diff --git a/oneone-auth/src/main/java/com/oneone/auth/controller/app/InternalSsoController.java b/oneone-auth/src/main/java/com/oneone/auth/controller/app/InternalSsoController.java
new file mode 100644
index 0000000..c4504ce
--- /dev/null
+++ b/oneone-auth/src/main/java/com/oneone/auth/controller/app/InternalSsoController.java
@@ -0,0 +1,47 @@
+package com.oneone.auth.controller.app;
+
+import com.oneone.auth.service.LoginService;
+import com.oneone.common.base.LocalToken;
+import com.oneone.common.result.Result;
+import io.swagger.v3.oas.annotations.Hidden;
+import lombok.Data;
+import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.util.StringUtils;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@Hidden
+@RestController
+@RequestMapping("/oauth/internal")
+@RequiredArgsConstructor
+public class InternalSsoController {
+    private final LoginService loginService;
+
+    @Value("${auth.internal-issue-key:}")
+    private String internalIssueKey;
+
+    @PostMapping("/issue-mini-app")
+    public Result<LocalToken> issueMiniApp(
+            @RequestHeader(value = "X-Internal-Key", required = false) String key,
+            @RequestBody IssueMiniAppParam body
+    ) {
+        if (!StringUtils.hasText(internalIssueKey) || !internalIssueKey.equals(key)) {
+            return Result.failed("unauthorized");
+        }
+        if (body == null || !StringUtils.hasText(body.getOpenid())) {
+            return Result.failed("openid required");
+        }
+        return Result.success(loginService.issueMiniAppByOpenid(body.getOpenid(), body.getUnionId(), body.getPhone()));
+    }
+
+    @Data
+    public static class IssueMiniAppParam {
+        private String openid;
+        private String unionId;
+        private String phone;
+    }
+}
diff --git a/oneone-auth/src/main/java/com/oneone/auth/service/LoginService.java b/oneone-auth/src/main/java/com/oneone/auth/service/LoginService.java
index 053007c..03e2dcd 100644
--- a/oneone-auth/src/main/java/com/oneone/auth/service/LoginService.java
+++ b/oneone-auth/src/main/java/com/oneone/auth/service/LoginService.java
@@ -27,6 +27,8 @@ public interface LoginService {
 
     LocalToken miniApp(String code,String miniAppParamStr);
 
+    LocalToken issueMiniAppByOpenid(String openid, String unionId, String phone);
+
     LocalToken officialAccount(String officialAccountParamStr);
 
     LocalToken appleJwt(String token);
diff --git a/oneone-auth/src/main/java/com/oneone/auth/service/impl/LoginServiceImpl.java b/oneone-auth/src/main/java/com/oneone/auth/service/impl/LoginServiceImpl.java
index eac98db..72b8845 100644
--- a/oneone-auth/src/main/java/com/oneone/auth/service/impl/LoginServiceImpl.java
+++ b/oneone-auth/src/main/java/com/oneone/auth/service/impl/LoginServiceImpl.java
@@ -272,6 +272,27 @@ public class LoginServiceImpl implements LoginService {
         return token;
     }
 
+    @Override
+    public LocalToken issueMiniAppByOpenid(String openid, String unionId, String phone) {
+        if (!StringUtils.hasText(openid)) {
+            throw new BusinessException("登录失败,请稍后再试");
+        }
+        AccountInfo accountInfo = accountInfoService.getAccountInfo(AccountTypeEnum.MINI_APP.getCode(), openid);
+        if (accountInfo == null) {
+            RegisterParam registerParam = new RegisterParam(AccountTypeEnum.MINI_APP.getCode(), openid);
+            registerParam.setPhone(phone);
+            registerParam.setUnionId(unionId);
+            accountInfo = accountInfoService.register(registerParam);
+        }
+        if (accountInfo.getStatus() == 0) {
+            log.error("微信登录,账号被封禁,账号:{}", openid);
+            throw new BusinessException(ErrorCodeConstants.USER_ACCOUNT_LOCKED);
+        }
+        LocalToken token = TokenUtil.generateToken(tokenValid, AccountTypeEnum.MINI_APP.getCode(), openid, accountInfo.getPlatformUserId(), GrantTypeEnum.MINI_APP.getCode());
+        appRedisTokenStore.storeAccessToken(token);
+        return token;
+    }
+
     @Override
     public LocalToken officialAccount(String officialAccountParamStr) {
         OfficialAccountParam officialAccountParam = JsonUtils.strToClass(officialAccountParamStr, OfficialAccountParam.class);
diff --git a/oneone-auth/src/main/resources/bootstrap.yml b/oneone-auth/src/main/resources/bootstrap.yml
index 066ad72..5065a4f 100644
--- a/oneone-auth/src/main/resources/bootstrap.yml
+++ b/oneone-auth/src/main/resources/bootstrap.yml
@@ -19,4 +19,8 @@ springdoc:
 knife4j:
   enable: true # 2.2 是否开启 Swagger 文档的 Knife4j UI 界面
   setting:
-    language: zh_cn
\ No newline at end of file
+    language: zh_cn
+
+# ECR-049：Go 内网换小程序 token。须与 Go JAVA_INTERNAL_KEY 一致；空则拒绝签发。
+auth:
+  internal-issue-key: ${AUTH_INTERNAL_ISSUE_KEY:}
\ No newline at end of file