diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go
index 8091719..9bc51b0 100644
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -12,6 +12,7 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"github.com/hhs/camtalk/internal/api"
+	"github.com/hhs/camtalk/internal/auth"
 	"github.com/hhs/camtalk/internal/ai/llm"
 	"github.com/hhs/camtalk/internal/ai/stt"
 	"github.com/hhs/camtalk/internal/ai/tts"
@@ -60,6 +61,10 @@ func main() {
 		_ = pool
 	}
 
+	// 初始化 UserRepository（内存模式用于无 DB 场景）
+	var userRepo store.UserRepository
+	userRepo = store.NewMemUserRepository()
+
 	// 初始化 Session Manager（MVP 默认内存实现）
 	var sessionMgr session.Manager
 	// TODO: 当 Redis 配置非空时切换为 RedisManager
@@ -105,6 +110,14 @@ func main() {
 	// 初始化 Orchestrator
 	orch := orchestrator.New(sttService, llmService, ttsService, sessionMgr, cfg)
 
+	// 初始化认证服务
+	tokenMgr := auth.NewTokenManager(
+		cfg.Auth.JWTSecret,
+		time.Duration(cfg.Auth.AccessTTL)*time.Minute,
+		time.Duration(cfg.Auth.RefreshTTL)*time.Minute,
+	)
+	authService := auth.NewAuthService(tokenMgr, userRepo)
+
 	// Gin 模式
 	if cfg.App.Env == "prod" {
 		gin.SetMode(gin.ReleaseMode)
@@ -123,6 +136,10 @@ func main() {
 	sessionHandler := api.NewSessionHandler(sessionMgr)
 	sessionHandler.RegisterRoutes(apiGroup)
 
+	// Auth REST 端点
+	authHandler := api.NewAuthHandler(authService, tokenMgr)
+	authHandler.RegisterRoutes(apiGroup)
+
 	// WebSocket
 	r.GET("/ws", ws.ServeWS(sessionMgr, orch, cfg))