diff --git a/gen/go/sso/auth.pb.go b/gen/go/sso/auth.pb.go
index c859e4e..9a39317 100644
--- a/gen/go/sso/auth.pb.go
+++ b/gen/go/sso/auth.pb.go
@@ -913,6 +913,206 @@ func (x *TerminateSessionResponse) GetMessage() string {
 	return ""
 }
 
+type GenerateOauthCodeRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserId        string                 `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GenerateOauthCodeRequest) Reset() {
+	*x = GenerateOauthCodeRequest{}
+	mi := &file_sso_auth_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GenerateOauthCodeRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GenerateOauthCodeRequest) ProtoMessage() {}
+
+func (x *GenerateOauthCodeRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sso_auth_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GenerateOauthCodeRequest.ProtoReflect.Descriptor instead.
+func (*GenerateOauthCodeRequest) Descriptor() ([]byte, []int) {
+	return file_sso_auth_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *GenerateOauthCodeRequest) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+type GenerateOauthCodeResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Code          string                 `protobuf:"bytes,1,opt,name=code,proto3" json:"code,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GenerateOauthCodeResponse) Reset() {
+	*x = GenerateOauthCodeResponse{}
+	mi := &file_sso_auth_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GenerateOauthCodeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GenerateOauthCodeResponse) ProtoMessage() {}
+
+func (x *GenerateOauthCodeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sso_auth_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GenerateOauthCodeResponse.ProtoReflect.Descriptor instead.
+func (*GenerateOauthCodeResponse) Descriptor() ([]byte, []int) {
+	return file_sso_auth_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *GenerateOauthCodeResponse) GetCode() string {
+	if x != nil {
+		return x.Code
+	}
+	return ""
+}
+
+type ExchangeOauthCodeRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Code          string                 `protobuf:"bytes,1,opt,name=code,proto3" json:"code,omitempty"`
+	ClientId      string                 `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	ClientSecret  string                 `protobuf:"bytes,3,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExchangeOauthCodeRequest) Reset() {
+	*x = ExchangeOauthCodeRequest{}
+	mi := &file_sso_auth_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExchangeOauthCodeRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExchangeOauthCodeRequest) ProtoMessage() {}
+
+func (x *ExchangeOauthCodeRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sso_auth_proto_msgTypes[17]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExchangeOauthCodeRequest.ProtoReflect.Descriptor instead.
+func (*ExchangeOauthCodeRequest) Descriptor() ([]byte, []int) {
+	return file_sso_auth_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *ExchangeOauthCodeRequest) GetCode() string {
+	if x != nil {
+		return x.Code
+	}
+	return ""
+}
+
+func (x *ExchangeOauthCodeRequest) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *ExchangeOauthCodeRequest) GetClientSecret() string {
+	if x != nil {
+		return x.ClientSecret
+	}
+	return ""
+}
+
+type ExchangeOauthCodeResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	AccessToken   string                 `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
+	ExpiresIn     int32                  `protobuf:"varint,2,opt,name=expires_in,json=expiresIn,proto3" json:"expires_in,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExchangeOauthCodeResponse) Reset() {
+	*x = ExchangeOauthCodeResponse{}
+	mi := &file_sso_auth_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExchangeOauthCodeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExchangeOauthCodeResponse) ProtoMessage() {}
+
+func (x *ExchangeOauthCodeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sso_auth_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExchangeOauthCodeResponse.ProtoReflect.Descriptor instead.
+func (*ExchangeOauthCodeResponse) Descriptor() ([]byte, []int) {
+	return file_sso_auth_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *ExchangeOauthCodeResponse) GetAccessToken() string {
+	if x != nil {
+		return x.AccessToken
+	}
+	return ""
+}
+
+func (x *ExchangeOauthCodeResponse) GetExpiresIn() int32 {
+	if x != nil {
+		return x.ExpiresIn
+	}
+	return 0
+}
+
 type SystemCreateAccountRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Username      string                 `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
@@ -924,7 +1124,7 @@ type SystemCreateAccountRequest struct {
 
 func (x *SystemCreateAccountRequest) Reset() {
 	*x = SystemCreateAccountRequest{}
-	mi := &file_sso_auth_proto_msgTypes[15]
+	mi := &file_sso_auth_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -936,7 +1136,7 @@ func (x *SystemCreateAccountRequest) String() string {
 func (*SystemCreateAccountRequest) ProtoMessage() {}
 
 func (x *SystemCreateAccountRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[15]
+	mi := &file_sso_auth_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -949,7 +1149,7 @@ func (x *SystemCreateAccountRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemCreateAccountRequest.ProtoReflect.Descriptor instead.
 func (*SystemCreateAccountRequest) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{15}
+	return file_sso_auth_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *SystemCreateAccountRequest) GetUsername() string {
@@ -982,7 +1182,7 @@ type SystemCreateAccountResponse struct {
 
