚀 Preview Deployment')
+            );
+            
+            const body = `🚀 **Preview Deployment**
+            
+            Your preview deployment is ready!
+            
+            **🔗 Preview URL:** ${previewUrl}
+            
+            This preview will be updated automatically when you push new commits to this PR.
+            
+            <sub>Deployed from commit: ${context.sha.substring(0, 7)}</sub>`;
+            
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: body
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body: body
+              });
+            }
+
+  cleanup-preview:
+    if: github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    name: Cleanup Preview
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Delete preview deployment
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: delete firefly-api-pr-${{ github.event.number }}
+        continue-on-error: true
+
+      - name: Comment PR cleanup
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = context.issue.number;
+            
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              body: `🧹 **Preview Cleaned Up**
+              
+              The preview deployment for this PR has been removed.`
+            });
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 1501d29..2ddbe86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,7 @@
 target
 node_modules
 .wrangler
-.dev.vars
\ No newline at end of file
+.dev.vars
+
+# test request json file
+request.json
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index 6d2cc79..e51f413 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -132,6 +132,7 @@ dependencies = [
  "pin-project-lite",
  "rustversion",
  "serde",
+ "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
  "sync_wrapper",
@@ -233,11 +234,34 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "bitflag"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beac6a55fd5b7b4f4e857cc74d09f8b3e7c063fe147a83e38a76773750fdb1b"
+dependencies = [
+ "bitflag-attr-macros",
+]
+
+[[package]]
+name = "bitflag-attr-macros"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b618aab4883d58a2d2ed1f59d8d9cb2c8c735588f873f4a4b7966626f3fdad50"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "bitflags"
 version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "block-buffer"
@@ -335,6 +359,15 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "deranged"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
+dependencies = [
+ "powerfmt",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -356,6 +389,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "dotenv"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -407,17 +446,29 @@ dependencies = [
  "axum 0.8.4",
  "axum-cloudflare-adapter",
  "base64",
+ "bitflag",
+ "bitflags",
  "console_error_panic_hook",
+ "dotenv",
  "futures",
  "http",
+ "instant",
+ "jiff",
+ "md5",
  "oneshot",
  "reqwest",
  "rspotify",
  "serde",
  "serde_json",
+ "serde_repr",
+ "time",
  "tower-service",
+ "tracing",
+ "tracing-subscriber",
+ "tracing-web",
  "wasm-bindgen-futures",
  "wasm-bindgen-test",
+ "web-sys",
  "worker",
 ]
 
@@ -871,6 +922,18 @@ dependencies = [
  "hashbrown",
 ]
 
+[[package]]
+name = "instant"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.11.0"
@@ -893,6 +956,47 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
+[[package]]
+name = "jiff"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49"
+dependencies = [
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1283705eb0a21404d2bfd6eef2a7593d240bc42a0bdb39db0ad6fa2ec026524"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.77"
@@ -903,6 +1007,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
 [[package]]
 name = "libc"
 version = "0.2.174"
@@ -950,6 +1060,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "md5"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae960838283323069879657ca3de837e9f7bbb4c7bf6ea7f1b290d5e9476d2e0"
+
 [[package]]
 name = "memchr"
 version = "2.7.5"
@@ -1009,6 +1125,22 @@ dependencies = [
  "tempfile",
 ]
 
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -1083,6 +1215,12 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.1"
@@ -1127,6 +1265,21 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
+[[package]]
+name = "portable-atomic"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
+dependencies = [
+ "portable-atomic",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.2"
@@ -1136,6 +1289,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.95"
@@ -1170,6 +1329,7 @@ dependencies = [
  "bytes",
  "encoding_rs",
  "futures-core",
+ "futures-util",
  "h2",
  "http",
  "http-body",
@@ -1191,12 +1351,14 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-native-tls",
+ "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+ "wasm-streams",
  "web-sys",
 ]
 
@@ -1441,6 +1603,17 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -1464,6 +1637,15 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -1631,6 +1813,47 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+dependencies = [
+ "deranged",
+ "itoa",
+ "js-sys",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+
+[[package]]
+name = "time-macros"
+version = "0.2.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.1"
@@ -1741,9 +1964,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
  "pin-project-lite",
+ "tracing-attributes",
  "tracing-core",
 ]
 
+[[package]]
+name = "tracing-attributes"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "tracing-core"
 version = "0.1.34"
@@ -1751,6 +1986,59 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
 dependencies = [
  "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-serde"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
+dependencies = [
+ "nu-ansi-term",
+ "serde",
+ "serde_json",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "time",
+ "tracing-core",
+ "tracing-log",
+ "tracing-serde",
+]
+
+[[package]]
+name = "tracing-web"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e6a141feebd51f8d91ebfd785af50fca223c570b86852166caa3b141defe7c"
+dependencies = [
+ "js-sys",
+ "tracing-core",
+ "tracing-subscriber",
+ "wasm-bindgen",
+ "web-sys",
 ]
 
