diff --git a/src/sheep/api/user.ts b/src/sheep/api/user.ts
index f0d14de..28e736b 100644
--- a/src/sheep/api/user.ts
+++ b/src/sheep/api/user.ts
@@ -1,6 +1,7 @@
 import base64 from "base64-utf8"
 
 import request from "@/sheep/utils/request"
+import { encryption } from "../utils/encryption"
 
 // 将 Basic Auth 字符串提取为常量
 const BASIC_AUTH = "Basic " + base64.encode(import.meta.env.VITE_OAUTH2_APP_CLIENT)
@@ -48,21 +49,31 @@ export default {
 	// 账号密码登录
 	login: (params: any) => {
 		const { username, password, randomStr, code, grant_type, scope } = params
+		const encKey = import.meta.env.VITE_PWD_ENC_KEY
+		// 未配置密钥时只能明文（需与 auth 客户端 encFlag 一致）；或显式 VITE_OAUTH_PWD_PLAIN=true
+		const plainPwd = import.meta.env.VITE_OAUTH_PWD_PLAIN === "true" || !encKey
+		const pwdForWire = plainPwd ? password : encryption(password, encKey)
+		const query: Record<string, string> = {
+			username: username ?? "",
+			grant_type: grant_type ?? "",
+			scope: scope ?? "",
+		}
+		if (randomStr != null && String(randomStr) !== "") {
+			query.randomStr = String(randomStr)
+		}
+		if (code != null && String(code) !== "") {
+			query.code = String(code)
+		}
 		return request({
 			url: `/auth/oauth2/token`,
 			method: "POST",
-			params: {
-				username,
-				randomStr,
-				code,
-				grant_type,
-				scope,
-			},
-			data: { password },
+			params: query,
+			data: `password=${encodeURIComponent(pwdForWire)}`,
+			// data: `password=`+password,
 			header: {
 				skipToken: true,
 				Authorization: BASIC_AUTH,
-				"content-type": "application/x-www-form-urlencoded",
+				"Content-Type": "application/x-www-form-urlencoded",
 			},
 		})
 	},
@@ -112,7 +123,7 @@ export default {
 		}),
 
 	// 设备认证
-	verifyDevice: (data: { mobilePhone: string; code: string, deviceUniqueCode?: string }) =>
+	verifyDevice: (data: { mobilePhone: string; code: string; deviceUniqueCode?: string }) =>
 		request({
 			url: "/thirdparty/thirdPartyOAth2/mini-app/verify-device",
 			method: "POST",
@@ -120,7 +131,7 @@ export default {
 		}),
 
 	// 判断该设备是否被验证
-	isVerifyDevice: (data: { mobile: string; userId: string, uniqueCode?: string, deviceUniqueCode?: string }) =>
+	isVerifyDevice: (data: { mobile: string; userId: string; uniqueCode?: string; deviceUniqueCode?: string }) =>
 		request({
 			url: "/thirdparty/thirdPartyOAth2/is-verify-device",
 			method: "POST",
diff --git a/src/sheep/utils/encryption.ts b/src/sheep/utils/encryption.ts
new file mode 100644
index 0000000..ce6c2ec
--- /dev/null
+++ b/src/sheep/utils/encryption.ts
@@ -0,0 +1,15 @@
+import * as CryptoJS from "crypto-js"
+
+/**
+ *加密处理
+ */
+export function encryption(src: string, keyWord: string) {
+	const key = CryptoJS.enc.Utf8.parse(keyWord)
+	// 加密
+	var encrypted = CryptoJS.AES.encrypt(src, key, {
+		iv: key,
+		mode: CryptoJS.mode.CFB,
+		padding: CryptoJS.pad.NoPadding,
+	})
+	return encrypted.toString()
+}