diff --git a/rc-service/rc-service-other/other-adapter/src/main/java/com/red/circle/other/adapter/app/game/party3rd/GameHkysRestController.java b/rc-service/rc-service-other/other-adapter/src/main/java/com/red/circle/other/adapter/app/game/party3rd/GameHkysRestController.java
index e703c7cb..39b0703b 100644
--- a/rc-service/rc-service-other/other-adapter/src/main/java/com/red/circle/other/adapter/app/game/party3rd/GameHkysRestController.java
+++ b/rc-service/rc-service-other/other-adapter/src/main/java/com/red/circle/other/adapter/app/game/party3rd/GameHkysRestController.java
@@ -51,12 +51,14 @@ import com.red.circle.tool.core.text.StringUtils;
 import com.red.circle.tool.crypto.SecurityUtils;
 
 import java.math.BigDecimal;
+import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.TimeUnit;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
+import java.util.Objects;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -102,12 +104,12 @@ public class GameHkysRestController {
       return new HkysResponse<HkysUserProfileResponse>()
           .setErrorCode(HyksErrorEnum.PARAM_ERROR.getErrorCode());
     }
-    String sign = SecurityUtils.md5(Stream.of(cmd.getGameId(), cmd.getUid(), cmd.getToken(), cmd.getRoomId(),
-        resolveLingxianSignKey(cmd.getToken())).filter(Objects::nonNull).map(String::valueOf)
-        .collect(Collectors.joining("")));
-    if (!sign.equals(cmd.getSign())) {
-      return new HkysResponse<HkysUserProfileResponse>().setErrorCode(HyksErrorEnum.SIGN_VERIFY_FAIL.getErrorCode());
-    }
+    if (!verifyLingxianUserInfoSign(cmd)) {
+      log.warn("lingxian getUserInfo sign verify failed, uid={}, gameId={}, roomId={}, sysOrigin={}, tokenLength={}",
+          cmd.getUid(), cmd.getGameId(), cmd.getRoomId(), resolveSysOriginQuietly(cmd.getToken()),
+          cmd.getToken() == null ? 0 : cmd.getToken().length());
+      return new HkysResponse<HkysUserProfileResponse>().setErrorCode(HyksErrorEnum.SIGN_VERIFY_FAIL.getErrorCode());
+    }
 
     HkysUserProfileQuery query = new HkysUserProfileQuery();
     query.setGameId(cmd.getGameId());
@@ -125,12 +127,12 @@ public class GameHkysRestController {
         || Objects.isNull(cmd.getType()) || Objects.isNull(cmd.getCoin())) {
       return new HkysResponse<JSONObject>().setErrorCode(HyksErrorEnum.PARAM_ERROR.getErrorCode());
     }
-    String sign = SecurityUtils.md5(Stream.of(cmd.getOrderId(), cmd.getGameId(), cmd.getRoundId(), cmd.getUid(),
-            cmd.getCoin(), cmd.getType(), cmd.getToken(), cmd.getWinId(), cmd.getRoomId(), resolveLingxianSignKey(cmd.getToken()))
-            .filter(Objects::nonNull).map(String::valueOf).collect(Collectors.joining("")));
-    if (!sign.equals(cmd.getSign())) {
-      return new HkysResponse<JSONObject>().setErrorCode(HyksErrorEnum.SIGN_VERIFY_FAIL.getErrorCode());
-    }
+    if (!verifyLingxianUpdateBalanceSign(cmd)) {
+      log.warn("lingxian updateBalance sign verify failed, uid={}, gameId={}, orderId={}, roomId={}, sysOrigin={}, tokenLength={}",
+          cmd.getUid(), cmd.getGameId(), cmd.getOrderId(), cmd.getRoomId(), resolveSysOriginQuietly(cmd.getToken()),
+          cmd.getToken() == null ? 0 : cmd.getToken().length());
+      return new HkysResponse<JSONObject>().setErrorCode(HyksErrorEnum.SIGN_VERIFY_FAIL.getErrorCode());
+    }
 
     HkysUserCoinUpdate param = new HkysUserCoinUpdate();
     param.setOrderId(cmd.getOrderId());
@@ -226,12 +228,72 @@ public class GameHkysRestController {
   }
 
   private String resolveLingxianSignKey(String token) {
-    String sysOrigin = resolveSysOriginQuietly(token);
-    String appKey = gameListConfigService.getActiveLingxianAppKey(sysOrigin);
-    if (StringUtils.isNotBlank(appKey)) {
-      return appKey;
+    List<String> keys = lingxianSignKeys(token);
+    return keys.isEmpty() ? "" : keys.get(0);
+  }
+
+  private boolean verifyLingxianUserInfoSign(GameLxwlUserInfoCmd cmd) {
+    for (String token : lingxianTokenCandidates(cmd.getToken())) {
+      for (String key : lingxianSignKeys(token)) {
+        String sign = SecurityUtils.md5(Stream.of(cmd.getGameId(), cmd.getUid(), token, cmd.getRoomId(), key)
+            .filter(Objects::nonNull).map(String::valueOf).collect(Collectors.joining("")));
+        if (sign.equalsIgnoreCase(cmd.getSign())) {
+          return true;
+        }
+      }
     }
-    return gameHkysProperties.getSignKey();
+    return false;
+  }
+
+  private boolean verifyLingxianUpdateBalanceSign(GameLxwlUpdateBalanceCmd cmd) {
+    for (String token : lingxianTokenCandidates(cmd.getToken())) {
+      for (String key : lingxianSignKeys(token)) {
+        String sign = SecurityUtils.md5(Stream.of(cmd.getOrderId(), cmd.getGameId(), cmd.getRoundId(), cmd.getUid(),
+                cmd.getCoin(), cmd.getType(), token, cmd.getWinId(), cmd.getRoomId(), key)
+            .filter(Objects::nonNull).map(String::valueOf).collect(Collectors.joining("")));
+        if (sign.equalsIgnoreCase(cmd.getSign())) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+
+  private List<String> lingxianSignKeys(String token) {
+    List<String> keys = new ArrayList<>();
+    addIfNotBlank(keys, gameListConfigService.getActiveLingxianAppKey(resolveSysOriginQuietly(token)));
+    addIfNotBlank(keys, gameHkysProperties.getSignKey());
+    return keys;
+  }
+
+  private List<String> lingxianTokenCandidates(String token) {
+    List<String> tokens = new ArrayList<>();
+    if (StringUtils.isBlank(token)) {
+      tokens.add(null);
+      return tokens;
+    }
+    addTokenCandidate(tokens, token);
+    addTokenCandidate(tokens, SecurityUtils.urlDecode(token));
+    return tokens;
+  }
+
+  private void addTokenCandidate(List<String> tokens, String token) {
+    if (StringUtils.isBlank(token)) {
+      return;
+    }
+    addIfNotBlank(tokens, token);
+    addIfNotBlank(tokens, trimTokenPadding(token));
+  }
+
+  private String trimTokenPadding(String token) {
+    return token == null ? "" : token.trim().replaceAll("=+$", "");
+  }
+
+  private void addIfNotBlank(List<String> values, String value) {
+    if (StringUtils.isBlank(value) || values.contains(value)) {
+      return;
+    }
+    values.add(value);
   }
 
   private String resolveSysOriginQuietly(String token) {