diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
index 1ab603e..586bcce 100644
--- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
+++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
@@ -34,6 +34,8 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
     private static final String HEADER_SIGNATURE = "X-Signature";
     private static final String HEADER_TIMESTAMP = "X-Timestamp";
     private static final String HEADER_EMAIL = "X-Email";
+    /** 客户端安装 ID（PSK 模式下的提交者标识） */
+    private static final String HEADER_CLIENT_ID = "X-Client-Id";
 
     private static final long TOKEN_EXPIRY_HOURS = 24;
 
@@ -60,26 +62,21 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
             return false;
         }
 
-        // 方式 2：PSK 签名
+        // 方式 2：PSK 签名（无需账户，clientId 即身份）
         String sig = request.getHeader(HEADER_SIGNATURE);
         String ts = request.getHeader(HEADER_TIMESTAMP);
         if (sig != null && ts != null) {
             try {
                 if (pskService.verify(request.getMethod(), request.getRequestURI(),
                         Long.parseLong(ts), sig) != null) {
-                    // X-Email 支持多值，依次尝试匹配账户
-                    Account account = null;
-                    String matchedEmail = null;
-                    var emails = request.getHeaders(HEADER_EMAIL);
-                    while (emails != null && emails.hasMoreElements()) {
-                        String e = emails.nextElement();
-                        account = accountService.findByAnyEmail(e);
-                        if (account != null) { matchedEmail = e; break; }
+                    // clientId 作为提交者标识（优先 X-Client-Id，其次 X-Email）
+                    String clientId = request.getHeader(HEADER_CLIENT_ID);
+                    if (clientId == null || clientId.isBlank()) {
+                        clientId = request.getHeader(HEADER_EMAIL);
                     }
-                    request.setAttribute("accountId", account != null ? account.getId() : 0L);
-                    request.setAttribute("trustLevel", account != null ? account.getTrustLevel()
-                            : com.par.core.enums.TrustLevel.TRUSTED);
-                    request.setAttribute("authEmail", matchedEmail);
+                    request.setAttribute("accountId", 0L);
+                    request.setAttribute("trustLevel", com.par.core.enums.TrustLevel.TRUSTED);
+                    request.setAttribute("clientId", clientId);
                     return true;
                 }
             } catch (NumberFormatException ignored) {}