diff --git a/app/routers/work_order_api.py b/app/routers/work_order_api.py
index af880de..e89681a 100644
--- a/app/routers/work_order_api.py
+++ b/app/routers/work_order_api.py
@@ -2,6 +2,7 @@
 H5 工单处理 API
 
 供企微 H5 工单详情页调用：
+- GET /auth — 企微 OAuth2 code 换 userid
 - GET /detail — 获取告警+工单详情
 - POST /submit — 提交处理结果（描述+图片）
 - POST /upload-image — 上传处理后照片到 COS
@@ -10,7 +11,9 @@ H5 工单处理 API
 from fastapi import APIRouter, Query, UploadFile, File
 from pydantic import BaseModel
 from typing import Optional, List
+import httpx
 
+from app.config import settings
 from app.utils.logger import logger
 
 router = APIRouter(prefix="/api/work-order", tags=["H5工单处理"])
@@ -22,6 +25,39 @@ class SubmitRequest(BaseModel):
     resultImgUrls: Optional[List[str]] = None
 
 
+@router.get("/auth")
+async def wechat_oauth(
+    code: str = Query(..., description="企微 OAuth2 授权码"),
+):
+    """企微 OAuth2：用 code 换取 userid"""
+    try:
+        # 1. 获取 access_token
+        from app.services.wechat_service import get_wechat_service
+        wechat = get_wechat_service()
+        access_token = await wechat._get_access_token()
+
+        # 2. 用 code 换 userid
+        url = f"https://qyapi.weixin.qq.com/cgi-bin/auth/getuserinfo?access_token={access_token}&code={code}"
+        async with httpx.AsyncClient(timeout=10) as client:
+            resp = await client.get(url)
+            data = resp.json()
+
+        if data.get("errcode", 0) != 0:
+            logger.warning(f"OAuth2 获取用户失败: {data}")
+            return {"code": -1, "msg": data.get("errmsg", "授权失败"), "data": None}
+
+        userid = data.get("UserId") or data.get("userid") or ""
+        if not userid:
+            return {"code": -1, "msg": "非企业成员", "data": None}
+
+        logger.info(f"OAuth2 认证成功: userid={userid}")
+        return {"code": 0, "msg": "success", "data": {"userId": userid}}
+
+    except Exception as e:
+        logger.error(f"OAuth2 认证异常: {e}")
+        return {"code": -1, "msg": str(e), "data": None}
+
+
 @router.get("/detail")
 async def get_work_order_detail(
     alarmId: str = Query(..., description="告警ID"),