diff --git a/web/usercenter/lib/api/http.ts b/web/usercenter/lib/api/http.ts
index 9ee4254..4e7b2be 100644
--- a/web/usercenter/lib/api/http.ts
+++ b/web/usercenter/lib/api/http.ts
@@ -161,11 +161,14 @@ export class HttpClient implements ApiClient {
   async refresh(): Promise<Session> {
     const rt = getRefreshToken();
     if (!rt) throw new ApiError({ code: 'unauthorized', message_zh: '登录已失效', message_en: 'Session expired' });
+    // 服务端 /v1/auth/refresh 从 **请求体** {refresh_token} 读取(与原生 Flutter 客户端
+    // auth_api.dart 一致);此处曾误用 X-Refresh-Token 头(仅 /auth/logout 读头),导致
+    // 服务端拿到空 token → 400 invalid_request → 每次刷新页面即被登出。改回 body。
     const r = await this.request<RawTokenPair>('/v1/auth/refresh', {
       method: 'POST',
       auth: false,
       allowRefresh: false,
-      refreshToken: rt,
+      body: { refresh_token: rt },
     });
     const session = mapSession(r);
     setSession(session);