 [[package]]
@@ -1794,6 +2082,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -1958,6 +2252,22 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.9"
@@ -1967,6 +2277,12 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.61.2"
diff --git a/Cargo.toml b/Cargo.toml
index 4cac1b0..3c76e65 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -20,7 +20,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 worker = { version = "0.5.0", features = ['http', 'axum'] }
-axum = { version = "0.8.4", default-features = false, features = ["macros", "query"] }
+axum = { version = "0.8.4", default-features = false, features = ["json", "macros", "query"] }
 tower-service = "0.3.3"
 console_error_panic_hook = { version = "0.1.7" }
 rspotify = "0.14.0"
@@ -28,12 +28,24 @@ serde = { version = "1.0.219", features = ["derive"] }
 axum-cloudflare-adapter = "0.14.0"
 wasm-bindgen-futures = "0.4.50"
 oneshot = "0.1.11"
-reqwest = { version = "0.12.22", features = ["json"] }
+reqwest = { version = "0.12.22", features = ["json", "stream"] }
 http = "1.3.1"
 serde_json = "1.0.140"
 anyhow = "1.0.98"
 base64 = "0.22.1"
 futures = "0.3.31"
+md5 = "0.8.0"
+dotenv = "0.15.0"
+bitflag = "0.10.1"
+bitflags = { version = "2.9.1", features = ["serde"] }
+instant = { version = "0.1.13", features = ["wasm-bindgen"] }
+serde_repr = "0.1.20"
+web-sys = "0.3.77"
+jiff = "0.2.15"
+tracing = "0.1.41"
+tracing-web = "0.1.3"
+tracing-subscriber = { version = "0.3.19", features = ["time", "json"] }
+time = { version = "0.3.41", features = ["wasm-bindgen"] }
 
