diff --git a/kenaito-conf-cpp-client/src/client.cpp b/kenaito-conf-cpp-client/src/client.cpp
index c923b70..99d0920 100644
--- a/kenaito-conf-cpp-client/src/client.cpp
+++ b/kenaito-conf-cpp-client/src/client.cpp
@@ -200,6 +200,7 @@ bool Client::fetch_changed() {
     payload["version"] = config_.version;
     payload["lastTime"] = last_time_;
     payload["ignoreGlobal"] = config_.ignore_global;
+    payload["token"] = config_.token;
 
     std::string resp = http_post(url, payload.dump());
     if (resp.empty()) {
diff --git a/kenaito-conf-dotnet-client/Client.cs b/kenaito-conf-dotnet-client/Client.cs
index 85f4447..96fedc8 100644
--- a/kenaito-conf-dotnet-client/Client.cs
+++ b/kenaito-conf-dotnet-client/Client.cs
@@ -136,7 +136,8 @@ public class Client
             env = _config.Env,
             version = _config.Version,
             lastTime = _lastTime,
-            ignoreGlobal = _config.IgnoreGlobal
+            ignoreGlobal = _config.IgnoreGlobal,
+            token = _config.Token
         };
         var content = new StringContent(JsonConvert.SerializeObject(payload), System.Text.Encoding.UTF8, "application/json");
         var response = await _httpClient.PostAsync(url, content);
diff --git a/kenaito-conf-rust-client/src/lib.rs b/kenaito-conf-rust-client/src/lib.rs
index 60448de..02334b8 100644
--- a/kenaito-conf-rust-client/src/lib.rs
+++ b/kenaito-conf-rust-client/src/lib.rs
@@ -238,6 +238,7 @@ impl Client {
             "version": self.config.version,
             "lastTime": *self.last_time.lock().unwrap(),
             "ignoreGlobal": self.config.ignore_global,
+            "token": self.config.token,
         });
 
         let resp = self.http_post(&url, &payload.to_string())?;
diff --git a/kenaito-conf-springboot2-client/src/main/java/cn/odboy/confcenter/ConfigcenterContext.java b/kenaito-conf-springboot2-client/src/main/java/cn/odboy/confcenter/ConfigcenterContext.java
index 4a1f2e7..d3f03e3 100644
--- a/kenaito-conf-springboot2-client/src/main/java/cn/odboy/confcenter/ConfigcenterContext.java
+++ b/kenaito-conf-springboot2-client/src/main/java/cn/odboy/confcenter/ConfigcenterContext.java
@@ -487,6 +487,10 @@ public class ConfigcenterContext {
         }
     }
 
+    public String getToken() {
+        return token;
+    }
+
     public String buildTokenParameter(String url) {
         if (token == null || token.isEmpty()) {
             return url;
diff --git a/kenaito-conf-springboot2-client/src/main/java/cn/odboy/confcenter/InternalConfigChangeListener.java b/kenaito-conf-springboot2-client/src/main/java/cn/odboy/confcenter/InternalConfigChangeListener.java
index 73d80c6..3e7c99b 100644
--- a/kenaito-conf-springboot2-client/src/main/java/cn/odboy/confcenter/InternalConfigChangeListener.java
+++ b/kenaito-conf-springboot2-client/src/main/java/cn/odboy/confcenter/InternalConfigChangeListener.java
@@ -48,12 +48,15 @@ public class InternalConfigChangeListener {
 			params.put("ignoreGlobal", String.valueOf(context.isIgnoreGlobal()));
 		}
 		params.put("lastTime", Long.parseLong(ConfigcenterContext.getProperty(LATEST_FETCH_TIMESTAMP, String.valueOf(System.currentTimeMillis()))));
+		if (context.getToken() != null && !context.getToken().isEmpty()) {
+			params.put("token", context.getToken());
+		}
 
 		hbScheduledExecutor.scheduleAtFixedRate(new Runnable() {
 			@Override
 			public void run() {
 				try {
-					String safeUrl = ConfigcenterContext.getInstance().buildTokenParameter(url);
+					String safeUrl = url;
 					String response = ConfigcenterContext.httpPostJson(safeUrl, JSON.toJSONString(params));
 					if (response != null) {
 						Map<String, Object> map = JSON.parseObject(response, Map.class);
diff --git a/kenaito-conf-springboot3-client/src/main/java/cn/odboy/confcenter/ConfigcenterContext.java b/kenaito-conf-springboot3-client/src/main/java/cn/odboy/confcenter/ConfigcenterContext.java
index cc4496f..2e43dbc 100644
--- a/kenaito-conf-springboot3-client/src/main/java/cn/odboy/confcenter/ConfigcenterContext.java
+++ b/kenaito-conf-springboot3-client/src/main/java/cn/odboy/confcenter/ConfigcenterContext.java
@@ -645,6 +645,10 @@ public class ConfigcenterContext {
 		}
 	}
 
+	public String getToken() {
+		return token;
+	}
+
 	public String buildTokenParameter(String url) {
 		if (StringUtils.isBlank(token)) {
 			return url;
diff --git a/kenaito-conf-springboot3-client/src/main/java/cn/odboy/confcenter/InternalConfigChangeListener.java b/kenaito-conf-springboot3-client/src/main/java/cn/odboy/confcenter/InternalConfigChangeListener.java
index 70c42e5..a467353 100644
--- a/kenaito-conf-springboot3-client/src/main/java/cn/odboy/confcenter/InternalConfigChangeListener.java
+++ b/kenaito-conf-springboot3-client/src/main/java/cn/odboy/confcenter/InternalConfigChangeListener.java
@@ -82,13 +82,16 @@ public class InternalConfigChangeListener {
 	@SuppressWarnings("unchecked")
 	private void poll(ConfigcenterContext context, String[] baseUrls) {
 		for (String baseUrl : baseUrls) {
-			String url = context.buildTokenParameter(baseUrl + "/api/fetchChangedConfigs");
+			String url = baseUrl + "/api/fetchChangedConfigs";
 			Map<String, Object> params = new HashMap<>();
 			params.put("version", context.getVersion());
 			params.put("appName", context.getApp());
 			params.put("env", context.getEnv());
 			params.put("ignoreGlobal", context.isIgnoreGlobal());
 			params.put("lastTime", lastTime);
+			if (context.getToken() != null && !context.getToken().isEmpty()) {
+				params.put("token", context.getToken());
+			}
 
 			String response;
 			try {
diff --git a/server/internal/handler/config_api.go b/server/internal/handler/config_api.go
index 8ff71db..63d7b68 100644
--- a/server/internal/handler/config_api.go
+++ b/server/internal/handler/config_api.go
@@ -86,7 +86,12 @@ func (h *ConfigApiHandler) FetchAllConfigs(c *gin.Context) {
 	}
 
 	// validate token if app has token configured
-	if app.Token != "" && app.Token != req.Token {
+	// 兼容旧版客户端把 token 放在 URL query 中的行为
+	token := req.Token
+	if token == "" {
+		token = c.Query("token")
+	}
+	if app.Token != "" && app.Token != token {
 		c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "Token 无效"})
 		return
 	}
@@ -173,7 +178,12 @@ func (h *ConfigApiHandler) FetchChangedConfigs(c *gin.Context) {
 	}
 
 	// validate token if app has token configured
-	if app.Token != "" && app.Token != req.Token {
+	// 兼容旧版客户端把 token 放在 URL query 中的行为
+	token := req.Token
+	if token == "" {
+		token = c.Query("token")
+	}
+	if app.Token != "" && app.Token != token {
 		c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "Token 无效"})
 		return
 	}