diff --git a/Src/Dlhis.Canteen/Order/Controllers/OrdersController.cs b/Src/Dlhis.Canteen/Order/Controllers/OrdersController.cs
index 44eca76f..2c0c6012 100644
--- a/Src/Dlhis.Canteen/Order/Controllers/OrdersController.cs
+++ b/Src/Dlhis.Canteen/Order/Controllers/OrdersController.cs
@@ -28,10 +28,11 @@ public class OrdersController : ControllerBase
     }
 
     /// <summary>
-    /// 添加充值
+    /// 消费
     /// </summary>
     /// <param name="request"></param>
     /// <returns></returns>
+    [Authorize(Policy = "consumer")]
     [HttpPost]
     [IgnoreTenant]
     public async Task<DefaultApiResult<OrderResultResponse>> AddAsync(OrderAddRequest request)
@@ -58,6 +59,7 @@ public class OrdersController : ControllerBase
     /// </summary>
     /// <param name="request"></param>
     /// <returns></returns>
+    [Authorize(Policy = "consumer")]
     [HttpPost("device")]
     [IgnoreTenant]
     public async Task<DefaultApiResult<OrderResultResponse>> DeviceConsume(OrderAddRequest request)
diff --git a/Src/Dlhis.Canteen/Program.cs b/Src/Dlhis.Canteen/Program.cs
index 8fa11358..8f18c30e 100644
--- a/Src/Dlhis.Canteen/Program.cs
+++ b/Src/Dlhis.Canteen/Program.cs
@@ -23,6 +23,13 @@ public class Startup : DefaultStartup
     {
         base.ConfigureServices(services);
         services.AddRedis();
+
+        services.AddAuthorization(options =>
+        {
+            options.AddPolicy("consumer", policy =>
+                policy.RequireClaim("client_consumer", "dl")
+            );
+        });
     }
 
     public override void Configure(IApplicationBuilder app, IWebHostEnvironment env)