 [dev-dependencies]
 wasm-bindgen-test = "0.3.50"
diff --git a/build.rs b/build.rs
new file mode 100644
index 0000000..dd80dce
--- /dev/null
+++ b/build.rs
@@ -0,0 +1,7 @@
+// build.rs
+fn main() {
+    println!("cargo::rustc-check-cfg=cfg(ci_build)");
+    if std::env::var("CI").is_ok() {
+        println!("cargo:rustc-cfg=ci_build");
+    }
+}
\ No newline at end of file
diff --git a/src/api/v1/bilibili/mod.rs b/src/api/v1/bilibili/mod.rs
new file mode 100644
index 0000000..b04b953
--- /dev/null
+++ b/src/api/v1/bilibili/mod.rs
@@ -0,0 +1 @@
+pub mod video;
diff --git a/src/api/v1/bilibili/video/download.rs b/src/api/v1/bilibili/video/download.rs
new file mode 100644
index 0000000..a69dee9
--- /dev/null
+++ b/src/api/v1/bilibili/video/download.rs
@@ -0,0 +1,301 @@
+use axum::extract::{Json, State};
+use axum_cloudflare_adapter::wasm_compat;
+use jiff::{tz::TimeZone, Timestamp};
+use serde::Deserialize;
+
+use crate::{api::v1::ApiV1Response, utils::bilibili::Credential, AppState};
+
+#[derive(Debug, Deserialize)]
+pub struct DownloadRequest {
+    bvid: String,
+    /// Authorization token. This API is admin-only.
+    token: String,
+}
+
+#[derive(Debug, serde::Serialize)]
+pub struct DownloadResponse {
+    /// Name of the cloudflare r2 bucket where the video is stored
+    bucket: String,
+    /// A list of downloaded audio files from the given video
+    audios: Vec<Audio>,
+}
+
+#[derive(Debug, serde::Serialize)]
+pub struct Audio {
+    /// key of the audio file in the cloudflare r2 bucket
+    object_key: String,
+    /// upload id of the audio file, for debugging
+    /// If the upload is already present, this will be empty.
+    upload_id: String,
+}
+
+/// Download a bilibili video content and upload to cloudflare r2
+#[wasm_compat]
+pub async fn download(
+    State(state): State<AppState>,
+    Json(request): Json<DownloadRequest>,
+) -> ApiV1Response {
+    use http::StatusCode;
+    use crate::utils::bilibili::{BiliClient, video_stream_url::FeatureValue};
+
+    let DownloadRequest { bvid, token } = request;
+
+    if token != state.env.env.var("FIREFLY_API_AUTHN_TOKEN").unwrap().to_string() {
+        return ApiV1Response::Error {
+            status: StatusCode::UNAUTHORIZED,
+            message: "Invalid token".to_string(),
+        };
+    }
+
+    let credential = match Credential::from_env(&state.env.env) {
+        Ok(credential) => credential,
+        Err(e) => {
+            tracing::error!(error = %e, "Failed to get credential");
+            return ApiV1Response::Error {
+                status: StatusCode::INTERNAL_SERVER_ERROR,
+                message: "Failed to get credential".to_string(),
+            };
+        }
+    };
+
+    let client = BiliClient::new(credential);
+
+    let info = match client.video_info(bvid.clone()).await {
+        Ok(info) => info,
+        Err(e) => {
+            tracing::error!(error = %e, "Failed to get video info");
+            return ApiV1Response::Error {
+                status: StatusCode::INTERNAL_SERVER_ERROR,
+                message: "Failed to get video info".to_string(),
+            };
+        }
+    };
+
+    let wbi_keys = match client.get_wbi_keys().await {
+        Ok(wbi_keys) => wbi_keys,
+        Err(e) => {
+            tracing::error!(error = %e, "Failed to get wbi keys");
+            return ApiV1Response::Error {
+                status: StatusCode::INTERNAL_SERVER_ERROR,
+                message: "Failed to get wbi keys".to_string(),
+            };
+        }
+    };
+
+    tracing::info!(
+        bvid = bvid.as_str(),
+        title = info.title.as_str(),
+        owner = info.owner.mid,
+        pubdate = info.pubdate,
+        pages = info.pages.len(),
+        "Start processing bvid {}", bvid
+    );
+
+    let pubdate = info.pubdate;
+    let ts = Timestamp::new(pubdate, 0).unwrap();
+    let tz = TimeZone::get("Asia/Shanghai").unwrap();
+    let zoned = ts.to_zoned(tz);
+    let year = zoned.year();
+    let month = zoned.month();
+    let day = zoned.day();
+
+    let bucket = state.env.env.bucket("firefly_bilibili").expect("Failed to get bucket");
+
+    let mut audios = Vec::new();
+    for (index, page) in info.pages.iter().enumerate() {
+        // Pages are 1-indexed
+        let index = index + 1;
+
+        let stream_url = match client.stream_url(wbi_keys.clone(), bvid.clone(), page.cid, FeatureValue::all_dash()).await {
+            Ok(stream_url) => stream_url,
+            Err(e) => {
+                tracing::error!(error = ?e, "Failed to get stream url");
+                return ApiV1Response::Error {
+                    status: StatusCode::INTERNAL_SERVER_ERROR,
+                    message: "Failed to get stream url".to_string(),
+                };
+            }
+        };
+
+        let Some(selected_audio) = stream_url.dash.audio.first() else { 
+            tracing::error!(page = ?page, "No audio found for page");
+            return ApiV1Response::Error {
+                status: StatusCode::INTERNAL_SERVER_ERROR,
+                message: "No audio found for page".to_string(),
+            };
+        };
+
+        let audio_base_url = selected_audio.base_url.clone();
+        // Get the audio file size
+        let audio_response = client.get(audio_base_url.clone()).header("Referer", "https://www.bilibili.com/").send().await.unwrap().error_for_status().unwrap();
+        let audio_size = audio_response.headers().get("Content-Length").unwrap().to_str().unwrap().parse::<u64>().unwrap();
+
+        // Key: audio/{mid}/{year}/{month}/{day}/{bvid}/{page}.mp4
+        let upload_key = format!("audio/{}/{}/{}/{}/{}/{}.mp4", info.owner.mid, year, month, day, bvid, index);
+
+        if let Ok(Some(object)) = bucket.get(&upload_key).execute().await {
+            tracing::info!(
+                bvid = bvid.as_str(),
+                page = index,
+                cid = page.cid,
+                "Audio already exists for BVID {}, page {}, cid {}", bvid, index, page.cid
+            );
+
+            audios.push(Audio {
+                object_key: object.key(),
+                upload_id: "".to_string(),
+            });
+
+            continue;
+        }
+
+        tracing::info!(
+            bvid = bvid.as_str(),
+            page = index,
+            cid = page.cid,
+            bandwidth = selected_audio.bandwidth,
+            codecs = selected_audio.codecs,
+            mime_type = selected_audio.mime_type,
+            base_url = audio_base_url.as_str(),
+            audio_size = audio_size,
+            upload_key = upload_key.as_str(),
+            "Start downloading audio for BVID {}, page {}, cid {}", bvid, index, page.cid
+        );
+
+        // Chunk the audio file into 20MB chunks
