diff --git a/core/init/router/router.go b/core/init/router/router.go
index 1c9bc1666..e5ad7ccd4 100644
--- a/core/init/router/router.go
+++ b/core/init/router/router.go
@@ -79,6 +79,7 @@ func Routers() *gin.Engine {
 	Router.Use(middleware.PasswordExpired())
 	Router.Use(middleware.WhiteAllow())
 	Router.Use(middleware.BindDomain())
+	Router.Use(middleware.ApiAuth())
 
 	PrivateGroup := Router.Group("/api/v2/core")
 	PrivateGroup.Use(middleware.SetPasswordPublicKey())
@@ -86,7 +87,6 @@ func Routers() *gin.Engine {
 		router.InitRouter(PrivateGroup)
 	}
 
-	Router.Use(middleware.ApiAuth())
 	Router.Use(Proxy())
 	Router.NoRoute(func(c *gin.Context) {
 		if !security.HandleNotRoute(c) {
diff --git a/core/middleware/session.go b/core/middleware/session.go
index 40550f815..979993f5c 100644
--- a/core/middleware/session.go
+++ b/core/middleware/session.go
@@ -12,7 +12,8 @@ import (
 
 func SessionAuth() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		if strings.HasPrefix(c.Request.URL.Path, "/api/v2/core/auth") {
+		apiReq := c.GetBool("API_AUTH")
+		if strings.HasPrefix(c.Request.URL.Path, "/api/v2/core/auth") || apiReq {
 			c.Next()
 			return
 		}