diff --git a/yuthon_hr_attendance/controllers/applet_attendance.py b/yuthon_hr_attendance/controllers/applet_attendance.py
index c606a2361..da3103d48 100644
--- a/yuthon_hr_attendance/controllers/applet_attendance.py
+++ b/yuthon_hr_attendance/controllers/applet_attendance.py
@@ -6,6 +6,7 @@ from datetime import datetime, date
 import logging
 from geopy.distance import geodesic
 from datetime import timedelta
+from ..until import base
 import json
 import requests
 
@@ -56,17 +57,22 @@ class AppletAttendance(Controller):
             return json.dumps(return_data)
 
         user_id = request.env['res.users'].sudo().browse(uid)
+        # 创建token
+        token = base.set_token(user_id.id, user_id.name)
         employee_id = user_id.with_company(user_id.company_id.id).employee_id
         applet_security_setting_ids = request.env['applet.security'].search(
             [('employee_id', '=', employee_id.id)]).applet_security_setting_ids
         access_list = [access.name for access in applet_security_setting_ids]
         # 查询一下用户的手机号phone, 承租人关联的
 
-        data = {'name': employee_id.name, 'id': user_id.id, 'access': access_list, 'phone': employee_id.mobile_phone}
+        data = {'name': employee_id.name, 'id': user_id.id, 'access': access_list, 'phone': employee_id.mobile_phone, 'token': token}
         _logger.info(f"接口人{employee_id.name}权限{access_list}__用户id: {user_id}________")
         return_data = {'data': data, 'code': 200, 'message': ''}
         return json.dumps(return_data)
 
+    # 验证token就在url下面加这个装饰器
+    # @base.authorize
+
     @route('/yuthon/att/today', methods=['POST'], type='http', auth='none', cors='*', csrf=False)
     def apple_yuthon_att_today(self, **kw):
         """
diff --git a/yuthon_hr_attendance/until/base.py b/yuthon_hr_attendance/until/base.py
new file mode 100644
index 000000000..a06f6a303
--- /dev/null
+++ b/yuthon_hr_attendance/until/base.py
@@ -0,0 +1,72 @@
+import datetime
+import functools
+import hashlib
+import jwt
+import logging
+from odoo.http import request
+
+
+def logutils():
+    # 创建日志的记录等级
+    logger = logging.getLogger(__name__)
+    logger.setLevel(logging.INFO)
+    return logger
+
+
+_logging = logutils()
+
+
+def set_token(user_id, user_name):
+    '''创建jwt token'''
+    payload = {
+        # 过期时间
+        'exp': datetime.datetime.utcnow() + datetime.timedelta(days=1),
+        # token签发者
+        'iss': 'system',
+        # token创建时间
+        'iat': datetime.datetime.utcnow(),
+        'data': {
+            'id': user_id,
+            'name': user_name,
+        }
+    }
+    key = hashlib.md5('yuthon'.encode('utf-8')).hexdigest()
+    token = jwt.encode(payload=payload, key=key, algorithm="HS256")
+    return token
+
+
+def check_token(token):
+    '''验证jwt token'''
+    try:
+        key = hashlib.md5('yuthon'.encode('utf-8')).hexdigest()
+        payload = jwt.decode(jwt=token, key=key, algorithms="HS256")
+        data = payload.get('data')
+        if data and data.get('id'):
+            return payload
+    except Exception as e:
+        _logging.error(str(e))
+        return None
+
+
+# token登录验证装饰器
+def authorize(func):
+    @functools.wraps(func)
+    def wrapper(*args, **kw):
+        token = request.httprequest.headers.get('Authorization')
+        if not token:
+            raise ValueError('用户登录异常')
+
+        payload = check_token(token=token)
+        if not payload:
+            raise ValueError('用户登录异常')
+        data = payload.get('data')
+        user = request.env.user.search([('id', '=', data.get('id'))])
+        if user and user.login == data.get('name'):
+            request.env.uid = user.id
+            request.env.user = user
+        else:
+            raise ValueError('用户登录异常')
+        return func(*args, **kw)
+
+    return wrapper
+