+        let multipart_upload = bucket.create_multipart_upload(upload_key.clone()).execute().await.expect("Failed to create multipart upload");
+        let upload_id = multipart_upload.upload_id().await;
+
+        let mut upload_futures = Vec::new();
+        for (idx, (start, end)) in (0..audio_size).step_by(20 * 1024 * 1024).map(|start| (start, (start + 20 * 1024 * 1024).min(audio_size - 1))).enumerate() {
+            // Cloudflare R2 multipart upload is 1-indexed
+            let idx = idx + 1;
+
+            // let cookie = client.cookie().to_string();
+            let audio_base_url = audio_base_url.clone();
+            let bucket = bucket.clone();
+            let upload_id = upload_id.clone();
+            let upload_key = upload_key.clone();
+            let cookie = client.cookie().to_string();
+
+            let upload_future = async move {
+                let length = end - start + 1;
+
+                // let response = match client.get(audio_base_url.clone()).header("Referer", "https://www.bilibili.com/").header("Range", &format!("bytes={}-{}", start, end)).send().await.expect("Failed to send request").error_for_status() {
+                //     Ok(response) => response,
+                //     Err(e) => {
+                //         tracing::error!(error = %e, "Failed to get audio chunk {}-{}", start, end - 1);
+                //         return Err(anyhow::anyhow!("Failed to get audio chunk {}-{}: {:?}", start, end - 1, e));
+                //     }
+                // };
+                // let stream = response.bytes_stream();
+
+                // Not sure why reqwest stream doesn't work. Got either Network Connection Lost or Failed to decode response body.
+                // So use worker::Fetch instead.
+                let mut request = worker::Request::new(&audio_base_url, worker::Method::Get).unwrap();
+                request.headers_mut().unwrap().set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36").unwrap();
+                request.headers_mut().unwrap().set("Cookie", &cookie).unwrap();
+                request.headers_mut().unwrap().set("Referer", "https://www.bilibili.com/").unwrap();
+                request.headers_mut().unwrap().set("Range", &format!("bytes={}-{}", start, end)).unwrap();
+
+                let mut response = worker::Fetch::Request(request).send().await.unwrap();
+                if response.status_code() != 206 {
+                    let body = response.text().await.unwrap();
+                    tracing::error!(
+                        status = response.status_code(),
+                        body = body.as_str(),
+                        "Failed to get audio chunk {}-{}", start, end - 1
+                    );
+                    return Err(anyhow::anyhow!("Failed to get audio chunk {}-{}: {:?}", start, end - 1, response.status_code()));
+                }
+
+                let stream = response.stream().unwrap();
+                let fstream = worker::FixedLengthStream::wrap(stream, length);
+
+                let multipart = bucket.resume_multipart_upload(upload_key, upload_id).expect("Failed to resume multipart upload");
+                let part = multipart.upload_part(idx as u16, fstream).await.expect("Failed to upload part");
+
+                tracing::info!(
+                    part_number = part.part_number(),
+                    part_size = length,
+                    etag = part.etag().as_str(),
+                    start = start,
+                    end = end,
+                    "Uploaded audio chunk {}-{}", start, end - 1
+                );
+
+                Ok(part)
+            };
+
+            upload_futures.push(upload_future);
+        }
+
+        let results = futures::future::join_all(upload_futures).await;
+        if let Some(Err(_)) = results.iter().find(|result| result.is_err()) {
+            multipart_upload.abort().await.expect("Failed to abort multipart upload");
+
+            return ApiV1Response::Error {
+                status: StatusCode::INTERNAL_SERVER_ERROR,
+                message: "Failed to upload audio chunk".to_string(),
+            };
+        }
+
+        let object = multipart_upload.complete(results.into_iter().map(|result| result.unwrap())).await.expect("Failed to complete multipart upload");
+
+        tracing::info!(
+            object_key = object.key().as_str(),
+            size = object.size(),
+            etag = object.etag().as_str(),
+            upload_date = %object.uploaded(),
+            checksum = ?object.checksum(),
+            "Uploaded audio for BVID {}, page {}, cid {}", bvid, index, page.cid
+        );
+
+        audios.push(Audio {
+            object_key: upload_key,
+            upload_id,
+        });
+    }
+
+    let response = DownloadResponse {
+        bucket: "firefly-bilibili".to_string(),
+        audios,
+    };
+
+    let s = serde_json::to_string(&response).unwrap();
+    ApiV1Response::Ok(s)
+}
+
+#[cfg(test)]
+mod tests {
+    use wasm_bindgen_test::{console_log, wasm_bindgen_test};
+
+    use crate::utils::bilibili::{must_test_client, video_stream_url::FeatureValue};
+
+    #[ignore = "Ignore test that needs network acccess"]
+    #[wasm_bindgen_test]
+    async fn test_get_audio_streaming_url() {
+        let client = must_test_client();
+        let wbi_keys = client.get_wbi_keys().await.unwrap();
+        let info = client.video_info("BV1kemrYmEAJ").await.unwrap();
+        for page in info.pages {
+            let stream_url = client
+                .stream_url(
+                    wbi_keys.clone(),
+                    "BV1kemrYmEAJ",
+                    page.cid,
+                    FeatureValue::all_dash(),
+                )
+                .await
+                .unwrap();
+            console_log!("{:?}", stream_url);
+            console_log!(
+                "Download audio from {:?}",
+                stream_url.dash.audio[0].base_url
+            );
+            let audio_url = stream_url.dash.audio[0].base_url.clone();
+            let audio_response = client.get(audio_url).header("Referer", "https://www.bilibili.com/").send().await.unwrap().error_for_status().unwrap();
+            console_log!("{:?}", audio_response.headers().get("Content-Length"));
+        }
+    }
+}
diff --git a/src/api/v1/bilibili/video/mod.rs b/src/api/v1/bilibili/video/mod.rs
new file mode 100644
index 0000000..3137393
--- /dev/null
+++ b/src/api/v1/bilibili/video/mod.rs
@@ -0,0 +1 @@
+pub mod download;
\ No newline at end of file
diff --git a/src/api/v1/mod.rs b/src/api/v1/mod.rs
index 8751da9..b2a3555 100644
--- a/src/api/v1/mod.rs
+++ b/src/api/v1/mod.rs
@@ -1,11 +1,12 @@
 mod artwork;
+mod bilibili;
 mod song;
 
