diff --git a/src/adapters/auth/iot_auth.erl b/src/adapters/auth/iot_auth.erl
index b0b6305..4eef391 100644
--- a/src/adapters/auth/iot_auth.erl
+++ b/src/adapters/auth/iot_auth.erl
@@ -13,9 +13,8 @@
 -export([check/5]).
 
 %% 检测token是否是合法值
--spec check(Username :: binary(), Token :: binary(), UUID :: binary(), Salt :: binary(), Timestamp :: integer()) -> boolean().
-check(Username, Token, UUID, Salt, Timestamp) when is_binary(Username), is_binary(Token), is_binary(UUID), is_binary(Salt), is_integer(Timestamp) ->
-    true;
+-spec check(Username :: binary(), Token :: binary(), UUID :: binary(), Salt :: binary(), Timestamp :: integer()) ->
+    ok | {error, Reason :: binary()}.
 check(Username, Token, UUID, Salt, Timestamp) when is_binary(Username), is_binary(Token), is_binary(UUID), is_binary(Salt), is_integer(Timestamp) ->
     BinTimestamp = integer_to_binary(Timestamp),
     %% 1分钟内有效
@@ -24,10 +23,15 @@ check(Username, Token, UUID, Salt, Timestamp) when is_binary(Username), is_binar
             {ok, PreTokens} = application:get_env(iot, pre_tokens),
             case proplists:get_value(Username, PreTokens) of
                 undefined ->
-                    false;
+                    {error, <<"illegal user">>};
                 PreToken when is_binary(PreToken) ->
-                    iot_util:md5(<<Salt/binary, "!", PreToken/binary, "!", UUID/binary, "!", BinTimestamp/binary>>) =:= Token
+                    case iot_util:md5(<<Salt/binary, "!", PreToken/binary, "!", UUID/binary, "!", BinTimestamp/binary>>) =:= Token of
+                        true ->
+                            ok;
+                        false ->
+                            {error, <<"invalid token">>}
+                    end
             end;
         false ->
-            false
-    end.
+            {error, <<"invalid timestamp">>}
+    end.
\ No newline at end of file
diff --git a/src/transport/tcp/ssl_channel.erl b/src/transport/tcp/ssl_channel.erl
index 6c7a731..fbd833c 100644
--- a/src/transport/tcp/ssl_channel.erl
+++ b/src/transport/tcp/ssl_channel.erl
@@ -224,7 +224,7 @@ handle_request_frame(#'RequestFrame'{packet_id = PacketId,
 
     logger:debug("[ws_channel] auth uuid: ~p", [UUID]),
     case iot_auth:check(Username, Token, UUID, Salt, Timestamp) of
-        true ->
+        ok ->
             case iot_api_client:get_host_by_uuid(UUID) of
                 undefined ->
                     logger:warning("[ws_channel] uuid: ~p, user: ~p, host not found", [UUID, Username]),
@@ -248,9 +248,9 @@ handle_request_frame(#'RequestFrame'{packet_id = PacketId,
                             {stop, State}
                     end
             end;
-        false ->
-            send_reply_frame(Transport, Socket, PacketId, {error, #'ReplyFrame.Error'{code = 2, message = <<"auth failed">>}}),
-            logger:warning("[ws_channel] uuid: ~p, user: ~p, auth failed", [UUID, Username]),
+        {error, Reason} ->
+            send_reply_frame(Transport, Socket, PacketId, {error, #'ReplyFrame.Error'{code = 2, message = Reason}}),
+            logger:warning("[ws_channel] uuid: ~p, user: ~p, auth failed, reason: ~p", [UUID, Username, Reason]),
             {stop, State}
     end;
 handle_request_frame(#'RequestFrame'{packet_id = PacketId, body = {container_request, ContainerRequest}}, _Transport, _Socket, State) ->