 func (x *SystemCreateAccountResponse) Reset() {
 	*x = SystemCreateAccountResponse{}
-	mi := &file_sso_auth_proto_msgTypes[16]
+	mi := &file_sso_auth_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -994,7 +1194,7 @@ func (x *SystemCreateAccountResponse) String() string {
 func (*SystemCreateAccountResponse) ProtoMessage() {}
 
 func (x *SystemCreateAccountResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[16]
+	mi := &file_sso_auth_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1007,7 +1207,7 @@ func (x *SystemCreateAccountResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemCreateAccountResponse.ProtoReflect.Descriptor instead.
 func (*SystemCreateAccountResponse) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{16}
+	return file_sso_auth_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *SystemCreateAccountResponse) GetAccountId() string {
@@ -1027,7 +1227,7 @@ type SystemChangeStatusRequest struct {
 
 func (x *SystemChangeStatusRequest) Reset() {
 	*x = SystemChangeStatusRequest{}
-	mi := &file_sso_auth_proto_msgTypes[17]
+	mi := &file_sso_auth_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1039,7 +1239,7 @@ func (x *SystemChangeStatusRequest) String() string {
 func (*SystemChangeStatusRequest) ProtoMessage() {}
 
 func (x *SystemChangeStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[17]
+	mi := &file_sso_auth_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1052,7 +1252,7 @@ func (x *SystemChangeStatusRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemChangeStatusRequest.ProtoReflect.Descriptor instead.
 func (*SystemChangeStatusRequest) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{17}
+	return file_sso_auth_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *SystemChangeStatusRequest) GetAccountId() string {
@@ -1078,7 +1278,7 @@ type SystemChangeStatusResponse struct {
 
 func (x *SystemChangeStatusResponse) Reset() {
 	*x = SystemChangeStatusResponse{}
-	mi := &file_sso_auth_proto_msgTypes[18]
+	mi := &file_sso_auth_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1090,7 +1290,7 @@ func (x *SystemChangeStatusResponse) String() string {
 func (*SystemChangeStatusResponse) ProtoMessage() {}
 
 func (x *SystemChangeStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[18]
+	mi := &file_sso_auth_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1103,7 +1303,7 @@ func (x *SystemChangeStatusResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemChangeStatusResponse.ProtoReflect.Descriptor instead.
 func (*SystemChangeStatusResponse) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{18}
+	return file_sso_auth_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *SystemChangeStatusResponse) GetSuccess() bool {
@@ -1123,7 +1323,7 @@ type SystemUpdatePasswordRequest struct {
 
 func (x *SystemUpdatePasswordRequest) Reset() {
 	*x = SystemUpdatePasswordRequest{}
-	mi := &file_sso_auth_proto_msgTypes[19]
+	mi := &file_sso_auth_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1135,7 +1335,7 @@ func (x *SystemUpdatePasswordRequest) String() string {
 func (*SystemUpdatePasswordRequest) ProtoMessage() {}
 
 func (x *SystemUpdatePasswordRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[19]
+	mi := &file_sso_auth_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1148,7 +1348,7 @@ func (x *SystemUpdatePasswordRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemUpdatePasswordRequest.ProtoReflect.Descriptor instead.
 func (*SystemUpdatePasswordRequest) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{19}
+	return file_sso_auth_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *SystemUpdatePasswordRequest) GetAccountId() string {
@@ -1174,7 +1374,7 @@ type SystemUpdatePasswordResponse struct {
 
 func (x *SystemUpdatePasswordResponse) Reset() {
 	*x = SystemUpdatePasswordResponse{}
-	mi := &file_sso_auth_proto_msgTypes[20]
+	mi := &file_sso_auth_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1186,7 +1386,7 @@ func (x *SystemUpdatePasswordResponse) String() string {
 func (*SystemUpdatePasswordResponse) ProtoMessage() {}
 
 func (x *SystemUpdatePasswordResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[20]
+	mi := &file_sso_auth_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1199,7 +1399,7 @@ func (x *SystemUpdatePasswordResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemUpdatePasswordResponse.ProtoReflect.Descriptor instead.
 func (*SystemUpdatePasswordResponse) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{20}
+	return file_sso_auth_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *SystemUpdatePasswordResponse) GetSuccess() bool {
@@ -1219,7 +1419,7 @@ type SystemUpdatePinRequest struct {
 
 func (x *SystemUpdatePinRequest) Reset() {
 	*x = SystemUpdatePinRequest{}
-	mi := &file_sso_auth_proto_msgTypes[21]
+	mi := &file_sso_auth_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1231,7 +1431,7 @@ func (x *SystemUpdatePinRequest) String() string {
 func (*SystemUpdatePinRequest) ProtoMessage() {}
 
