diff --git a/Cargo.toml b/Cargo.toml
index ec35eebf..077359dd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -35,7 +35,7 @@ backon = "1.3.0"
 bytes = "1.9.0"
 bytesize = "1.3.0"
 chrono = { version = "0.4.39", features = ["serde"] }
-clap = { version = "4.5.27", features = ["derive"] }
+clap = { version = "4.5.27", features = ["derive","env"] }
 ecstore = { path = "./ecstore" }
 flatbuffers = "24.12.23"
 futures = "0.3.31"
diff --git a/rustfs/Cargo.toml b/rustfs/Cargo.toml
index 00d5d213..7c50d0f2 100644
--- a/rustfs/Cargo.toml
+++ b/rustfs/Cargo.toml
@@ -81,7 +81,7 @@ futures-util.workspace = true
 # uuid = { version = "1.8.0", features = ["v4", "fast-rng", "serde"] }
 ecstore = { path = "../ecstore" }
 s3s.workspace = true
-clap = { version = "4.5.27", features = ["derive"] }
+clap = { version = "4.5.27", features = ["derive","env"] }
 tracing-subscriber = { version = "0.3.19", features = ["env-filter", "time"] }
 hyper-util = { version = "0.1.10", features = [
     "tokio",
diff --git a/rustfs/src/config/mod.rs b/rustfs/src/config/mod.rs
index dd622620..406b211f 100644
--- a/rustfs/src/config/mod.rs
+++ b/rustfs/src/config/mod.rs
@@ -39,24 +39,24 @@ pub struct Opt {
     pub volumes: Vec<String>,
 
     /// bind to a specific ADDRESS:PORT, ADDRESS can be an IP or hostname
-    #[arg(long, default_value_t = format!("0.0.0.0:{}", DEFAULT_PORT))]
+    #[arg(long, default_value_t = format!("0.0.0.0:{}", DEFAULT_PORT), env = "RUSTFS_ADDRESS")]
     pub address: String,
 
     /// Access key used for authentication.
-    #[arg(long)]
-    pub access_key: Option<String>,
+    #[arg(long, default_value_t = DEFAULT_ACCESS_KEY.to_string(), env = "RUSTFS_ACCESS_KEY")]
+    pub access_key: String,
 
     /// Secret key used for authentication.
-    #[arg(long)]
-    pub secret_key: Option<String>,
+    #[arg(long, default_value_t = DEFAULT_SECRET_KEY.to_string(), env = "RUSTFS_SECRET_KEY")]
+    pub secret_key: String,
 
     /// Domain name used for virtual-hosted-style requests.
-    #[arg(long)]
+    #[arg(long, env = "RUSTFS_DOMAIN_NAME")]
     pub domain_name: Option<String>,
 
-    #[arg(long, default_value_t = false)]
+    #[arg(long, default_value_t = false, env = "RUSTFS_CONSOLE_ENABLE")]
     pub console_enable: bool,
 
-    #[arg(long, default_value_t = format!("0.0.0.0:{}", 0))]
+    #[arg(long, default_value_t = format!("127.0.0.1:{}", 0), env = "RUSTFS_CONSOLE_ADDRESS")]
     pub console_address: String,
 }
diff --git a/rustfs/src/main.rs b/rustfs/src/main.rs
index f259805e..a2ed4790 100644
--- a/rustfs/src/main.rs
+++ b/rustfs/src/main.rs
@@ -31,7 +31,7 @@ use iam::init_iam_sys;
 use protos::proto_gen::node_service::node_service_server::NodeServiceServer;
 use s3s::service::S3ServiceBuilder;
 use service::hybrid;
-use std::{io::IsTerminal, net::SocketAddr, str::FromStr};
+use std::{io::IsTerminal, net::SocketAddr};
 use tokio::net::TcpListener;
 use tonic::{metadata::MetadataValue, Request, Status};
 use tower_http::cors::CorsLayer;
@@ -92,17 +92,8 @@ async fn run(opt: config::Opt) -> Result<()> {
     debug!("server_address {}", &server_address);
 
     //设置AK和SK
-    //其中部份内容从config配置文件中读取
-    let mut access_key = String::from_str(config::DEFAULT_ACCESS_KEY).unwrap();
-    let mut secret_key = String::from_str(config::DEFAULT_SECRET_KEY).unwrap();
 
-    // Enable authentication
-    if let (Some(ak), Some(sk)) = (opt.access_key, opt.secret_key) {
-        access_key = ak;
-        secret_key = sk;
-    }
-
-    iam::init_global_action_cred(Some(access_key.clone()), Some(secret_key.clone())).unwrap();
+    iam::init_global_action_cred(Some(opt.access_key.clone()), Some(opt.secret_key.clone())).unwrap();
     set_global_rustfs_port(server_port);
 
     //监听地址,端口从参数中获取
@@ -139,8 +130,8 @@ async fn run(opt: config::Opt) -> Result<()> {
         let mut b = S3ServiceBuilder::new(store.clone());
 
         //显示info信息
-        info!("authentication is enabled {}, {}", &access_key, &secret_key);
-        b.set_auth(IAMAuth::new(access_key, secret_key));
+        info!("authentication is enabled {}, {}", &opt.access_key, &opt.secret_key);
+        b.set_auth(IAMAuth::new(opt.access_key, opt.secret_key));
 
         b.set_access(store.clone());