diff --git a/cypher-executor/src/routes/recipes.ts b/cypher-executor/src/routes/recipes.ts
index 511099f..6c0a776 100644
--- a/cypher-executor/src/routes/recipes.ts
+++ b/cypher-executor/src/routes/recipes.ts
@@ -209,6 +209,17 @@ recipesRouter.post('/auth-recipes', async (c) => {
   if (!body.required_secrets?.length) return c.json({ success: false, error: 'required_secrets 必填' }, 400);
   if (!body.inject) return c.json({ success: false, error: 'inject 必填' }, 400);
 
+  // help_url 一律必填（不分冷熱門服務）：每個 secret 都要留官方文件連結，
+  // 讓 AI/使用者不必猜該去哪設定、也不會搜到錯誤來源（壓測 §recipe 設定說明）。
+  const missingHelp = body.required_secrets.filter(s => !s.help_url || !/^https?:\/\//.test(s.help_url));
+  if (missingHelp.length > 0) {
+    return c.json({
+      success: false,
+      error: `每個 required_secret 必須有 help_url（官方文件連結，http(s)://）。缺：${missingHelp.map(s => s.key).join(', ')}`,
+      requires: 'help_url',
+    }, 400);
+  }
+
   const now = Date.now();
   const existing = await c.env.RECIPES.get(`auth_recipe:${service}`, 'json') as AuthRecipeDefinition | null;