 func (x *SystemUpdatePinRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[21]
+	mi := &file_sso_auth_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1244,7 +1444,7 @@ func (x *SystemUpdatePinRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemUpdatePinRequest.ProtoReflect.Descriptor instead.
 func (*SystemUpdatePinRequest) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{21}
+	return file_sso_auth_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *SystemUpdatePinRequest) GetAccountId() string {
@@ -1270,7 +1470,7 @@ type SystemUpdatePinResponse struct {
 
 func (x *SystemUpdatePinResponse) Reset() {
 	*x = SystemUpdatePinResponse{}
-	mi := &file_sso_auth_proto_msgTypes[22]
+	mi := &file_sso_auth_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1282,7 +1482,7 @@ func (x *SystemUpdatePinResponse) String() string {
 func (*SystemUpdatePinResponse) ProtoMessage() {}
 
 func (x *SystemUpdatePinResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[22]
+	mi := &file_sso_auth_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1295,7 +1495,7 @@ func (x *SystemUpdatePinResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemUpdatePinResponse.ProtoReflect.Descriptor instead.
 func (*SystemUpdatePinResponse) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{22}
+	return file_sso_auth_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *SystemUpdatePinResponse) GetSuccess() bool {
@@ -1316,7 +1516,7 @@ type SystemBlockIpRequest struct {
 
 func (x *SystemBlockIpRequest) Reset() {
 	*x = SystemBlockIpRequest{}
-	mi := &file_sso_auth_proto_msgTypes[23]
+	mi := &file_sso_auth_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1328,7 +1528,7 @@ func (x *SystemBlockIpRequest) String() string {
 func (*SystemBlockIpRequest) ProtoMessage() {}
 
 func (x *SystemBlockIpRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[23]
+	mi := &file_sso_auth_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1341,7 +1541,7 @@ func (x *SystemBlockIpRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemBlockIpRequest.ProtoReflect.Descriptor instead.
 func (*SystemBlockIpRequest) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{23}
+	return file_sso_auth_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *SystemBlockIpRequest) GetIpAddress() string {
@@ -1374,7 +1574,7 @@ type SystemBlockIpResponse struct {
 
 func (x *SystemBlockIpResponse) Reset() {
 	*x = SystemBlockIpResponse{}
-	mi := &file_sso_auth_proto_msgTypes[24]
+	mi := &file_sso_auth_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1386,7 +1586,7 @@ func (x *SystemBlockIpResponse) String() string {
 func (*SystemBlockIpResponse) ProtoMessage() {}
 
 func (x *SystemBlockIpResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[24]
+	mi := &file_sso_auth_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1399,7 +1599,7 @@ func (x *SystemBlockIpResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemBlockIpResponse.ProtoReflect.Descriptor instead.
 func (*SystemBlockIpResponse) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{24}
+	return file_sso_auth_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *SystemBlockIpResponse) GetSuccess() bool {
@@ -1418,7 +1618,7 @@ type SystemUnblockIpRequest struct {
 
 func (x *SystemUnblockIpRequest) Reset() {
 	*x = SystemUnblockIpRequest{}
-	mi := &file_sso_auth_proto_msgTypes[25]
+	mi := &file_sso_auth_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1430,7 +1630,7 @@ func (x *SystemUnblockIpRequest) String() string {
 func (*SystemUnblockIpRequest) ProtoMessage() {}
 
 func (x *SystemUnblockIpRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[25]
+	mi := &file_sso_auth_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1443,7 +1643,7 @@ func (x *SystemUnblockIpRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemUnblockIpRequest.ProtoReflect.Descriptor instead.
 func (*SystemUnblockIpRequest) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{25}
+	return file_sso_auth_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *SystemUnblockIpRequest) GetIpAddress() string {
@@ -1462,7 +1662,7 @@ type SystemUnblockIpResponse struct {
 
 func (x *SystemUnblockIpResponse) Reset() {
 	*x = SystemUnblockIpResponse{}
-	mi := &file_sso_auth_proto_msgTypes[26]
+	mi := &file_sso_auth_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1474,7 +1674,7 @@ func (x *SystemUnblockIpResponse) String() string {
 func (*SystemUnblockIpResponse) ProtoMessage() {}
 
 func (x *SystemUnblockIpResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[26]
+	mi := &file_sso_auth_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1487,7 +1687,7 @@ func (x *SystemUnblockIpResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemUnblockIpResponse.ProtoReflect.Descriptor instead.
 func (*SystemUnblockIpResponse) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{26}
+	return file_sso_auth_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *SystemUnblockIpResponse) GetSuccess() bool {
@@ -1507,7 +1707,7 @@ type SystemGetAllAccountsRequest struct {
 
