diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
index 4adefdf..54a940e 100644
--- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
+++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
@@ -62,12 +62,17 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
         // 方式 2：PSK 签名
         String sig = request.getHeader(HEADER_SIGNATURE);
         String ts = request.getHeader(HEADER_TIMESTAMP);
-        if (sig != null && ts != null) {
+        String email = request.getHeader(HEADER_EMAIL);
+        if (sig != null && ts != null && email != null) {
             try {
                 if (pskService.verify(request.getMethod(), request.getRequestURI(),
                         Long.parseLong(ts), sig) != null) {
-                    request.setAttribute("accountId", 0L);
-                    request.setAttribute("trustLevel", com.par.core.enums.TrustLevel.TRUSTED);
+                    // X-Email 仅标识身份，不参与签名
+                    Account account = accountService.findByAnyEmail(email);
+                    request.setAttribute("accountId", account != null ? account.getId() : 0L);
+                    request.setAttribute("trustLevel", account != null ? account.getTrustLevel()
+                            : com.par.core.enums.TrustLevel.TRUSTED);
+                    request.setAttribute("authEmail", email);
                     return true;
                 }
             } catch (NumberFormatException ignored) {}