diff --git a/payapi/src/main/java/com/supwisdom/dlpay/framework/core/JwtConfig.java b/payapi/src/main/java/com/supwisdom/dlpay/framework/core/JwtConfig.java
index fbaa21c..85167fd 100644
--- a/payapi/src/main/java/com/supwisdom/dlpay/framework/core/JwtConfig.java
+++ b/payapi/src/main/java/com/supwisdom/dlpay/framework/core/JwtConfig.java
@@ -12,7 +12,10 @@
   @Value("${jwt.header:Authorization}")
   private String header = "Authorization";
   @Value("${jwt.token_header:Bearer }")
-  private String tokenHeader = "Bearer";
+  private String tokenHeader = "Bearer ";
+
+  @Value("${jwt.multitenant:false}")
+  private Boolean multiTenant = false;
 
   public String getSecret() {
     return secret;
@@ -33,4 +36,12 @@
   public void setExpiration(Long expiration) {
     this.expiration = expiration;
   }
+
+  public Boolean getMultiTenant() {
+    return multiTenant;
+  }
+
+  public void setMultiTenant(Boolean multiTenant) {
+    this.multiTenant = multiTenant;
+  }
 }
diff --git a/payapi/src/main/java/com/supwisdom/dlpay/framework/util/Constants.java b/payapi/src/main/java/com/supwisdom/dlpay/framework/util/Constants.java
index 46af8bb..0bf11d8 100644
--- a/payapi/src/main/java/com/supwisdom/dlpay/framework/util/Constants.java
+++ b/payapi/src/main/java/com/supwisdom/dlpay/framework/util/Constants.java
@@ -3,6 +3,7 @@
 public class Constants {
   //  HTTP HEADER define
   public static final String HEADER_TETANTID = "X-TENANT-ID";
+  public static final String DEFAULT_TENANTID = "{tenantid}";
 
   // define
   public static final String JWT_CLAIM_TENANTID = "tenantId";
diff --git a/payapi/src/main/kotlin/com/supwisdom/dlpay/PayApiApplication.kt b/payapi/src/main/kotlin/com/supwisdom/dlpay/PayApiApplication.kt
index 1cc6089..8b7b796 100644
--- a/payapi/src/main/kotlin/com/supwisdom/dlpay/PayApiApplication.kt
+++ b/payapi/src/main/kotlin/com/supwisdom/dlpay/PayApiApplication.kt
@@ -11,6 +11,7 @@
 import org.springframework.boot.autoconfigure.data.redis.RedisProperties
 import org.springframework.boot.builder.SpringApplicationBuilder
 import org.springframework.boot.context.properties.ConfigurationProperties
+import org.springframework.boot.web.servlet.FilterRegistrationBean
 import org.springframework.boot.web.servlet.ServletComponentScan
 import org.springframework.boot.web.servlet.support.SpringBootServletInitializer
 import org.springframework.cache.annotation.EnableCaching
@@ -67,6 +68,33 @@
 }
 
 @Configuration
+class JwtAuthFilterRegistration {
+    @Autowired
+    private lateinit var apiJwtAuthenticationFilter: ApiJwtAuthenticationFilter
+
+    @Autowired
+    private lateinit var mobileSecurityFilter: MobileSecurityFilter
+
+    @Bean
+    fun registerJwtFilter(): FilterRegistrationBean<ApiJwtAuthenticationFilter> {
+        val registration = FilterRegistrationBean<ApiJwtAuthenticationFilter>()
+        registration.filter = apiJwtAuthenticationFilter
+        registration.addUrlPatterns("/api/*")
+        registration.order = 1
+        return registration
+    }
+
+    @Bean
+    fun registerMobileFilter(): FilterRegistrationBean<MobileSecurityFilter> {
+        val registrationBean = FilterRegistrationBean<MobileSecurityFilter>()
+        registrationBean.filter = mobileSecurityFilter
+        registrationBean.order = 2
+        registrationBean.addUrlPatterns("/mobile/*")
+        return registrationBean
+    }
+}
+
+@Configuration
 class HttpSessionConfig {
     @Bean
     fun sessionRedisTemplate(
diff --git a/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/MobileApi.kt b/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/MobileApi.kt
index 3d7471c..3e75d86 100644
--- a/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/MobileApi.kt
+++ b/payapi/src/main/kotlin/com/supwisdom/dlpay/mobile/MobileApi.kt
@@ -18,12 +18,17 @@
 import com.supwisdom.dlpay.system.service.DictionaryProxy
 import com.supwisdom.dlpay.util.ConstantUtil
 import org.apache.commons.lang.StringUtils
+import org.jose4j.jwt.ReservedClaimNames
+import org.jose4j.lang.JoseException
 import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.data.redis.core.RedisTemplate
+import org.springframework.http.HttpStatus
+import org.springframework.http.ResponseEntity
 import org.springframework.security.core.GrantedAuthority
 import org.springframework.security.core.authority.AuthorityUtils
 import org.springframework.security.core.context.SecurityContextHolder
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
+import org.springframework.web.bind.annotation.RequestHeader
 import org.springframework.web.bind.annotation.RequestMapping
 import org.springframework.web.bind.annotation.RestController
 import org.springframework.web.bind.annotation.RequestParam
@@ -90,8 +95,8 @@
         val temp = redisTemplate.opsForValue().get(phone)
         if (temp.isNullOrEmpty()) {
             val code = RandomUtils.randomNumber(6)
-            val rs = mobileApiService.sendSms(phone,code)
-            if("0"!=rs.retcode){
+            val rs = mobileApiService.sendSms(phone, code)
+            if ("0" != rs.retcode) {
                 return JsonResult.error(rs.retmsg)
             }
             redisTemplate.opsForValue().set(phone, code, Duration.ofMinutes(5))
@@ -230,12 +235,29 @@
     @Autowired
     lateinit var citizencardPayService: CitizencardPayService
 