 func (x *SystemGetAllAccountsRequest) Reset() {
 	*x = SystemGetAllAccountsRequest{}
-	mi := &file_sso_auth_proto_msgTypes[27]
+	mi := &file_sso_auth_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1519,7 +1719,7 @@ func (x *SystemGetAllAccountsRequest) String() string {
 func (*SystemGetAllAccountsRequest) ProtoMessage() {}
 
 func (x *SystemGetAllAccountsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[27]
+	mi := &file_sso_auth_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1532,7 +1732,7 @@ func (x *SystemGetAllAccountsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemGetAllAccountsRequest.ProtoReflect.Descriptor instead.
 func (*SystemGetAllAccountsRequest) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{27}
+	return file_sso_auth_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *SystemGetAllAccountsRequest) GetLimit() int32 {
@@ -1560,7 +1760,7 @@ type AccountBasicItem struct {
 
 func (x *AccountBasicItem) Reset() {
 	*x = AccountBasicItem{}
-	mi := &file_sso_auth_proto_msgTypes[28]
+	mi := &file_sso_auth_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1572,7 +1772,7 @@ func (x *AccountBasicItem) String() string {
 func (*AccountBasicItem) ProtoMessage() {}
 
 func (x *AccountBasicItem) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[28]
+	mi := &file_sso_auth_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1585,7 +1785,7 @@ func (x *AccountBasicItem) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccountBasicItem.ProtoReflect.Descriptor instead.
 func (*AccountBasicItem) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{28}
+	return file_sso_auth_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *AccountBasicItem) GetId() string {
@@ -1619,7 +1819,7 @@ type SystemGetAllAccountsResponse struct {
 
 func (x *SystemGetAllAccountsResponse) Reset() {
 	*x = SystemGetAllAccountsResponse{}
-	mi := &file_sso_auth_proto_msgTypes[29]
+	mi := &file_sso_auth_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1631,7 +1831,7 @@ func (x *SystemGetAllAccountsResponse) String() string {
 func (*SystemGetAllAccountsResponse) ProtoMessage() {}
 
