diff --git a/server/app/api/controller/GameController.php b/server/app/api/controller/GameController.php
index 7875d50..9103682 100644
--- a/server/app/api/controller/GameController.php
+++ b/server/app/api/controller/GameController.php
@@ -7,6 +7,7 @@ use support\Request;
 use support\Response;
 use app\api\logic\UserLogic;
 use app\api\logic\GameLogic;
+use app\api\util\ReturnCode;
 use app\dice\model\reward_config\DiceRewardConfig;
 use plugin\saiadmin\basic\OpenController;
 
@@ -32,16 +33,16 @@ class GameController extends OpenController
             }
         }
         if (empty($token)) {
-            return $this->fail('请携带 user-token');
+            return $this->fail('请携带 user-token', ReturnCode::MISSING_TOKEN);
         }
         $userId = UserLogic::getUserIdFromToken($token);
         if ($userId === null) {
-            return $this->fail('user-token 无效或已过期');
+            return $this->fail('user-token 无效或已过期', ReturnCode::TOKEN_TIMEOUT);
         }
 
         $count = (int) $request->post('count', 0);
         if (!in_array($count, [1, 5, 10], true)) {
-            return $this->fail('购买抽奖券错误');
+            return $this->fail('购买抽奖券错误', ReturnCode::EMPTY_PARAMS);
         }
 
         try {
@@ -49,7 +50,7 @@ class GameController extends OpenController
             $data = $logic->buyLotteryTickets($userId, $count);
             return $this->success($data);
         } catch (\plugin\saiadmin\exception\ApiException $e) {
-            return $this->fail($e->getMessage());
+            return $this->fail($e->getMessage(), ReturnCode::EMPTY_PARAMS);
         }
     }
 
diff --git a/server/app/api/controller/UserController.php b/server/app/api/controller/UserController.php
index bb992d6..6c65302 100644
--- a/server/app/api/controller/UserController.php
+++ b/server/app/api/controller/UserController.php
@@ -7,6 +7,7 @@ use support\Request;
 use support\Response;
 use app\api\cache\UserCache;
 use app\api\logic\UserLogic;
+use app\api\util\ReturnCode;
 use plugin\saiadmin\basic\OpenController;
 
 /**
@@ -25,7 +26,7 @@ class UserController extends OpenController
         $phone = $request->post('phone', '');
         $password = $request->post('password', '');
         if ($phone === '' || $password === '') {
-            return $this->fail('请填写手机号和密码');
+            return $this->fail('请填写手机号和密码', ReturnCode::EMPTY_PARAMS);
         }
         $logic = new UserLogic();
         $data = $logic->login($phone, $password);
@@ -47,7 +48,7 @@ class UserController extends OpenController
         $password = $request->post('password', '');
         $nickname = $request->post('nickname');
         if ($phone === '' || $password === '') {
-            return $this->fail('请填写手机号和密码');
+            return $this->fail('请填写手机号和密码', ReturnCode::EMPTY_PARAMS);
         }
         $logic = new UserLogic();
         $data = $logic->register($phone, $password, $nickname ? (string) $nickname : null);
@@ -74,12 +75,12 @@ class UserController extends OpenController
             }
         }
         if (empty($token)) {
-            return $this->fail('请携带 user-token');
+            return $this->fail('请携带 user-token', ReturnCode::MISSING_TOKEN);
         }
         if (UserLogic::logout($token)) {
             return $this->success('已退出登录');
         }
-        return $this->fail('退出失败或 token 已失效');
+        return $this->fail('退出失败或 token 已失效', ReturnCode::TOKEN_TIMEOUT);
     }
 
     /**
@@ -98,15 +99,15 @@ class UserController extends OpenController
             }
         }
         if (empty($token)) {
-            return $this->fail('请携带 user-token');
+            return $this->fail('请携带 user-token', ReturnCode::MISSING_TOKEN);
         }
         $userId = UserLogic::getUserIdFromToken($token);
         if ($userId === null) {
-            return $this->fail('user-token 无效或已过期');
+            return $this->fail('user-token 无效或已过期', ReturnCode::TOKEN_TIMEOUT);
         }
         $user = UserLogic::getCachedUser($userId);
         if (empty($user)) {
-            return $this->fail('用户不存在');
+            return $this->fail('用户不存在', ReturnCode::EMPTY_PARAMS);
         }
         $fields = ['id', 'username', 'phone', 'uid', 'name', 'coin', 'total_draw_count'];
         $info = [];
@@ -134,15 +135,15 @@ class UserController extends OpenController
             }
         }
         if (empty($token)) {
-            return $this->fail('请携带 user-token');
+            return $this->fail('请携带 user-token', ReturnCode::MISSING_TOKEN);
         }
         $userId = UserLogic::getUserIdFromToken($token);
         if ($userId === null) {
-            return $this->fail('user-token 无效或已过期');
+            return $this->fail('user-token 无效或已过期', ReturnCode::TOKEN_TIMEOUT);
         }
         $user = UserCache::getUser($userId);
         if (empty($user)) {
-            return $this->fail('缓存已过期，请重新登录');
+            return $this->fail('缓存已过期，请重新登录', ReturnCode::TOKEN_TIMEOUT);
         }
         $coin = $user['coin'] ?? null;
         if (is_string($coin) && is_numeric($coin)) {
diff --git a/server/app/api/middleware/CheckApiAuthMiddleware.php b/server/app/api/middleware/CheckApiAuthMiddleware.php
index e2ddf66..387e2e9 100644
--- a/server/app/api/middleware/CheckApiAuthMiddleware.php
+++ b/server/app/api/middleware/CheckApiAuthMiddleware.php
@@ -10,6 +10,7 @@ use Webman\MiddlewareInterface;
 use Tinywan\Jwt\JwtToken;
 use Tinywan\Jwt\Exception\JwtTokenException;
 use Tinywan\Jwt\Exception\JwtTokenExpiredException;
+use app\api\util\ReturnCode;
 use plugin\saiadmin\exception\ApiException;
 
