As quantum computing techniques develop rapidly, the security of classical communication, which is usually based on public key encryption algorithm, is under great threat. Therefore, a key establishment method with physics base is demanding, especially for Internet of Things devices, where energy and computational power is quite limited. In this article, we present a flexible continuous-wave quantum cryptography scheme for Internet of Things systems. In this configuration, the IoT controller contains a narrow linewidth laser as a real local oscillator. Thus, it is capable of working as either a host or a client in quantum key distribution with remote servers, and efficiently generating quantum random numbers for quantum key distribution, as well as one time pad communication with deployed sensors. The security of the scheme is analyzed under the assumption of collective attacks in the asymptotic regime, and feasibility is theoretically verified with typical channel and commercial device parameters.