 func (x *SystemGetAllAccountsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sso_auth_proto_msgTypes[29]
+	mi := &file_sso_auth_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1644,7 +1844,7 @@ func (x *SystemGetAllAccountsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemGetAllAccountsResponse.ProtoReflect.Descriptor instead.
 func (*SystemGetAllAccountsResponse) Descriptor() ([]byte, []int) {
-	return file_sso_auth_proto_rawDescGZIP(), []int{29}
+	return file_sso_auth_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *SystemGetAllAccountsResponse) GetAccounts() []*AccountBasicItem {
@@ -1748,7 +1948,19 @@ const file_sso_auth_proto_rawDesc = "" +
 	"targetHash\"N\n" +
 	"\x18TerminateSessionResponse\x12\x18\n" +
 	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x18\n" +
-	"\amessage\x18\x02 \x01(\tR\amessage\"v\n" +
+	"\amessage\x18\x02 \x01(\tR\amessage\"3\n" +
+	"\x18GenerateOauthCodeRequest\x12\x17\n" +
+	"\auser_id\x18\x01 \x01(\tR\x06userId\"/\n" +
+	"\x19GenerateOauthCodeResponse\x12\x12\n" +
+	"\x04code\x18\x01 \x01(\tR\x04code\"p\n" +
+	"\x18ExchangeOauthCodeRequest\x12\x12\n" +
+	"\x04code\x18\x01 \x01(\tR\x04code\x12\x1b\n" +
+	"\tclient_id\x18\x02 \x01(\tR\bclientId\x12#\n" +
+	"\rclient_secret\x18\x03 \x01(\tR\fclientSecret\"]\n" +
+	"\x19ExchangeOauthCodeResponse\x12!\n" +
+	"\faccess_token\x18\x01 \x01(\tR\vaccessToken\x12\x1d\n" +
+	"\n" +
+	"expires_in\x18\x02 \x01(\x05R\texpiresIn\"v\n" +
 	"\x1aSystemCreateAccountRequest\x12\x1a\n" +
 	"\busername\x18\x01 \x01(\tR\busername\x12#\n" +
 	"\rpassword_hash\x18\x02 \x01(\tR\fpasswordHash\x12\x17\n" +
@@ -1797,7 +2009,7 @@ const file_sso_auth_proto_rawDesc = "" +
 	"\x06status\x18\x03 \x01(\tR\x06status\"k\n" +
 	"\x1cSystemGetAllAccountsResponse\x125\n" +
 	"\baccounts\x18\x01 \x03(\v2\x19.auth.v1.AccountBasicItemR\baccounts\x12\x14\n" +
-	"\x05total\x18\x02 \x01(\x05R\x05total2\xd3\t\n" +
+	"\x05total\x18\x02 \x01(\x05R\x05total2\x8b\v\n" +
 	"\vAuthService\x126\n" +
 	"\x05Login\x12\x15.auth.v1.LoginRequest\x1a\x16.auth.v1.LoginResponse\x12<\n" +
 	"\aRefresh\x12\x17.auth.v1.RefreshRequest\x1a\x18.auth.v1.RefreshResponse\x12H\n" +
@@ -1806,7 +2018,9 @@ const file_sso_auth_proto_rawDesc = "" +
 	"\x06Logout\x12\x16.auth.v1.LogoutRequest\x1a\x17.auth.v1.LogoutResponse\x12>\n" +
 	"\vLogoutOther\x12\x16.auth.v1.LogoutRequest\x1a\x17.auth.v1.LogoutResponse\x12G\n" +
 	"\vGetSessions\x12\x1a.auth.v1.GetSessionRequest\x1a\x1c.auth.v1.GetSessionsResponse\x12W\n" +
-	"\x10TerminateSession\x12 .auth.v1.TerminateSessionRequest\x1a!.auth.v1.TerminateSessionResponse\x12`\n" +
+	"\x10TerminateSession\x12 .auth.v1.TerminateSessionRequest\x1a!.auth.v1.TerminateSessionResponse\x12Z\n" +
+	"\x11GenerateOauthCode\x12!.auth.v1.GenerateOauthCodeRequest\x1a\".auth.v1.GenerateOauthCodeResponse\x12Z\n" +
+	"\x11ExchangeOauthCode\x12!.auth.v1.ExchangeOauthCodeRequest\x1a\".auth.v1.ExchangeOauthCodeResponse\x12`\n" +
 	"\x13SystemCreateAccount\x12#.auth.v1.SystemCreateAccountRequest\x1a$.auth.v1.SystemCreateAccountResponse\x12]\n" +
 	"\x12SystemChangeStatus\x12\".auth.v1.SystemChangeStatusRequest\x1a#.auth.v1.SystemChangeStatusResponse\x12c\n" +
 	"\x14SystemUpdatePassword\x12$.auth.v1.SystemUpdatePasswordRequest\x1a%.auth.v1.SystemUpdatePasswordResponse\x12T\n" +
@@ -1827,7 +2041,7 @@ func file_sso_auth_proto_rawDescGZIP() []byte {
 	return file_sso_auth_proto_rawDescData
 }
 
