diff --git a/src/App.vue b/src/App.vue
index 0061fb1..94d09b5 100644
--- a/src/App.vue
+++ b/src/App.vue
@@ -47,9 +47,19 @@
 
 			if (code) {
 				// 有 code → 进入授权 Loading 页处理
-				// redirect_uri 已携带 device_id 和 action，回调时直接从 URL 取
-				const action = urlParams.get('action') || '';
-				const callbackDeviceId = urlParams.get('device_id') || deviceId || '';
+				// 从 state 中解析 device_id 和 action（OAuth 标准保证 state 原样回传）
+				let action = '';
+				let callbackDeviceId = deviceId || '';
+				try {
+					const stateStr = urlParams.get('state');
+					if (stateStr) {
+						const stateObj = JSON.parse(decodeURIComponent(stateStr));
+						action = stateObj.action || action;
+						callbackDeviceId = stateObj.device_id || callbackDeviceId;
+					}
+				} catch (_) {
+					// state 解析失败，忽略
+				}
 				let loadingUrl = '/pages/auth/loading?code=' + encodeURIComponent(code);
 				if (action) {
 					loadingUrl += '&action=' + action;
diff --git a/src/pages/auth/loading.vue b/src/pages/auth/loading.vue
index 41118ed..d7d52ed 100644
--- a/src/pages/auth/loading.vue
+++ b/src/pages/auth/loading.vue
@@ -87,13 +87,10 @@ export default {
       try {
         this.statusText = '正在获取授权...';
 
-        // 回调地址：基础地址 + device_id 参数（回调时保留）
-        let redirectUri = config.authRedirectUri || (
+        // 回调地址：必须与微信公众号后台注册地址一致，不能带自定义参数
+        const redirectUri = config.authRedirectUri || (
           window.location.origin.replace(/^http:/, 'https:') + window.location.pathname
         );
-        if (this.deviceId) {
-          redirectUri += (redirectUri.includes('?') ? '&' : '?') + 'device_id=' + encodeURIComponent(this.deviceId);
-        }
 
         // 使用 snsapi_base 静默授权，不弹窗
         const res = await gatewayGet('/api/v1/user/auth/url', {
@@ -104,8 +101,14 @@ export default {
 
         const data = res.data || {};
         if (data.code === 0 && data.data && data.data.auth_url) {
+          // 通过 state 传递 device_id（OAuth 标准保证 state 原样回传）
+          let authUrl = data.data.auth_url;
+          if (this.deviceId) {
+            const stateVal = encodeURIComponent(JSON.stringify({ device_id: this.deviceId }));
+            authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + stateVal;
+          }
           // 跳转微信授权页（静默，不弹窗）
-          window.location.href = data.data.auth_url;
+          window.location.href = authUrl;
         } else {
           uni.showToast({ title: data.message || '获取授权失败', icon: 'none' });
           setTimeout(() => this.goToScan(), 1500);
@@ -212,14 +215,10 @@ export default {
       try {
         this.statusText = '正在获取用户信息...';
 
-        // 回调地址：基础地址 + action + device_id 参数（回调时保留）
-        let redirectUri = config.authRedirectUri || (
+        // 回调地址：必须与微信公众号后台注册地址一致，不能带自定义参数
+        const redirectUri = config.authRedirectUri || (
           window.location.origin.replace(/^http:/, 'https:') + window.location.pathname
         );
-        redirectUri += (redirectUri.includes('?') ? '&' : '?') + 'action=userinfo';
-        if (this.deviceId) {
-          redirectUri += '&device_id=' + encodeURIComponent(this.deviceId);
-        }
 
         const res = await gatewayGet('/api/v1/user/auth/url', {
           app_no: appNo,
@@ -229,8 +228,15 @@ export default {
 
         const data = res.data || {};
         if (data.code === 0 && data.data && data.data.auth_url) {
+          // 通过 state 传递 action 和 device_id（OAuth 标准保证 state 原样回传）
+          const stateObj = { action: 'userinfo' };
+          if (this.deviceId) {
+            stateObj.device_id = this.deviceId;
+          }
+          let authUrl = data.data.auth_url;
+          authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + encodeURIComponent(JSON.stringify(stateObj));
           // 跳转微信授权页（弹窗确认）
-          window.location.href = data.data.auth_url;
+          window.location.href = authUrl;
         } else {
           uni.showToast({ title: data.message || '获取授权失败', icon: 'none' });
           setTimeout(() => this.goToHomeWithAction(), 1500);
diff --git a/src/pages/index/index.vue b/src/pages/index/index.vue
index d8435a2..9457f2a 100644
--- a/src/pages/index/index.vue
+++ b/src/pages/index/index.vue
@@ -325,14 +325,10 @@ export default {
       }
 
       try {
-        // 回调地址：基础地址 + action + device_id 参数（回调时保留）
-        let redirectUri = config.authRedirectUri || (
+        // 回调地址：必须与微信公众号后台注册地址一致，不能带自定义参数
+        const redirectUri = config.authRedirectUri || (
           window.location.origin.replace(/^http:/, 'https:') + window.location.pathname
         );
-        redirectUri += (redirectUri.includes('?') ? '&' : '?') + 'action=userinfo';
-        if (this.deviceId) {
-          redirectUri += '&device_id=' + encodeURIComponent(this.deviceId);
-        }
 
         // 获取非静默授权链接（会弹窗确认）
         const res = await gatewayGet('/api/v1/user/auth/url', {
@@ -343,8 +339,15 @@ export default {
 
         const data = res.data || {};
         if (data.code === 0 && data.data && data.data.auth_url) {
+          // 通过 state 传递 action 和 device_id（OAuth 标准保证 state 原样回传）
+          const stateObj = { action: 'userinfo' };
+          if (this.deviceId) {
+            stateObj.device_id = this.deviceId;
+          }
+          let authUrl = data.data.auth_url;
+          authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + encodeURIComponent(JSON.stringify(stateObj));
           // 跳转微信授权页（弹窗确认）
-          window.location.href = data.data.auth_url;
+          window.location.href = authUrl;
         } else {
           console.warn('[index] 获取授权链接失败:', data.message);
         }