 use axum::{
     body::Body,
     http::{HeaderValue, Response, StatusCode},
     response::{IntoResponse, Redirect},
-    routing::get,
+    routing::{get, post},
     Router,
 };
 
@@ -67,5 +68,6 @@ pub fn router(state: AppState) -> Router {
     Router::new()
         .route("/artwork", get(artwork::get_artwork))
         .route("/song/search", get(song::search_song))
+        .route("/bilibili/video/download", post(bilibili::video::download::download))
         .with_state(state)
 }
diff --git a/src/api/v1/song.rs b/src/api/v1/song.rs
index a0301f0..19ee1e5 100644
--- a/src/api/v1/song.rs
+++ b/src/api/v1/song.rs
@@ -76,11 +76,10 @@ async fn qq_music_search_song(query: SearchSongQuery) -> anyhow::Result<Songs> {
             HeaderValue::from_str("c.y.qq.com").expect("Failed to parse host"),
         );
 
-        let cli = reqwest::Client::builder()
+        reqwest::Client::builder()
             .default_headers(default_headers)
             .build()
-            .expect("Failed to build client");
-        cli
+            .expect("Failed to build client")
     };
 
     // First, we do a keyword search using the title
@@ -124,7 +123,7 @@ async fn qq_music_search_song(query: SearchSongQuery) -> anyhow::Result<Songs> {
     // Default to 5 segments.
     let segments = query.segments.unwrap_or(5) as usize;
 
-    for song_data in data.into_iter().take(len) {
+    for song_data in data.iter().take(len) {
         let title = song_data["songname"]
             .as_str()
             .ok_or_else(|| anyhow::anyhow!("Failed to parse song title"))?
diff --git a/src/lib.rs b/src/lib.rs
index 9404dbe..4baea17 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,9 +1,12 @@
 mod api;
+mod utils;
 
 use axum::Router;
 use axum_cloudflare_adapter::EnvWrapper;
 use http::HeaderValue;
 use tower_service::Service;
+use tracing_subscriber::{fmt::{format::Pretty, time::UtcTime}, layer::SubscriberExt, util::SubscriberInitExt as _};
+use tracing_web::{performance_layer, MakeConsoleWriter};
 use worker::*;
 
 #[derive(Clone)]
@@ -18,6 +21,16 @@ fn router(state: AppState) -> Router {
 #[event(start)]
 fn start() {
     console_error_panic_hook::set_once();
+
+    let fmt_layer = tracing_subscriber::fmt::layer()
+        .json()
+        .with_timer(UtcTime::rfc_3339())
+        .with_writer(MakeConsoleWriter);
+    let perf_layer = performance_layer().with_details_from_fields(Pretty::default());
+    tracing_subscriber::registry()
+        .with(fmt_layer)
+        .with(perf_layer)
+        .init();
 }
 
 #[event(fetch)]
@@ -26,19 +39,31 @@ async fn fetch(
     env: Env,
     _ctx: Context,
 ) -> Result<axum::http::Response<axum::body::Body>> {
-    let state = AppState {
-        env: EnvWrapper::new(env),
-    };
-
     if req.method() == "OPTIONS" {
+        // Allow all origins, methods, and headers
         let mut response = axum::http::Response::new(axum::body::Body::empty());
-        response.headers_mut().insert("Access-Control-Allow-Origin", HeaderValue::from_str("*").unwrap());
-        response.headers_mut().insert("Access-Control-Allow-Methods", HeaderValue::from_str("GET, POST, PUT, DELETE, OPTIONS").unwrap());
-        response.headers_mut().insert("Access-Control-Allow-Headers", HeaderValue::from_str("*").unwrap());
-        response.headers_mut().insert("Access-Control-Max-Age", HeaderValue::from_str("86400").unwrap());
+        response.headers_mut().insert(
+            "Access-Control-Allow-Origin",
+            HeaderValue::from_str("*").unwrap(),
+        );
+        response.headers_mut().insert(
+            "Access-Control-Allow-Methods",
+            HeaderValue::from_str("GET, POST, PUT, DELETE, OPTIONS").unwrap(),
+        );
+        response.headers_mut().insert(
+            "Access-Control-Allow-Headers",
+            HeaderValue::from_str("*").unwrap(),
+        );
+        response.headers_mut().insert(
+            "Access-Control-Max-Age",
+            HeaderValue::from_str("86400").unwrap(),
+        );
         return Ok(response);
     }
 
+    let state = AppState {
+        env: EnvWrapper::new(env),
+    };
 