-var file_sso_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 30)
+var file_sso_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 34)
 var file_sso_auth_proto_goTypes = []any{
 	(*LoginRequest)(nil),                 // 0: auth.v1.LoginRequest
 	(*LoginResponse)(nil),                // 1: auth.v1.LoginResponse
@@ -1844,25 +2058,29 @@ var file_sso_auth_proto_goTypes = []any{
 	(*GetSessionsResponse)(nil),          // 12: auth.v1.GetSessionsResponse
 	(*TerminateSessionRequest)(nil),      // 13: auth.v1.TerminateSessionRequest
 	(*TerminateSessionResponse)(nil),     // 14: auth.v1.TerminateSessionResponse
-	(*SystemCreateAccountRequest)(nil),   // 15: auth.v1.SystemCreateAccountRequest
-	(*SystemCreateAccountResponse)(nil),  // 16: auth.v1.SystemCreateAccountResponse
-	(*SystemChangeStatusRequest)(nil),    // 17: auth.v1.SystemChangeStatusRequest
-	(*SystemChangeStatusResponse)(nil),   // 18: auth.v1.SystemChangeStatusResponse
-	(*SystemUpdatePasswordRequest)(nil),  // 19: auth.v1.SystemUpdatePasswordRequest
-	(*SystemUpdatePasswordResponse)(nil), // 20: auth.v1.SystemUpdatePasswordResponse
-	(*SystemUpdatePinRequest)(nil),       // 21: auth.v1.SystemUpdatePinRequest
-	(*SystemUpdatePinResponse)(nil),      // 22: auth.v1.SystemUpdatePinResponse
-	(*SystemBlockIpRequest)(nil),         // 23: auth.v1.SystemBlockIpRequest
-	(*SystemBlockIpResponse)(nil),        // 24: auth.v1.SystemBlockIpResponse
-	(*SystemUnblockIpRequest)(nil),       // 25: auth.v1.SystemUnblockIpRequest
-	(*SystemUnblockIpResponse)(nil),      // 26: auth.v1.SystemUnblockIpResponse
-	(*SystemGetAllAccountsRequest)(nil),  // 27: auth.v1.SystemGetAllAccountsRequest
-	(*AccountBasicItem)(nil),             // 28: auth.v1.AccountBasicItem
-	(*SystemGetAllAccountsResponse)(nil), // 29: auth.v1.SystemGetAllAccountsResponse
+	(*GenerateOauthCodeRequest)(nil),     // 15: auth.v1.GenerateOauthCodeRequest
+	(*GenerateOauthCodeResponse)(nil),    // 16: auth.v1.GenerateOauthCodeResponse
+	(*ExchangeOauthCodeRequest)(nil),     // 17: auth.v1.ExchangeOauthCodeRequest
+	(*ExchangeOauthCodeResponse)(nil),    // 18: auth.v1.ExchangeOauthCodeResponse
+	(*SystemCreateAccountRequest)(nil),   // 19: auth.v1.SystemCreateAccountRequest
+	(*SystemCreateAccountResponse)(nil),  // 20: auth.v1.SystemCreateAccountResponse
+	(*SystemChangeStatusRequest)(nil),    // 21: auth.v1.SystemChangeStatusRequest
+	(*SystemChangeStatusResponse)(nil),   // 22: auth.v1.SystemChangeStatusResponse
+	(*SystemUpdatePasswordRequest)(nil),  // 23: auth.v1.SystemUpdatePasswordRequest
+	(*SystemUpdatePasswordResponse)(nil), // 24: auth.v1.SystemUpdatePasswordResponse
+	(*SystemUpdatePinRequest)(nil),       // 25: auth.v1.SystemUpdatePinRequest
+	(*SystemUpdatePinResponse)(nil),      // 26: auth.v1.SystemUpdatePinResponse
+	(*SystemBlockIpRequest)(nil),         // 27: auth.v1.SystemBlockIpRequest
+	(*SystemBlockIpResponse)(nil),        // 28: auth.v1.SystemBlockIpResponse
+	(*SystemUnblockIpRequest)(nil),       // 29: auth.v1.SystemUnblockIpRequest
+	(*SystemUnblockIpResponse)(nil),      // 30: auth.v1.SystemUnblockIpResponse
+	(*SystemGetAllAccountsRequest)(nil),  // 31: auth.v1.SystemGetAllAccountsRequest
+	(*AccountBasicItem)(nil),             // 32: auth.v1.AccountBasicItem
+	(*SystemGetAllAccountsResponse)(nil), // 33: auth.v1.SystemGetAllAccountsResponse
 }
 var file_sso_auth_proto_depIdxs = []int32{
 	11, // 0: auth.v1.GetSessionsResponse.sessions:type_name -> auth.v1.SessionItem
-	28, // 1: auth.v1.SystemGetAllAccountsResponse.accounts:type_name -> auth.v1.AccountBasicItem
+	32, // 1: auth.v1.SystemGetAllAccountsResponse.accounts:type_name -> auth.v1.AccountBasicItem
 	0,  // 2: auth.v1.AuthService.Login:input_type -> auth.v1.LoginRequest
 	2,  // 3: auth.v1.AuthService.Refresh:input_type -> auth.v1.RefreshRequest
 	6,  // 4: auth.v1.AuthService.VerifyToken:input_type -> auth.v1.VerifyTokenRequest
@@ -1871,30 +2089,34 @@ var file_sso_auth_proto_depIdxs = []int32{
 	4,  // 7: auth.v1.AuthService.LogoutOther:input_type -> auth.v1.LogoutRequest
 	10, // 8: auth.v1.AuthService.GetSessions:input_type -> auth.v1.GetSessionRequest