 /**
@@ -38,7 +39,7 @@ class CheckApiAuthMiddleware implements MiddlewareInterface
             }
         }
         if (empty($token)) {
-            throw new ApiException('缺少 auth-token，请先调用 /api/authToken 获取', 401);
+            throw new ApiException('请携带 auth-token', ReturnCode::MISSING_TOKEN);
         }
 
         try {
@@ -46,17 +47,17 @@ class CheckApiAuthMiddleware implements MiddlewareInterface
             $decoded = JwtToken::verify(1, $token);
             $extend = $decoded['extend'] ?? [];
             if (($extend['plat'] ?? '') !== 'api') {
-                throw new ApiException('auth-token 无效', 401);
+                throw new ApiException('auth-token 无效', ReturnCode::TOKEN_TIMEOUT);
             }
         } catch (JwtTokenExpiredException $e) {
-            Log::error('code=401, auth-token 已过期，请重新获取, 报错信息'. $e);
-            throw new ApiException('auth-token 已过期，请重新获取', 401);
+            Log::error('auth-token 已过期, 报错信息'. $e);
+            throw new ApiException('auth-token 已过期', ReturnCode::TOKEN_TIMEOUT);
         } catch (JwtTokenException $e) {
-            Log::error('code=401, message=auth-token 无效, 报错信息'. $e);
-            throw new ApiException($e->getMessage() ?: 'auth-token 无效', 401);
+            Log::error('auth-token 无效, 报错信息'. $e);
+            throw new ApiException($e->getMessage() ?: 'auth-token 无效', ReturnCode::TOKEN_TIMEOUT);
         } catch (\Throwable $e) {
-            Log::error('code=401, message=auth-token 校验失败, 报错信息'. $e);
-            throw new ApiException('auth-token 校验失败', 401);
+            Log::error('auth-token 校验失败, 报错信息'. $e);
+            throw new ApiException('auth-token 校验失败', ReturnCode::TOKEN_TIMEOUT);
         }
 
         return $handler($request);
diff --git a/server/app/api/util/ReturnCode.php b/server/app/api/util/ReturnCode.php
new file mode 100644
index 0000000..aba2a58
--- /dev/null
+++ b/server/app/api/util/ReturnCode.php
@@ -0,0 +1,22 @@
+<?php
+declare(strict_types=1);
+
+namespace app\api\util;
+
+/**
+ * API 状态码统一管理
+ */
+class ReturnCode
+{
+    /** 200 成功 */
+    public const SUCCESS = 200;
+
+    /** 201 请携带 token（auth-token / user-token） */
+    public const MISSING_TOKEN = 201;
+
+    /** 202 缺少参数 / 参数错误 / 业务校验不通过（如余额不足、购买抽奖券错误等） */
+    public const EMPTY_PARAMS = 202;
+
+    /** 203 token 过期或无效（auth-token / user-token 过期、缓存已过期等） */
+    public const TOKEN_TIMEOUT = 203;
+}
diff --git a/server/plugin/saiadmin/basic/OpenController.php b/server/plugin/saiadmin/basic/OpenController.php
index 764ebe9..05dbb56 100644
--- a/server/plugin/saiadmin/basic/OpenController.php
+++ b/server/plugin/saiadmin/basic/OpenController.php
@@ -42,11 +42,12 @@ class OpenController
     /**
      * 失败返回json内容
      * @param string $msg
+     * @param int $code 201=请携带token 202=缺少参数 203=token过期，默认400
      * @return Response
      */
-    public function fail(string $msg = 'fail'): Response
+    public function fail(string $msg = 'fail', int $code = 400): Response
     {
-        return json(['code' => 400, 'message' => $msg]);
+        return json(['code' => $code, 'message' => $msg]);
     }
 
     /**