     Ok(router(state).call(req).await?)
 }
diff --git a/src/utils/bilibili/mod.rs b/src/utils/bilibili/mod.rs
new file mode 100644
index 0000000..13fc60f
--- /dev/null
+++ b/src/utils/bilibili/mod.rs
@@ -0,0 +1,80 @@
+use std::ops::Deref;
+
+use worker::Env;
+
+pub mod video;
+pub mod video_stream_url;
+mod wbi;
+
+#[derive(Debug, Clone)]
+pub struct Credential {
+    cookie: String,
+}
+
+impl Credential {
+    #[cfg(test)]
+    pub fn new_for_test(sessdata: impl AsRef<str>) -> Self {
+        let cookie = format!("SESSDATA={}", sessdata.as_ref());
+        Self { cookie }
+    }
+
+    pub fn from_env(env: &Env) -> anyhow::Result<Self> {
+        let sessdata = env.var("BILIBILI_SESSDATA")?.to_string();
+        let cookie = format!("SESSDATA={}", sessdata);
+        Ok(Self { cookie })
+    }
+
+    pub fn cookie(&self) -> &str {
+        &self.cookie
+    }
+}
+
+#[derive(Debug, serde::Deserialize)]
+pub struct Response<T> {
+    pub code: i32,
+    pub message: Option<String>,
+    pub data: Option<T>,
+}
+
+#[derive(Debug, Clone)]
+pub struct BiliClient {
+    credential: Credential,
+    inner: reqwest::Client,
+}
+
+impl BiliClient {
+    pub fn new(credential: Credential) -> Self {
+        let mut default_headers = reqwest::header::HeaderMap::new();
+        default_headers.insert("Cookie", credential.cookie().parse().unwrap());
+        default_headers.insert("User-Agent", "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36".parse().unwrap());
+
+        let inner = reqwest::Client::builder()
+            .default_headers(default_headers)
+            .build()
+            .unwrap();
+
+        Self {
+            credential,
+            inner,
+        }
+    }
+
+    pub fn cookie(&self) -> &str {
+        self.credential.cookie()
+    }
+}
+
+impl Deref for BiliClient {
+    type Target = reqwest::Client;
+
+    fn deref(&self) -> &Self::Target {
+        &self.inner
+    }
+}
+
+#[cfg(test)]
+pub fn must_test_client() -> BiliClient {
+    let env = crate::utils::env();
+    let sessdata = env.get("BILIBILI_SESSDATA").expect("BILIBILI_SESSDATA is not set");
+    BiliClient::new(Credential::new_for_test(sessdata))
+}
\ No newline at end of file
diff --git a/src/utils/bilibili/video.rs b/src/utils/bilibili/video.rs
new file mode 100644
index 0000000..9f8c0df
--- /dev/null
+++ b/src/utils/bilibili/video.rs
@@ -0,0 +1,37 @@
+// https://github.com/SocialSisterYi/bilibili-API-collect/blob/e99f64c9b5c2bbd156e95ca254620378a22697f7/docs/video/info.md
+
+use crate::utils::bilibili::{BiliClient, Response};
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct VideoInfoData {
+    pub bvid: String,
+    pub title: String,
+    pub pubdate: i64,
+    pub pages: Vec<VideoPage>,
+    pub owner: VideoOwner,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct VideoPage {
+    pub cid: i64,
+    pub duration: i64,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct VideoOwner {
+    pub mid: i64,
+}
+
+impl BiliClient {
+    pub async fn video_info(&self, bvid: impl AsRef<str>) -> anyhow::Result<VideoInfoData> {
+        const URL: &str = "https://api.bilibili.com/x/web-interface/view";
+        let req = self.get(URL).query(&[("bvid", bvid.as_ref())]);
+        let res: Response<VideoInfoData> = req.send().await?.error_for_status()?.json().await?;
+
+        if res.code != 0 {
+            return Err(anyhow::anyhow!("Failed to get video info: code={}, message={}", res.code, res.message.unwrap_or_default()));
+        }
+
+        Ok(res.data.expect("No data in response"))
+    }
+}
\ No newline at end of file
diff --git a/src/utils/bilibili/video_stream_url.rs b/src/utils/bilibili/video_stream_url.rs
new file mode 100644
index 0000000..4d0e674
--- /dev/null
+++ b/src/utils/bilibili/video_stream_url.rs
@@ -0,0 +1,105 @@
+//! https://github.com/SocialSisterYi/bilibili-API-collect/blob/e99f64c9b5c2bbd156e95ca254620378a22697f7/docs/video/videostream_url.md
+
+use bitflags::bitflags;
+
+use crate::utils::bilibili::{wbi::encode_wbi, BiliClient, Response};
+
+#[derive(Debug, serde_repr::Deserialize_repr, PartialEq, Eq, PartialOrd, Ord, Clone, Copy)]
+#[repr(u32)]
+pub enum QualityCode {
+    P240 = 6,
+    P360 = 16,
+    P480 = 32,
+    P720 = 64,
+    P720HFR = 74,
+    P1080 = 80,
+    AiAugmented = 100,
+    P1080HBR = 112,
+    P1080HFR = 116,
+    P4K = 120,
+    Hdr = 125,
+    DolbyVision = 126,