 	13, // 9: auth.v1.AuthService.TerminateSession:input_type -> auth.v1.TerminateSessionRequest
-	15, // 10: auth.v1.AuthService.SystemCreateAccount:input_type -> auth.v1.SystemCreateAccountRequest
-	17, // 11: auth.v1.AuthService.SystemChangeStatus:input_type -> auth.v1.SystemChangeStatusRequest
-	19, // 12: auth.v1.AuthService.SystemUpdatePassword:input_type -> auth.v1.SystemUpdatePasswordRequest
-	21, // 13: auth.v1.AuthService.SystemUpdatePin:input_type -> auth.v1.SystemUpdatePinRequest
-	23, // 14: auth.v1.AuthService.SystemBlockIp:input_type -> auth.v1.SystemBlockIpRequest
-	25, // 15: auth.v1.AuthService.SystemUnblockIp:input_type -> auth.v1.SystemUnblockIpRequest
-	27, // 16: auth.v1.AuthService.SystemGetAllAccounts:input_type -> auth.v1.SystemGetAllAccountsRequest
-	1,  // 17: auth.v1.AuthService.Login:output_type -> auth.v1.LoginResponse
-	3,  // 18: auth.v1.AuthService.Refresh:output_type -> auth.v1.RefreshResponse
-	7,  // 19: auth.v1.AuthService.VerifyToken:output_type -> auth.v1.VerifyTokenResponse
-	9,  // 20: auth.v1.AuthService.GetAccountRoleLevel:output_type -> auth.v1.GetAccountRoleLevelResponse
-	5,  // 21: auth.v1.AuthService.Logout:output_type -> auth.v1.LogoutResponse
-	5,  // 22: auth.v1.AuthService.LogoutOther:output_type -> auth.v1.LogoutResponse
-	12, // 23: auth.v1.AuthService.GetSessions:output_type -> auth.v1.GetSessionsResponse
-	14, // 24: auth.v1.AuthService.TerminateSession:output_type -> auth.v1.TerminateSessionResponse
-	16, // 25: auth.v1.AuthService.SystemCreateAccount:output_type -> auth.v1.SystemCreateAccountResponse
-	18, // 26: auth.v1.AuthService.SystemChangeStatus:output_type -> auth.v1.SystemChangeStatusResponse
-	20, // 27: auth.v1.AuthService.SystemUpdatePassword:output_type -> auth.v1.SystemUpdatePasswordResponse
-	22, // 28: auth.v1.AuthService.SystemUpdatePin:output_type -> auth.v1.SystemUpdatePinResponse
-	24, // 29: auth.v1.AuthService.SystemBlockIp:output_type -> auth.v1.SystemBlockIpResponse
-	26, // 30: auth.v1.AuthService.SystemUnblockIp:output_type -> auth.v1.SystemUnblockIpResponse
-	29, // 31: auth.v1.AuthService.SystemGetAllAccounts:output_type -> auth.v1.SystemGetAllAccountsResponse
-	17, // [17:32] is the sub-list for method output_type
-	2,  // [2:17] is the sub-list for method input_type
+	15, // 10: auth.v1.AuthService.GenerateOauthCode:input_type -> auth.v1.GenerateOauthCodeRequest
+	17, // 11: auth.v1.AuthService.ExchangeOauthCode:input_type -> auth.v1.ExchangeOauthCodeRequest
+	19, // 12: auth.v1.AuthService.SystemCreateAccount:input_type -> auth.v1.SystemCreateAccountRequest
+	21, // 13: auth.v1.AuthService.SystemChangeStatus:input_type -> auth.v1.SystemChangeStatusRequest
+	23, // 14: auth.v1.AuthService.SystemUpdatePassword:input_type -> auth.v1.SystemUpdatePasswordRequest
+	25, // 15: auth.v1.AuthService.SystemUpdatePin:input_type -> auth.v1.SystemUpdatePinRequest
+	27, // 16: auth.v1.AuthService.SystemBlockIp:input_type -> auth.v1.SystemBlockIpRequest
+	29, // 17: auth.v1.AuthService.SystemUnblockIp:input_type -> auth.v1.SystemUnblockIpRequest
+	31, // 18: auth.v1.AuthService.SystemGetAllAccounts:input_type -> auth.v1.SystemGetAllAccountsRequest
+	1,  // 19: auth.v1.AuthService.Login:output_type -> auth.v1.LoginResponse
+	3,  // 20: auth.v1.AuthService.Refresh:output_type -> auth.v1.RefreshResponse
+	7,  // 21: auth.v1.AuthService.VerifyToken:output_type -> auth.v1.VerifyTokenResponse
+	9,  // 22: auth.v1.AuthService.GetAccountRoleLevel:output_type -> auth.v1.GetAccountRoleLevelResponse
+	5,  // 23: auth.v1.AuthService.Logout:output_type -> auth.v1.LogoutResponse
+	5,  // 24: auth.v1.AuthService.LogoutOther:output_type -> auth.v1.LogoutResponse
+	12, // 25: auth.v1.AuthService.GetSessions:output_type -> auth.v1.GetSessionsResponse
+	14, // 26: auth.v1.AuthService.TerminateSession:output_type -> auth.v1.TerminateSessionResponse
+	16, // 27: auth.v1.AuthService.GenerateOauthCode:output_type -> auth.v1.GenerateOauthCodeResponse
+	18, // 28: auth.v1.AuthService.ExchangeOauthCode:output_type -> auth.v1.ExchangeOauthCodeResponse
