diff --git a/app/mix/controller/init.go b/app/mix/controller/init.go
index e707c7dc..5a2f44e2 100644
--- a/app/mix/controller/init.go
+++ b/app/mix/controller/init.go
@@ -224,13 +224,13 @@ func Init(r *gin.Engine) {
 	apiZoneGroup.POST("list_by_mid", middleware.JSONParamValidator(zoneproto.ApiListByMidReq{}), middleware.JwtAuthenticator(), ApiGetZoneListByMid)
 	apiZoneGroup.POST("list_by_visitor_mid", middleware.JSONParamValidator(zoneproto.ApiListByVisitorMidReq{}), middleware.JwtAuthenticator(), ApiGetZoneListByVisitorMid)
 	apiZoneGroup.POST("list_by_user_id_from_outside", middleware.JSONParamValidator(zoneproto.ApiListByUserIdFromOutsideReq{}), ApiGetZoneListByUserIdFromOutside)
-	apiZoneGroup.POST("get_cashier", middleware.JSONParamValidator(vasproto.ZoneGetCashierReq{}), ZoneGetCashier)
-	apiZoneGroup.POST("create_order", middleware.JSONParamValidator(vasproto.ZoneCreateOrderReq{}), ZoneCreateOrder)
-	apiZoneGroup.POST("refund_page", middleware.JSONParamValidator(vasproto.ZoneRefundPageReq{}), ZoneRefundPage)
-	apiZoneGroup.POST("refund", middleware.JSONParamValidator(vasproto.ZoneRefundReq{}), ZoneRefund)
-	apiZoneGroup.POST("member_list", middleware.JSONParamValidator(vasproto.GetZoneMemberListReq{}), ZoneMemberList)
-	apiZoneGroup.POST("free_join", middleware.JSONParamValidator(vasproto.ZoneFreeJoinReq{}), ZoneFreeJoin)
-	apiZoneGroup.POST("exit", middleware.JSONParamValidator(vasproto.ZoneExitReq{}), ZoneExit)
+	apiZoneGroup.POST("get_cashier", middleware.JSONParamValidator(vasproto.ZoneGetCashierReq{}), middleware.JwtAuthenticator(), ZoneGetCashier)
+	apiZoneGroup.POST("create_order", middleware.JSONParamValidator(vasproto.ZoneCreateOrderReq{}), middleware.JwtAuthenticator(), ZoneCreateOrder)
+	apiZoneGroup.POST("refund_page", middleware.JSONParamValidator(vasproto.ZoneRefundPageReq{}), middleware.JwtAuthenticator(), ZoneRefundPage)
+	apiZoneGroup.POST("refund", middleware.JSONParamValidator(vasproto.ZoneRefundReq{}), middleware.JwtAuthenticator(), ZoneRefund)
+	apiZoneGroup.POST("member_list", middleware.JSONParamValidator(vasproto.GetZoneMemberListReq{}), middleware.JwtAuthenticator(), ZoneMemberList)
+	apiZoneGroup.POST("free_join", middleware.JSONParamValidator(vasproto.ZoneFreeJoinReq{}), middleware.JwtAuthenticator(), ZoneFreeJoin)
+	apiZoneGroup.POST("exit", middleware.JSONParamValidator(vasproto.ZoneExitReq{}), middleware.JwtAuthenticator(), ZoneExit)
 
 	// 私密圈动态
 	apiZoneMomentGroup := r.Group("/api/zone_moment", PrepareToC())
@@ -285,23 +285,23 @@ func Init(r *gin.Engine) {
 	vasPayGroup.POST("get_membership_product_list", middleware.JSONParamValidator(vasproto.GetMembershipProductListReq{}), GetMembershipProductList)
 	vasPayGroup.POST("create_order", middleware.JSONParamValidator(vasproto.CreateOrderReq{}), middleware.JwtAuthenticator(), CreateOrder)
 	vasPayGroup.POST("create_order_wx_pub", middleware.JSONParamValidator(vasproto.CreateOrderReq{}), CreateOrderWxPub)
-	vasPayGroup.POST("one_step_unlock", middleware.JSONParamValidator(vasproto.OneStepUnlockContactReq{}), OneStepUnlock)
-	vasPayGroup.POST("consumer_fill_contact", middleware.JSONParamValidator(vasproto.ConsumerFillContactReq{}), ConsumerFillContact)
-	vasPayGroup.POST("get_add_wechat_list", middleware.JSONParamValidator(vasproto.GetAddWechatListReq{}), GetAddWechatList)
-	vasPayGroup.POST("confirm_add_wechat", middleware.JSONParamValidator(vasproto.ConfirmAddWechatReq{}), ConfirmAddWechat)
-	vasPayGroup.POST("get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), GetUnlockWechatList)
