diff --git a/backend/bootstrap/app.php b/backend/bootstrap/app.php
index fe8cf5d..30d5b54 100644
--- a/backend/bootstrap/app.php
+++ b/backend/bootstrap/app.php
@@ -22,5 +22,9 @@ return Application::configure(basePath: dirname(__DIR__))
         // Removed statefulApi() — app uses Bearer token auth, not cookie SPA auth
     })
     ->withExceptions(function (Exceptions $exceptions): void {
-        //
+        $exceptions->render(function (\Illuminate\Auth\AuthenticationException $e, $request) {
+            if ($request->expectsJson() || $request->is('api/*')) {
+                return response()->json(['message' => '未认证，请先登录'], 401);
+            }
+        });
     })->create();