diff --git a/bff/internal/request/user.go b/bff/internal/request/user.go
index 483b255..055149d 100644
--- a/bff/internal/request/user.go
+++ b/bff/internal/request/user.go
@@ -33,18 +33,17 @@ const (
 	CtxGroupId      ctxKey = "X-Group-Id"
 	CtxGroupName    ctxKey = "X-Group-Name"
 	CtxUserType     ctxKey = "X-User-Type"
-	CtxBizId         ctxKey = "X-Biz-Id"
-	CtxRawBody       ctxKey = "X-Raw-Body"
-	CtxOssAuth       ctxKey = "X-Oss-Authorization"
-	CtxOssPubKeyURL  ctxKey = "X-Oss-Pub-Key-Url"
-	CtxRequestPath   ctxKey = "X-Request-Path"
-	CtxRequestQuery  ctxKey = "X-Request-Query"
+	CtxBizId        ctxKey = "X-Biz-Id"
+	CtxRawBody      ctxKey = "X-Raw-Body"
+	CtxOssAuth      ctxKey = "X-Oss-Authorization"
+	CtxOssPubKeyURL ctxKey = "X-Oss-Pub-Key-Url"
+	CtxRequestPath  ctxKey = "X-Request-Path"
+	CtxRequestQuery ctxKey = "X-Request-Query"
 )
 
 var callbackPrefixes = []string{
 	"/api/v3/express/",
 	"/api/v2/analysis/oss/callback",
-	"/api/v2/analysis/py/callback",
 	"/api/v3/other1/",
 	"/api/v3/other2/",
 }
@@ -66,13 +65,13 @@ type UserInfo struct {
 	StoreName    string
 	GroupId      string
 	GroupName    string
-	BizId         string
-	RawBody       string
-	OssAuth       string
-	OssPubKeyURL  string
-	RequestPath   string
-	RequestQuery  string
-	Valid         bool
+	BizId        string
+	RawBody      string
+	OssAuth      string
+	OssPubKeyURL string
+	RequestPath  string
+	RequestQuery string
+	Valid        bool
 }
 
 func GetUserInfo(ctx context.Context) UserInfo {
diff --git a/deploy/apisix/lua/auth.lua b/deploy/apisix/lua/auth.lua
index 38ece88..e489907 100644
--- a/deploy/apisix/lua/auth.lua
+++ b/deploy/apisix/lua/auth.lua
@@ -22,8 +22,10 @@ function _M.access(conf, ctx)
         ["/api/v3/express/sf"] = true,
         ["/api/v3/express/jd"] = true,
 
-        ["/api/v3/chore/oss/upload"] = true,
-        ["/api/v1/oss/callback"]     = true,
+        ["/api/v3/chore/oss/upload"]    = true,
+        ["/api/v3/chore/answer/items"]  = true,
+        ["/api/v3/chore/system/info"]   = true,
+        ["/api/v3/chore/system/items"]  = true,
 
         ["/api/v3/user/qrcode/generate"] = true,
         ["/api/v3/user/qrcode/scan"]     = true,
@@ -33,10 +35,9 @@ function _M.access(conf, ctx)
         ["/api/v2/analysis/qrcode/info"]    = true,
         ["/api/v2/analysis/user/delete"]    = true,
         ["/api/v2/analysis/store/info"]     = true,
+        ["/api/v2/analysis/oss/callback"]   = true,
+        ["/api/v2/analysis/py/callback"]    = true,
 
-        ["/api/v3/chore/answer/items"]      = true,
-        ["/api/v3/chore/system/info"]       = true,
-        ["/api/v3/chore/system/items"]      = true,
     }
 
     local user_key = core.request.header(ctx, "authorization")