+    @Autowired
+    lateinit var apiJwtRepository: ApiJwtRepository
+    @Autowired
+    lateinit var jwtConfig: JwtConfig
+
     @RequestMapping("/idtypes")
     fun idtypes(): JsonResult {
         var dict = dictionaryProxy.getDictionaryAsMap(Dictionary.IDTYPE)
         return JsonResult.ok("OK").put("idtypes", dict)!!
     }
 
+    @RequestMapping("/logout")
+    fun logout(@RequestHeader("Authorization") auth: String?): ResponseEntity<Any> {
+        if (auth == null) {
+            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build()
+        }
+        val jwt = auth.substring(jwtConfig.tokenHeader.length)
+        val claims = JwtTokenUtil(jwtConfig).verifyToken(jwt)
+        SecurityContextHolder.clearContext()
+        apiJwtRepository.deleteById(claims[ReservedClaimNames.JWT_ID].toString())
+        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build()
+    }
+
     /**
      * 用户信息
      * */
@@ -260,8 +282,8 @@
         val temp = redisTemplate.opsForValue().get(user.phone)
         if (temp.isNullOrEmpty()) {
             val code = RandomUtils.randomNumber(6)
-            val rs = mobileApiService.sendSms(user.phone,code)
-            if("0"!=rs.retcode){
+            val rs = mobileApiService.sendSms(user.phone, code)
+            if ("0" != rs.retcode) {
                 return JsonResult.error(rs.retmsg)
             }
             redisTemplate.opsForValue().set(user.phone, code, Duration.ofMinutes(5))
@@ -461,7 +483,8 @@
                 ?: return JsonResult.error("用户不存在，请注册")
         var signed: String
         if (!user.userid.isNullOrEmpty()) {
-            var card = mobileApiService.findCardByUserid(user.userid!!) ?: return JsonResult.error("卡片不存在，请重新绑定")
+            var card = mobileApiService.findCardByUserid(user.userid!!)
+                    ?: return JsonResult.error("卡片不存在，请重新绑定")
             if (card.signed) {
                 signed = TradeDict.STATUS_YES
             } else {
@@ -612,7 +635,8 @@
             return JsonResult.error(-1, "银行卡未绑定，请先绑定")
         }
         val person = userService.findOnePersonByUserid(user.userid!!)
-        val card = mobileApiService.findCardByUserid(user.userid!!) ?: return JsonResult.error(-1, "银行卡未绑定，请先绑定")
+        val card = mobileApiService.findCardByUserid(user.userid!!)
+                ?: return JsonResult.error(-1, "银行卡未绑定，请先绑定")
         var status = ""
         //normal/loss/frozen/locked
         when (card.transStatus) {
@@ -652,7 +676,8 @@
                 if (it) mobileApiService.saveUser(user)
             }
         }
-        var card = mobileApiService.findCardByUserid(user.userid!!) ?: return JsonResult.error(-1, "银行卡未绑定，请先绑定")
+        var card = mobileApiService.findCardByUserid(user.userid!!)
+                ?: return JsonResult.error(-1, "银行卡未绑定，请先绑定")
         if (card.transStatus != TradeDict.STATUS_NORMAL) {
             return JsonResult.error("卡状态非正常，不能挂失")
         }
@@ -671,7 +696,7 @@
         mobileApiService.findUserById(p.name)
                 ?: return JsonResult.error("用户不存在，请注册")
         //TODO qrcode
-        return JsonResult.ok("ok").put("qrcode",p.name)!!
+        return JsonResult.ok("ok").put("qrcode", p.name)!!
     }
 
