diff --git a/README.md b/README.md
index a6229a5..553ae63 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@ Generated A2APack agent for a2a cloud blog API.
 - Source OpenAPI: https://blog.a2acloud.io/openapi.json
 - Generated operations: 6
 - Main skill: `auto`
+- Required setup: `BLOG_API_KEY`
 
 The generated code is intentionally editable. Tune prompts, operation
 grouping, auth names, and safety policy before publishing serious agents.
diff --git a/agent.py b/agent.py
index a7529b2..adefb28 100644
--- a/agent.py
+++ b/agent.py
@@ -29,7 +29,7 @@ DEFAULT_BASE_URL = "https://blog.a2acloud.io"
 OPERATIONS = json.loads("{\n  \"create_blog_post\": {\n    \"description\": \"Create a blog post\",\n    \"destructive\": true,\n    \"method\": \"POST\",\n    \"operation_id\": \"create_blog_post\",\n    \"parameters\": [],\n    \"path\": \"/api/posts\",\n    \"request_body\": {\n      \"$ref\": \"#/components/schemas/BlogPostInput\"\n    },\n    \"security\": [\n      {\n        \"bearerAuth\": []\n      },\n      {\n        \"apiKeyAuth\": []\n      }\n    ],\n    \"skill_name\": \"create_blog_post\",\n    \"summary\": \"Create a blog post\",\n    \"tags\": [\n      \"Posts\"\n    ]\n  },\n  \"delete_blog_post\": {\n    \"description\": \"Delete a post by slug\",\n    \"destructive\": true,\n    \"method\": \"DELETE\",\n    \"operation_id\": \"delete_blog_post\",\n    \"parameters\": [],\n    \"path\": \"/api/posts/{slug}\",\n    \"request_body\": null,\n    \"security\": [\n      {\n        \"bearerAuth\": []\n      },\n      {\n        \"apiKeyAuth\": []\n      }\n    ],\n    \"skill_name\": \"delete_blog_post\",\n    \"summary\": \"Delete a post by slug\",\n    \"tags\": [\n      \"Posts\"\n    ]\n  },\n  \"get_blog_health\": {\n    \"description\": \"Check blog service health\",\n    \"destructive\": false,\n    \"method\": \"GET\",\n    \"operation_id\": \"get_blog_health\",\n    \"parameters\": [],\n    \"path\": \"/api/healthz\",\n    \"request_body\": null,\n    \"security\": null,\n    \"skill_name\": \"get_blog_health\",\n    \"summary\": \"Check blog service health\",\n    \"tags\": [\n      \"Health\"\n    ]\n  },\n  \"get_blog_post\": {\n    \"description\": \"Returns a published post. Add `preview=1` to fetch drafts or future-dated posts; preview requests require either bearer auth or the `x-api-key` header.\",\n    \"destructive\": false,\n    \"method\": \"GET\",\n    \"operation_id\": \"get_blog_post\",\n    \"parameters\": [\n      {\n        \"description\": \"Set to `1` to bypass the public published-post filter. Requires authentication.\",\n        \"in\": \"query\",\n        \"name\": \"preview\",\n        \"required\": false,\n        \"schema\": {\n          \"enum\": [\n            \"1\"\n          ],\n          \"type\": \"string\"\n        }\n      }\n    ],\n    \"path\": \"/api/posts/{slug}\",\n    \"request_body\": null,\n    \"security\": [\n      {},\n      {\n        \"bearerAuth\": []\n      },\n      {\n        \"apiKeyAuth\": []\n      }\n    ],\n    \"skill_name\": \"get_blog_post\",\n    \"summary\": \"Get a post by slug\",\n    \"tags\": [\n      \"Posts\"\n    ]\n  },\n  \"list_blog_posts\": {\n    \"description\": \"Returns published posts by default. `status=all` and `status=draft` include draft content and require either bearer auth or the `x-api-key` header.\",\n    \"destructive\": false,\n    \"method\": \"GET\",\n    \"operation_id\": \"list_blog_posts\",\n    \"parameters\": [\n      {\n        \"description\": \"Use `published` or omit the parameter for public published posts. `all` and `draft` require authentication.