diff --git a/par-api/src/main/java/com/par/api/controller/AuthController.java b/par-api/src/main/java/com/par/api/controller/AuthController.java
index fdf7a4a..c780733 100644
--- a/par-api/src/main/java/com/par/api/controller/AuthController.java
+++ b/par-api/src/main/java/com/par/api/controller/AuthController.java
@@ -106,7 +106,8 @@ public class AuthController {
         String sig = request.getHeader("X-Medibot-Signature");
         if (ts == null || sig == null) return false;
         try {
-            return pskService.verify(email, Long.parseLong(ts), sig) != null;
+            return pskService.verify(request.getMethod(), request.getRequestURI(),
+                    Long.parseLong(ts), sig) != null;
         } catch (NumberFormatException e) {
             return false;
         }
diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
index 1e6e70f..4adefdf 100644
--- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
+++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
@@ -62,10 +62,10 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
         // 方式 2：PSK 签名
         String sig = request.getHeader(HEADER_SIGNATURE);
         String ts = request.getHeader(HEADER_TIMESTAMP);
-        String email = request.getHeader(HEADER_EMAIL);
-        if (sig != null && ts != null && email != null) {
+        if (sig != null && ts != null) {
             try {
-                if (pskService.verify(email, Long.parseLong(ts), sig) != null) {
+                if (pskService.verify(request.getMethod(), request.getRequestURI(),
+                        Long.parseLong(ts), sig) != null) {
                     request.setAttribute("accountId", 0L);
                     request.setAttribute("trustLevel", com.par.core.enums.TrustLevel.TRUSTED);
                     return true;
diff --git a/par-core/src/main/java/com/par/core/service/PskService.java b/par-core/src/main/java/com/par/core/service/PskService.java
index 2614669..0d27518 100644
--- a/par-core/src/main/java/com/par/core/service/PskService.java
+++ b/par-core/src/main/java/com/par/core/service/PskService.java
@@ -84,16 +84,15 @@ public class PskService {
 
     /**
      * 使用所有活跃 PSK 逐一验证签名
-     * signContent = email + ":" + timestamp
-     * @return 匹配的 PSK 版本号，null 表示验证失败
+     * signContent = METHOD:path:timestamp
+     * @return "ok" 表示验证通过，null 表示失败
      */
-    public String verify(String email, long timestamp, String signature) {
+    public String verify(String method, String path, long timestamp, String signature) {
         long now = System.currentTimeMillis() / 1000;
         if (Math.abs(now - timestamp) > 300) return null; // 5 分钟窗口
-        String payload = email.toLowerCase().trim() + ":" + timestamp;
+        String payload = method.toUpperCase() + ":" + path + ":" + timestamp;
 
-        String[] secrets = getActiveSecrets();
-        for (String secret : secrets) {
+        for (String secret : getActiveSecrets()) {
             if (HmacUtil.verify(secret, payload, signature)) {
                 return "ok";
             }