 
diff --git a/payapi/src/main/kotlin/com/supwisdom/dlpay/security.kt b/payapi/src/main/kotlin/com/supwisdom/dlpay/security.kt
index 2e747ae..1591191 100644
--- a/payapi/src/main/kotlin/com/supwisdom/dlpay/security.kt
+++ b/payapi/src/main/kotlin/com/supwisdom/dlpay/security.kt
@@ -7,6 +7,7 @@
 import com.supwisdom.dlpay.framework.security.MyAuthenticationFailureHandler
 import com.supwisdom.dlpay.framework.security.ValidateCodeSecurityConfig
 import com.supwisdom.dlpay.framework.service.OperatorDetailService
+import com.supwisdom.dlpay.framework.tenant.TenantContext
 import com.supwisdom.dlpay.framework.util.Constants
 import com.supwisdom.dlpay.framework.util.TradeDict
 import com.supwisdom.dlpay.mobile.AuthLoginFailHandler
@@ -19,7 +20,6 @@
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.core.annotation.Order
-import org.springframework.data.redis.connection.RedisConnectionFactory
 import org.springframework.http.HttpStatus
 import org.springframework.security.authentication.AuthenticationManager
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
@@ -33,7 +33,6 @@
 import org.springframework.security.core.authority.SimpleGrantedAuthority
 import org.springframework.security.core.context.SecurityContextHolder
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
-import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStore
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
 import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher
@@ -45,6 +44,7 @@
 import java.security.SecureRandom
 import java.util.*
 import javax.servlet.FilterChain
+import javax.servlet.http.HttpFilter
 import javax.servlet.http.HttpServletRequest
 import javax.servlet.http.HttpServletResponse
 import javax.sql.DataSource
@@ -60,10 +60,6 @@
 
     private var jwtUtil: JwtTokenUtil? = null
 
-    @Autowired
-    private lateinit var redisConnectionFactory: RedisConnectionFactory
-
-
     private fun getUtil(): JwtTokenUtil {
         if (jwtUtil == null) {
             jwtUtil = JwtTokenUtil((jwtConfig))
@@ -72,22 +68,8 @@
     }
 
     override fun doFilterInternal(request: HttpServletRequest, response: HttpServletResponse, filterChain: FilterChain) {
-        var context: String? = request.contextPath
-        if (context == null || "" == context.trim { it <= ' ' }) {
-            context = "/"
-        }
-        if (request.requestURI.isEmpty()) {
-            filterChain.doFilter(request, response)
-            return
-        }
-        var url = request.requestURI
-        if ("/" != context) {
-            url = url.replace(context, "")
-        }
-        logger.info(url)
-        if (!url.startsWith("/api/") && !url.startsWith("/mobileapi/v1/")) {
-            filterChain.doFilter(request, response)
-            return
+        if (!jwtConfig.multiTenant) {
+            TenantContext.setTenantSchema(Constants.DEFAULT_TENANTID)
         }
         request.getHeader(jwtConfig.header)?.let { authHeader ->
             try {
@@ -96,18 +78,7 @@
                 } else {
                     throw JoseException("JWT Header error")
                 }
-                if (url.contains("/userinfor")) {
-                    SecurityContextHolder.getContext().authentication = RedisTokenStore(redisConnectionFactory).readAuthentication(jwt)
-                    filterChain.doFilter(request, response)
-                    return
-                }
                 val claims = getUtil().verifyToken(jwt)
-                if (url.equals("/mobileapi/v1/logout")) {
-                    SecurityContextHolder.clearContext()
-                    apiJwtRepository.deleteById(claims[ReservedClaimNames.JWT_ID].toString())
-                    throw JoseException("JWT has not been register")
-                }
-
                 apiJwtRepository.findById(claims[ReservedClaimNames.JWT_ID].toString()).let {
                     if (!it.isPresent) {
                         throw JoseException("JWT has not been register")
@@ -117,14 +88,17 @@
                         throw JoseException("JWT status error : ${it.get().status}")
                     }
                 }
-                val tenantId = request.getHeader(Constants.HEADER_TETANTID)
-                if (tenantId == null) {
-                    response.status = HttpStatus.UNAUTHORIZED.value()
-                    return
-                }
-                if (claims[Constants.JWT_CLAIM_TENANTID] != tenantId) {
-                    response.status = HttpStatus.UNAUTHORIZED.value()
-                    return
+                if (jwtConfig.multiTenant) {
+                    val tenantId = request.getHeader(Constants.HEADER_TETANTID)
+                    if (tenantId == null) {
+                        response.status = HttpStatus.UNAUTHORIZED.value()
+                        return
+                    }
+                    if (claims[Constants.JWT_CLAIM_TENANTID] != tenantId) {
+                        response.status = HttpStatus.UNAUTHORIZED.value()
+                        return
+                    }
+                    TenantContext.setTenantSchema(tenantId)
                 }
                 val auth = UsernamePasswordAuthenticationToken(claims[Constants.JWT_CLAIM_UID], null,
                         (claims[Constants.JWT_CLAIM_AUTHORITIES] as ArrayList<*>)
@@ -144,10 +118,10 @@
                 response.status = HttpStatus.UNAUTHORIZED.value()
                 response.contentType = "application/json;charset=UTF-8"
                 return
-            } catch (e:Exception){
+            } catch (e: Exception) {
                 SecurityContextHolder.clearContext()
                 // jwt 失效后返回 401
-                response.status=HttpStatus.UNAUTHORIZED.value()
+                response.status = HttpStatus.UNAUTHORIZED.value()
                 response.contentType = "application/json;charset=UTF-8"
                 return
             }
@@ -156,6 +130,19 @@
     }
 }
 