\",\n        \"in\": \"query\",\n        \"name\": \"status\",\n        \"required\": false,\n        \"schema\": {\n          \"default\": \"published\",\n          \"enum\": [\n            \"published\",\n            \"draft\",\n            \"all\"\n          ],\n          \"type\": \"string\"\n        }\n      }\n    ],\n    \"path\": \"/api/posts\",\n    \"request_body\": null,\n    \"security\": [\n      {},\n      {\n        \"bearerAuth\": []\n      },\n      {\n        \"apiKeyAuth\": []\n      }\n    ],\n    \"skill_name\": \"list_blog_posts\",\n    \"summary\": \"List posts\",\n    \"tags\": [\n      \"Posts\"\n    ]\n  },\n  \"upsert_blog_post\": {\n    \"description\": \"Upsert a post by slug\",\n    \"destructive\": true,\n    \"method\": \"PUT\",\n    \"operation_id\": \"upsert_blog_post\",\n    \"parameters\": [],\n    \"path\": \"/api/posts/{slug}\",\n    \"request_body\": {\n      \"$ref\": \"#/components/schemas/BlogPostInput\"\n    },\n    \"security\": [\n      {\n        \"bearerAuth\": []\n      },\n      {\n        \"apiKeyAuth\": []\n      }\n    ],\n    \"skill_name\": \"upsert_blog_post\",\n    \"summary\": \"Upsert a post by slug\",\n    \"tags\": [\n      \"Posts\"\n    ]\n  }\n}")
 ROOT_SECURITY = json.loads("[]")
 SECURITY_SCHEMES = json.loads("{\n  \"apiKeyAuth\": {\n    \"description\": \"Use the configured `BLOG_API_KEY` value.\",\n    \"in\": \"header\",\n    \"name\": \"x-api-key\",\n    \"type\": \"apiKey\"\n  },\n  \"bearerAuth\": {\n    \"description\": \"Use `Authorization: Bearer $BLOG_API_KEY`.\",\n    \"scheme\": \"bearer\",\n    \"type\": \"http\"\n  }\n}")
-SECURITY_FIELDS = json.loads("{\n  \"apiKeyAuth\": {\n    \"field\": \"X_API_KEY\",\n    \"kind\": \"apiKey\",\n    \"location\": \"header\",\n    \"name\": \"x-api-key\"\n  },\n  \"bearerAuth\": {\n    \"field\": \"BEARERAUTH_TOKEN\",\n    \"kind\": \"http\",\n    \"scheme\": \"bearer\"\n  }\n}")
+SECURITY_FIELDS = json.loads("{\n  \"apiKeyAuth\": {\n    \"field\": \"BLOG_API_KEY\",\n    \"kind\": \"apiKey\",\n    \"location\": \"header\",\n    \"name\": \"x-api-key\"\n  },\n  \"bearerAuth\": {\n    \"field\": \"BLOG_API_KEY\",\n    \"kind\": \"http\",\n    \"scheme\": \"bearer\"\n  }\n}")
 
 
 class OperationInput(BaseModel):
@@ -46,8 +46,7 @@ class BlogOpenapiAgent(A2AAgent):
     version = "0.1.0"
     consumer_setup = ConsumerSetup.from_fields(
         ConsumerSetupField.config("OPENAPI_BASE_URL", label="API base URL", description="Override the default API server (https://blog.a2acloud.io).", required=False, input_type="url"),
-        ConsumerSetupField.secret("BEARERAUTH_TOKEN", label="bearerAuth bearer credential", description="Use `Authorization: Bearer $BLOG_API_KEY`.", required=False),
-        ConsumerSetupField.secret("X_API_KEY", label="apiKeyAuth API key", description="Use the configured `BLOG_API_KEY` value.", required=False),
+        ConsumerSetupField.secret("BLOG_API_KEY", label="Blog API key", description="Used as either `Authorization: Bearer $BLOG_API_KEY` or the `x-api-key` header.", required=True),
     )
     llm_provisioning = LLMProvisioning.PLATFORM
     pricing = Pricing(
@@ -343,7 +342,7 @@ class BlogOpenapiAgent(A2AAgent):
             value = parameters[name]
             location = param["in"]
             if location == "path":
-                path = path.replace(" + name + ", str(value))
+                path = path.replace("{" + name + "}", str(value))
             elif location == "query":
                 query[name] = value
             elif location == "header":
diff --git a/deploy/20-deployment.yaml b/deploy/20-deployment.yaml
index 71d7b1e..0390831 100644
--- a/deploy/20-deployment.yaml
+++ b/deploy/20-deployment.yaml
@@ -20,13 +20,13 @@ spec:
     spec:
       containers:
         - name: agent
-          image: registry.a2acloud.io/agents/blog-openapi-agent:16d7a5fc4ffc2f55fd08f3538905cabb75612d45
+          image: registry.a2acloud.io/agents/blog-openapi-agent:latest
           imagePullPolicy: Always
           env:
             - name: A2A_AGENT_IMAGE
-              value: registry.a2acloud.io/agents/blog-openapi-agent:16d7a5fc4ffc2f55fd08f3538905cabb75612d45
+              value: registry.a2acloud.io/agents/blog-openapi-agent:latest
             - name: A2A_RENDER_IMAGE
-              value: registry.a2acloud.io/agents/blog-openapi-agent:16d7a5fc4ffc2f55fd08f3538905cabb75612d45
+              value: registry.a2acloud.io/agents/blog-openapi-agent:latest
             - name: A2A_CP_URL
               value: "http://control-plane.control-plane.svc.cluster.local"
             - name: A2A_LOGIN_URL