diff --git a/application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/InterceptorConfig.java b/application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/InterceptorConfig.java
index bf73b41..248604b 100644
--- a/application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/InterceptorConfig.java
+++ b/application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/InterceptorConfig.java
@@ -1,6 +1,10 @@
 package apelet.tenantadmin.config;
 
+import apelet.common.openapi.config.OpenApiProperties;
+import apelet.common.openapi.interceptor.OpenApiAuthInterceptor;
 import apelet.tenantadmin.interceptor.AuthenticationInterceptor;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@@ -14,8 +18,27 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 @Configuration
 public class InterceptorConfig implements WebMvcConfigurer {
 
+    @Autowired
+    private ObjectProvider<OpenApiAuthInterceptor> openApiAuthInterceptorProvider;
+    @Autowired
+    private OpenApiProperties openApiProperties;
+
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
-        registry.addInterceptor(new AuthenticationInterceptor()).addPathPatterns("/tenantadmin/**").addPathPatterns("/botp/**");
+        String openApiPrefix = openApiProperties.getUrlPrefix();
+        registry.addInterceptor(new AuthenticationInterceptor())
+                .addPathPatterns("/tenantadmin/**").addPathPatterns("/botp/**")
+                // OpenAPI 对外开放部分不依赖应用登录态：{prefix}/v1/** 由 OpenApiAuthInterceptor 校验 accessToken，
+                // {prefix}/auth/token 是公开的签发接口。这里一并排除，避免调用方误带 Authorization 头时
+                // 被登录态拦截器抢先拦下（它注册在前，会先执行）。
+                .excludePathPatterns(openApiPrefix + "/v1/**")
+                .excludePathPatterns(openApiPrefix + "/auth/**");
+        // OpenAPI 对外开放路由鉴权（{prefix}/v1/**）：校验 accessToken 并把 TokenData 注入请求上下文。
+        // 注意 HandlerInterceptor 即使标了 @Component 也不会被 Spring Boot 自动注册，必须在这里显式挂上；
+        // common-openapi.operationEnabled=false 时该 bean 不存在，getIfAvailable() 返回 null，跳过注册即可。
+        OpenApiAuthInterceptor openApiAuthInterceptor = openApiAuthInterceptorProvider.getIfAvailable();
+        if (openApiAuthInterceptor != null) {
+            registry.addInterceptor(openApiAuthInterceptor).addPathPatterns(openApiPrefix + "/v1/**");
+        }
     }
 }
diff --git a/common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiKbController.java b/common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiKbController.java
index 1f6d6b4..fad705e 100644
--- a/common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiKbController.java
+++ b/common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiKbController.java
@@ -45,6 +45,7 @@ public class OpenApiKbController {
      * @return 页面节点列表。
      */
     @PostMapping("/pageFormTree")
+    @NoAuthInterface
     public ResponseResult<List<OpenApiKbPageNodeDto>> pageFormTree(@RequestBody(required = false) OpenApiKbTreeQueryDto queryDto) {
         if (queryDto == null) {
             queryDto = new OpenApiKbTreeQueryDto();
@@ -61,6 +62,7 @@ public class OpenApiKbController {
      * @return data 为分页对象（list/pageNo/pageSize/total/hasMore）。
      */
     @PostMapping("/files")
+    @NoAuthInterface
     public ResponseResult<OpenApiKbFilePageDto> files(@RequestBody(required = false) OpenApiKbFileQueryDto queryDto) {
         if (queryDto == null) {
             return ResponseResult.error(ErrorCodeEnum.ARGUMENT_NULL_EXIST, "请求体不能为空！");
@@ -79,6 +81,7 @@ public class OpenApiKbController {
      * @throws IOException 写出应答时发生错误。
      */
     @GetMapping("/download")
+    @NoAuthInterface
     public void download(@RequestParam(required = false) Long formId,
                          @RequestParam(required = false) String dataId,
                          @RequestParam(required = false) String fieldName,