diff --git a/src/net/AuthService.cpp b/src/net/AuthService.cpp
index 734836b..998f2cf 100644
--- a/src/net/AuthService.cpp
+++ b/src/net/AuthService.cpp
@@ -41,12 +41,13 @@ LoginLoad* AuthService::loginAsync(const QString& username, const QString& passw
     };
 
     // step2：RSA 加密密码（PKCS#1 v1.5 -> base64，可抛 std::exception → ApiChain 转 failed）-> login2。
-    ApiChain::StepFactory step2 = [this, username, password](const QList<ApiResponse>&) -> IApiCall* {
+    ApiChain::StepFactory step2 = [this, username, password, code, codeId](const QList<ApiResponse>&) -> IApiCall* {
         RsaEncryptor enc(rsaPublicKeyPem_);
         const std::string encrypted = enc.encryptBase64(password.toStdString());
         const QJsonObject body{{QStringLiteral("username"), username},
                                {QStringLiteral("password"), QString::fromStdString(encrypted)},
-                               {QStringLiteral("checkCode"), QString()}};
+                               {QStringLiteral("checkCode"), code},      // 用户输入的验证码（后端 checkCodeNotNull）
+                               {QStringLiteral("codeId"), codeId}};
         return api_.postJsonAsync(QString::fromLatin1(kPathLogin), body);
     };