diff --git a/common/api.js b/common/api.js
index 965b274..46ed467 100644
--- a/common/api.js
+++ b/common/api.js
@@ -55,18 +55,72 @@ var default_api = 'https://api.global-interaction.com/';
         return match ? match[0] : token;
     }
 
-    function decodeBase64URLJSON(value) {
+    function decodeBase64URLText(value) {
         try {
             var normalized = String(value || '')
                 .replace(/-/g, '+')
                 .replace(/_/g, '/');
             while (normalized.length % 4) normalized += '=';
-            return JSON.parse(window.atob(normalized));
+            return window.atob(normalized);
+        } catch (_) {
+            return '';
+        }
+    }
+
+    function decodeBase64URLJSON(value) {
+        try {
+            var text = decodeBase64URLText(value);
+            return text ? JSON.parse(text) : null;
         } catch (_) {
             return null;
         }
     }
 
+    function numericUserID(value) {
+        var text = String(value || '').trim();
+        return /^\d{6,}$/.test(text) ? text : '';
+    }
+
+    function firstLongNumericID(value) {
+        var match = String(value || '').match(/\d{12,}/);
+        return match ? match[0] : '';
+    }
+
+    function tokenPayloadUserID(payload) {
+        if (!payload || typeof payload !== 'object') return '';
+        var keys = ['userId', 'user_id', 'uid', 'id', 'sub'];
+        for (var i = 0; i < keys.length; i += 1) {
+            var userID = numericUserID(payload[keys[i]]);
+            if (userID) return userID;
+        }
+        return '';
+    }
+
+    function tokenUserID() {
+        var queryUserID =
+            numericUserID(readQuery('userId')) ||
+            numericUserID(readQuery('user_id')) ||
+            numericUserID(readQuery('uid'));
+        if (queryUserID) return queryUserID;
+
+        var token = getAccessToken();
+        if (!token) return '';
+
+        var parts = String(token).split('.');
+        for (var i = 0; i < parts.length; i += 1) {
+            var payloadUserID = tokenPayloadUserID(
+                decodeBase64URLJSON(parts[i])
+            );
+            if (payloadUserID) return payloadUserID;
+
+            var textUserID = firstLongNumericID(
+                decodeBase64URLText(parts[i])
+            );
+            if (textUserID) return textUserID;
+        }
+        return '';
+    }
+
     function isExpiredToken(token) {
         var parts = String(token || '').split('.');
         if (parts.length < 2) return false;
@@ -529,9 +583,15 @@ var default_api = 'https://api.global-interaction.com/';
     }
 
     function configuredWebPayUserQuery(displayUserID) {
-        return Object.assign(aslanUserQuery(displayUserID), {
+        var query = Object.assign(aslanUserQuery(displayUserID), {
             sysOrigin: activeAppConfig.sys_origin || 'LIKEI',
         });
+        if (isYumiWebPay() && !query.userId && !query.account) {
+            // Yumi 的 user-profile 当前只从 query 里的 userId 或 account+sysOrigin 查用户，不会从 Authorization token 反解用户。
+            // H5 token 入口会隐藏账号输入并传空 displayUserID，因此这里仅在没有显式身份参数时把 token 里的 uid 补成 userId。
+            query.userId = tokenUserID();
+        }
+        return query;
     }
 
     function aslanPaymentMethods(options) {