diff --git a/server/src/lib/wxpay.js b/server/src/lib/wxpay.js
index a96ad03..1a9779c 100644
--- a/server/src/lib/wxpay.js
+++ b/server/src/lib/wxpay.js
@@ -11,9 +11,17 @@ function isConfigured() {
 let _cachedPrivateKey = null
 function getPrivateKey() {
   if (_cachedPrivateKey) return _cachedPrivateKey
-  if (config.wxpay.privateKey) { _cachedPrivateKey = config.wxpay.privateKey; return _cachedPrivateKey }
-  if (config.wxpay.privateKeyPath) { _cachedPrivateKey = fs.readFileSync(config.wxpay.privateKeyPath, 'utf8'); return _cachedPrivateKey }
-  throw new Error('WeChat Pay private key not configured')
+  let key = ''
+  if (config.wxpay.privateKey) {
+    key = config.wxpay.privateKey.replace(/\\n/g, '\n')
+  } else if (config.wxpay.privateKeyPath) {
+    key = fs.readFileSync(config.wxpay.privateKeyPath, 'utf8')
+  } else {
+    throw new Error('WeChat Pay private key not configured')
+  }
+  if (!key.includes('-----BEGIN')) throw new Error('Invalid private key format (missing PEM header)')
+  _cachedPrivateKey = key
+  return _cachedPrivateKey
 }
 
 function generateNonce() {