+    P8K = 127,
+    #[serde(other)]
+    Unknown = 0,
+}
+
+bitflags! {
+    #[derive(Debug, serde::Deserialize, Default, Clone, Copy)]
+    pub struct FeatureValue: u32 {
+        const FLV = 0; // Deprecated
+        const MP4 = 1;
+        const DASH = 1 << 4; // 1 << 4 = 16
+        const HDR = 1 << 6; // 1 << 6 = 64
+        const P4k = 1 << 7; // 1 << 7 = 128
+        const DolbyAudio = 1 << 8; // 1 << 8 = 256
+        const DolbyVision = 1 << 9; // 1 << 9 = 512
+        const P8k = 1 << 10; // 1 << 10 = 1024
+        const AV1 = 1 << 11; // 1 << 11 = 2048
+    }
+}
+
+impl FeatureValue {
+    pub fn all_dash() -> Self {
+        // 4048
+        Self::DASH | Self::DolbyAudio | Self::DolbyVision | Self::P4k | Self::P8k | Self::AV1
+    }
+}
+
+#[cfg(test)]
+#[test]
+fn test_all_dash() {
+    assert_eq!(FeatureValue::all_dash().bits(), 4048);
+}
+
+#[derive(Debug, serde::Deserialize)]
+pub struct VideostreamUrlData {
+    // pub quality: QualityCode,
+    pub dash: Dash,
+}
+
+#[derive(Debug, serde::Deserialize)]
+pub struct Dash {
+    #[serde(default)]
+    pub audio: Vec<DashAudio>,
+}
+
+#[derive(Debug, serde::Deserialize)]
+pub struct DashAudio {
+    // pub id: i64,
+    pub base_url: String,
+    pub bandwidth: u32,
+    pub codecs: String,
+    pub mime_type: String,
+}
+
+impl BiliClient {
+    pub async fn stream_url(
+        &self,
+        wbi_keys: (String, String),
+        bvid: impl AsRef<str>,
+        cid: i64,
+        fnval: FeatureValue,
+    ) -> anyhow::Result<VideostreamUrlData> {
+        const URL: &str = "https://api.bilibili.com/x/player/wbi/playurl";
+
+        let params = vec![
+            ("bvid", bvid.as_ref().to_string()),
+            ("cid", cid.to_string()),
+            ("fnval", fnval.bits().to_string()),
+        ];
+
+        let wbi_encoded_params = encode_wbi(params, wbi_keys);
+
+        let url = format!("{}?{}", URL, wbi_encoded_params);
+        let req = self.get(url);
+
+        let res: Response<VideostreamUrlData> = req.send().await?.error_for_status()?.json().await?;
+
+        if res.code != 0 {
+            return Err(anyhow::anyhow!("Failed to get stream url: code={}, message={}", res.code, res.message.unwrap_or_default()));
+        }
+
+        Ok(res.data.expect("No data in response"))
+    }
+}
diff --git a/src/utils/bilibili/wbi.rs b/src/utils/bilibili/wbi.rs
new file mode 100644
index 0000000..b16a960
--- /dev/null
+++ b/src/utils/bilibili/wbi.rs
@@ -0,0 +1,175 @@
+//! https://github.com/SocialSisterYi/bilibili-API-collect/blob/e99f64c9b5c2bbd156e95ca254620378a22697f7/docs/misc/sign/wbi.md#rust
+
+use crate::utils::bilibili::BiliClient;
+use serde::Deserialize;
+use instant::{SystemTime};
+
+impl BiliClient {
+    pub async fn get_wbi_keys(&self) -> Result<(String, String), reqwest::Error> {
+        // let ResWbi {
+        //     data: Data { wbi_img },
+        // } = self
+        //     .get("https://api.bilibili.com/x/web-interface/nav")
+        //     .header("Referer", "https://www.bilibili.com/")
+        //     .send()
+        //     .await?
+        //     .error_for_status()?
+        //     .json::<ResWbi>()
+        //     .await?;
+
+        let resp = self
+            .get("https://api.bilibili.com/x/web-interface/nav")
+            .header("Referer", "https://www.bilibili.com/")
+            .send()
+            .await?;
+            // .error_for_status()?
+            // .text()
+            // .await?;
+
+        let body = resp.text().await?;
+        tracing::info!("wbi body: {}", body);
+
+        let ResWbi {
+            data: Data { wbi_img },
+        } = serde_json::from_str(&body).unwrap();
+
+        Ok((
+            take_filename(wbi_img.img_url).unwrap(),
+            take_filename(wbi_img.sub_url).unwrap(),
+        ))
+    }
+}
+
+// 为请求参数进行 wbi 签名
+pub fn encode_wbi(params: Vec<(&str, String)>, (img_key, sub_key): (String, String)) -> String {
+    let cur_time = match SystemTime::now().duration_since(SystemTime::UNIX_EPOCH) {
+        Ok(t) => t.as_secs(),
+        Err(_) => panic!("SystemTime before UNIX EPOCH!"),
+    };
+    _encode_wbi(params, (img_key, sub_key), cur_time)
+}
+
+const MIXIN_KEY_ENC_TAB: [usize; 64] = [
+    46, 47, 18, 2, 53, 8, 23, 32, 15, 50, 10, 31, 58, 3, 45, 35, 27, 43, 5, 49, 33, 9, 42, 19, 29,
+    28, 14, 39, 12, 38, 41, 13, 37, 48, 7, 16, 24, 55, 40, 61, 26, 17, 0, 1, 60, 51, 30, 4, 22, 25,