+@Component
+class MobileSecurityFilter : HttpFilter() {
+    override fun doFilter(req: HttpServletRequest, res: HttpServletResponse, chain: FilterChain) {
+//        val url = req.requestURI
+//        if (url.contains("/userinfor")) {
+//            SecurityContextHolder.getContext().authentication = RedisTokenStore(redisConnectionFactory).readAuthentication(jwt)
+//            chain.doFilter(req, res)
+//            return
+//        }
+        chain.doFilter(req, res)
+    }
+}
+
 @EnableWebSecurity
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 class WebSecurityConfig {
@@ -165,22 +152,16 @@
         @Order(1)
         class ApiWebSecurityConfigurationAdapter : WebSecurityConfigurerAdapter() {
 
-            @Autowired
-            lateinit var apiFilter: ApiJwtAuthenticationFilter
-
             override fun configure(http: HttpSecurity) {
                 // 设置 API 访问权限管理
                 http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                         .and()
                         .antMatcher("/api/**")
-                        .addFilterAfter(apiFilter,
-                                UsernamePasswordAuthenticationFilter::class.java)
                         .authorizeRequests()
                         .antMatchers("/api/auth/**").permitAll()
                         .antMatchers("/api/notify/**").permitAll()
                         .antMatchers("/api/common/**").permitAll()
                         .antMatchers("/api/userinfor").hasAnyRole("ADMIN", "THIRD_ADMIN")
-//                        .antMatchers("/api/common/**").hasAnyRole("THIRD_COMMON", "THIRD_ADMIN")
                         .antMatchers("/api/consume/**").hasRole("THIRD_CONSUME")
                         .antMatchers("/api/recharge/**").hasRole("THIRD_DEPOSIT")
                         .antMatchers("/api/user/**").hasRole("THIRD_ADMIN")
@@ -242,7 +223,7 @@
                         .antMatcher("/mobileapi/**")
                         .addFilterAfter(apiFilter,
                                 UsernamePasswordAuthenticationFilter::class.java)
-                        .authorizeRequests().antMatchers("/mobileapi/i/**","/mobileapi/login")
+                        .authorizeRequests().antMatchers("/mobileapi/i/**", "/mobileapi/login")
                         .permitAll().anyRequest().authenticated()
                         .and()
                         .formLogin()
@@ -253,14 +234,15 @@
                         .sessionManagement().maximumSessions(1)
                         .expiredUrl("/mobileapi/sessionexpired")
             }
+
             @Bean
-            fun  corsConfigurationSource(): CorsConfigurationSource {
+            fun corsConfigurationSource(): CorsConfigurationSource {
                 //手机端支持跨域请求
                 val configuration = CorsConfiguration()
-                configuration.allowedOrigins = Arrays.asList("*")
-                configuration.allowedMethods = Arrays.asList("GET","POST")
-                configuration.allowedHeaders = Arrays.asList("*")
-                val source =  UrlBasedCorsConfigurationSource()
+                configuration.allowedOrigins = listOf("*")
+                configuration.allowedMethods = listOf("GET", "POST")
+                configuration.allowedHeaders = listOf("*")
+                val source = UrlBasedCorsConfigurationSource()
                 source.registerCorsConfiguration("/mobileapi/**", configuration);
                 return source
             }