-	vasPayGroup.POST("get_ch_list", middleware.JSONParamValidator(vasproto.GetCHListReq{}), GetCHList)
-	vasPayGroup.POST("update_wechat", middleware.JSONParamValidator(vasproto.UpdateWechatReq{}), UpdateWechat)
-	vasPayGroup.POST("query_wechat", middleware.JSONParamValidator(vasproto.QueryWechatReq{}), QueryWechat)
-	vasPayGroup.POST("h5_direct_unlock_wechat", middleware.JSONParamValidator(vasproto.H5DirectUnlockWechatReq{}), H5DirectUnlockWechat)
-	vasPayGroup.POST("h5_get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), GetUnlockWechatList)
+	vasPayGroup.POST("one_step_unlock", middleware.JSONParamValidator(vasproto.OneStepUnlockContactReq{}), middleware.JwtAuthenticator(), OneStepUnlock)
+	vasPayGroup.POST("consumer_fill_contact", middleware.JSONParamValidator(vasproto.ConsumerFillContactReq{}), middleware.JwtAuthenticator(), ConsumerFillContact)
+	vasPayGroup.POST("get_add_wechat_list", middleware.JSONParamValidator(vasproto.GetAddWechatListReq{}), middleware.JwtAuthenticator(), GetAddWechatList)
+	vasPayGroup.POST("confirm_add_wechat", middleware.JSONParamValidator(vasproto.ConfirmAddWechatReq{}), middleware.JwtAuthenticator(), ConfirmAddWechat)
+	vasPayGroup.POST("get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), middleware.JwtAuthenticator(), GetUnlockWechatList)
+	vasPayGroup.POST("get_ch_list", middleware.JSONParamValidator(vasproto.GetCHListReq{}), middleware.JwtAuthenticator(), GetCHList)
+	vasPayGroup.POST("update_wechat", middleware.JSONParamValidator(vasproto.UpdateWechatReq{}), middleware.JwtAuthenticator(), UpdateWechat)
+	vasPayGroup.POST("query_wechat", middleware.JSONParamValidator(vasproto.QueryWechatReq{}), middleware.JwtAuthenticator(), QueryWechat)
+	vasPayGroup.POST("h5_direct_unlock_wechat", middleware.JSONParamValidator(vasproto.H5DirectUnlockWechatReq{}), middleware.JwtAuthenticator(), H5DirectUnlockWechat)
+	vasPayGroup.POST("h5_get_unlock_wechat_list", middleware.JSONParamValidator(vasproto.GetUnlockWechatListReq{}), middleware.JwtAuthenticator(), GetUnlockWechatList)
 	vasPayGroup.POST("withdraw_page", middleware.JSONParamValidator(vasproto.WithdrawPageReq{}), middleware.JwtAuthenticator(), WithdrawPage)
-	vasPayGroup.POST("withdraw_send_verifycode", middleware.JSONParamValidator(vasproto.WithdrawSendVerifycodeReq{}), WithdrawSendVerifycode)
-	vasPayGroup.POST("withdraw_apply", middleware.JSONParamValidator(vasproto.WithdrawApplyReq{}), WithdrawApply)
+	vasPayGroup.POST("withdraw_send_verifycode", middleware.JSONParamValidator(vasproto.WithdrawSendVerifycodeReq{}), middleware.JwtAuthenticator(), WithdrawSendVerifycode)
+	vasPayGroup.POST("withdraw_apply", middleware.JSONParamValidator(vasproto.WithdrawApplyReq{}), middleware.JwtAuthenticator(), WithdrawApply)
 	vasPayGroup.POST("deal_one_coin_order", middleware.JSONParamValidator(vasproto.DealOneCoinOrderReq{}), DealOneCoinOrder)
 	vasPayGroup.POST("deal_one_order", middleware.JSONParamValidator(vasproto.DealOneOrderReq{}), DealOneOrder)
-	vasPayGroup.POST("moment_order_list", middleware.JSONParamValidator(vasproto.ZoneMomentOrderListReq{}), ZoneMomentOrderList)
-	vasPayGroup.POST("income_page", middleware.JSONParamValidator(vasproto.IncomePageReq{}), IncomePage)
+	vasPayGroup.POST("moment_order_list", middleware.JSONParamValidator(vasproto.ZoneMomentOrderListReq{}), middleware.JwtAuthenticator(), ZoneMomentOrderList)
+	vasPayGroup.POST("income_page", middleware.JSONParamValidator(vasproto.IncomePageReq{}), middleware.JwtAuthenticator(), IncomePage)
 
 	extVasPayGroup := r.Group("/ext/vas")
 	extVasPayGroup.POST("alipay_callback", AlipayCallback)