+    54, 21, 56, 59, 6, 63, 57, 62, 11, 36, 20, 34, 44, 52,
+];
+
+#[derive(Deserialize)]
+struct WbiImg {
+    img_url: String,
+    sub_url: String,
+}
+
+#[derive(Deserialize)]
+struct Data {
+    wbi_img: WbiImg,
+}
+
+#[derive(Deserialize)]
+struct ResWbi {
+    data: Data,
+}
+
+// 对 imgKey 和 subKey 进行字符顺序打乱编码
+fn get_mixin_key(orig: &[u8]) -> String {
+    MIXIN_KEY_ENC_TAB
+        .iter()
+        .take(32)
+        .map(|&i| orig[i] as char)
+        .collect::<String>()
+}
+
+fn get_url_encoded(s: &str) -> String {
+    s.chars()
+        .filter_map(|c| match c.is_ascii_alphanumeric() || "-_.~".contains(c) {
+            true => Some(c.to_string()),
+            false => {
+                // 过滤 value 中的 "!'()*" 字符
+                if "!'()*".contains(c) {
+                    return None;
+                }
+                let encoded = c
+                    .encode_utf8(&mut [0; 4])
+                    .bytes()
+                    .fold("".to_string(), |acc, b| acc + &format!("%{:02X}", b));
+                Some(encoded)
+            }
+        })
+        .collect::<String>()
+}
+
+fn _encode_wbi(
+    mut params: Vec<(&str, String)>,
+    (img_key, sub_key): (String, String),
+    timestamp: u64,
+) -> String {
+    let mixin_key = get_mixin_key((img_key + &sub_key).as_bytes());
+    // 添加当前时间戳
+    params.push(("wts", timestamp.to_string()));
+    // 重新排序
+    params.sort_by(|a, b| a.0.cmp(b.0));
+    // 拼接参数
+    let query = params
+        .iter()
+        .map(|(k, v)| format!("{}={}", get_url_encoded(k), get_url_encoded(v)))
+        .collect::<Vec<_>>()
+        .join("&");
+    // 计算签名
+    let web_sign = format!("{:?}", md5::compute(query.clone() + &mixin_key));
+    // 返回最终的 query
+    query + &format!("&w_rid={}", web_sign)
+}
+
+fn take_filename(url: String) -> Option<String> {
+    url.rsplit_once('/')
+        .and_then(|(_, s)| s.rsplit_once('.'))
+        .map(|(s, _)| s.to_string())
+}
+
+// 取自文档描述的测试用例
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_get_filename() {
+        assert_eq!(
+            take_filename(
+                "https://i0.hdslb.com/bfs/wbi/7cd084941338484aae1ad9425b84077c.png".to_string()
+            ),
+            Some("7cd084941338484aae1ad9425b84077c".to_string())
+        );
+    }
+
+    #[test]
+    fn test_get_mixin_key() {
+        let concat_key =
+            "7cd084941338484aae1ad9425b84077c".to_string() + "4932caff0ff746eab6f01bf08b70ac45";
+        assert_eq!(
+            get_mixin_key(concat_key.as_bytes()),
+            "ea1db124af3c7062474693fa704f4ff8"
+        );
+    }
+
+    #[test]
+    fn test_encode_wbi() {
+        let params = vec![
+            ("foo", String::from("114")),
+            ("bar", String::from("514")),
+            ("zab", String::from("1919810")),
+        ];
+        assert_eq!(
+            _encode_wbi(
+                params,
+                (
+                    "7cd084941338484aae1ad9425b84077c".to_string(),
+                    "4932caff0ff746eab6f01bf08b70ac45".to_string()
+                ),
+                1702204169
+            ),
+            "bar=514&foo=114&wts=1702204169&zab=1919810&w_rid=8f6f2b5b3d485fe1886cec6a0be8c5d4"
+                .to_string()
+        )
+    }
+}
diff --git a/src/utils/mod.rs b/src/utils/mod.rs
new file mode 100644
index 0000000..85b5dab
--- /dev/null
+++ b/src/utils/mod.rs
@@ -0,0 +1,15 @@
+pub mod bilibili;
+
+#[cfg(test)]
+pub fn env() -> std::collections::HashMap<String, String> {
+    // Wasm32 has no filesystem access support. Embed the .dev.vars file into the test binary.
+    #[cfg(not(ci_build))]
+    let env = include_str!("../../.dev.vars");
+    #[cfg(ci_build)]
+    let env = "";
+
+    env.lines().map(|line| {
+        let (key, value) = line.split_once('=').unwrap();
+        (key.to_string(), value.to_string())
+    }).collect()
+}
\ No newline at end of file
diff --git a/wrangler.toml b/wrangler.toml
index dc47450..23f9399 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -3,4 +3,8 @@ main = "build/worker/shim.mjs"
 compatibility_date = "2025-06-22"
 
 [build]
-command = "cargo install -q worker-build && worker-build --release"
\ No newline at end of file
+command = "cargo install -q worker-build && worker-build --release"
+
+[[r2_buckets]]
+bucket_name = "firefly-bilibili"
+binding = "firefly_bilibili"