+	20, // 29: auth.v1.AuthService.SystemCreateAccount:output_type -> auth.v1.SystemCreateAccountResponse
+	22, // 30: auth.v1.AuthService.SystemChangeStatus:output_type -> auth.v1.SystemChangeStatusResponse
+	24, // 31: auth.v1.AuthService.SystemUpdatePassword:output_type -> auth.v1.SystemUpdatePasswordResponse
+	26, // 32: auth.v1.AuthService.SystemUpdatePin:output_type -> auth.v1.SystemUpdatePinResponse
+	28, // 33: auth.v1.AuthService.SystemBlockIp:output_type -> auth.v1.SystemBlockIpResponse
+	30, // 34: auth.v1.AuthService.SystemUnblockIp:output_type -> auth.v1.SystemUnblockIpResponse
+	33, // 35: auth.v1.AuthService.SystemGetAllAccounts:output_type -> auth.v1.SystemGetAllAccountsResponse
+	19, // [19:36] is the sub-list for method output_type
+	2,  // [2:19] is the sub-list for method input_type
 	2,  // [2:2] is the sub-list for extension type_name
 	2,  // [2:2] is the sub-list for extension extendee
 	0,  // [0:2] is the sub-list for field type_name
@@ -1907,15 +2129,15 @@ func file_sso_auth_proto_init() {
 	}
 	file_sso_auth_proto_msgTypes[1].OneofWrappers = []any{}
 	file_sso_auth_proto_msgTypes[7].OneofWrappers = []any{}
-	file_sso_auth_proto_msgTypes[21].OneofWrappers = []any{}
-	file_sso_auth_proto_msgTypes[23].OneofWrappers = []any{}
+	file_sso_auth_proto_msgTypes[25].OneofWrappers = []any{}
+	file_sso_auth_proto_msgTypes[27].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sso_auth_proto_rawDesc), len(file_sso_auth_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   30,
+			NumMessages:   34,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/go/sso/auth_grpc.pb.go b/gen/go/sso/auth_grpc.pb.go
index ba2beb2..742a0e1 100644
--- a/gen/go/sso/auth_grpc.pb.go
+++ b/gen/go/sso/auth_grpc.pb.go
@@ -27,6 +27,8 @@ const (
 	AuthService_LogoutOther_FullMethodName          = "/auth.v1.AuthService/LogoutOther"
 	AuthService_GetSessions_FullMethodName          = "/auth.v1.AuthService/GetSessions"
 	AuthService_TerminateSession_FullMethodName     = "/auth.v1.AuthService/TerminateSession"
+	AuthService_GenerateOauthCode_FullMethodName    = "/auth.v1.AuthService/GenerateOauthCode"
+	AuthService_ExchangeOauthCode_FullMethodName    = "/auth.v1.AuthService/ExchangeOauthCode"
 	AuthService_SystemCreateAccount_FullMethodName  = "/auth.v1.AuthService/SystemCreateAccount"
 	AuthService_SystemChangeStatus_FullMethodName   = "/auth.v1.AuthService/SystemChangeStatus"
 	AuthService_SystemUpdatePassword_FullMethodName = "/auth.v1.AuthService/SystemUpdatePassword"
@@ -48,6 +50,9 @@ type AuthServiceClient interface {
 	LogoutOther(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*LogoutResponse, error)
 	GetSessions(ctx context.Context, in *GetSessionRequest, opts ...grpc.CallOption) (*GetSessionsResponse, error)
 	TerminateSession(ctx context.Context, in *TerminateSessionRequest, opts ...grpc.CallOption) (*TerminateSessionResponse, error)
+	// === OAuth2 SSO ===
+	GenerateOauthCode(ctx context.Context, in *GenerateOauthCodeRequest, opts ...grpc.CallOption) (*GenerateOauthCodeResponse, error)
+	ExchangeOauthCode(ctx context.Context, in *ExchangeOauthCodeRequest, opts ...grpc.CallOption) (*ExchangeOauthCodeResponse, error)
 	// Системные методы для админа
 	SystemCreateAccount(ctx context.Context, in *SystemCreateAccountRequest, opts ...grpc.CallOption) (*SystemCreateAccountResponse, error)
 	SystemChangeStatus(ctx context.Context, in *SystemChangeStatusRequest, opts ...grpc.CallOption) (*SystemChangeStatusResponse, error)
@@ -146,6 +151,26 @@ func (c *authServiceClient) TerminateSession(ctx context.Context, in *TerminateS
 	return out, nil
 }
 
+func (c *authServiceClient) GenerateOauthCode(ctx context.Context, in *GenerateOauthCodeRequest, opts ...grpc.CallOption) (*GenerateOauthCodeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GenerateOauthCodeResponse)
+	err := c.cc.Invoke(ctx, AuthService_GenerateOauthCode_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *authServiceClient) ExchangeOauthCode(ctx context.Context, in *ExchangeOauthCodeRequest, opts ...grpc.CallOption) (*ExchangeOauthCodeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ExchangeOauthCodeResponse)
+	err := c.cc.Invoke(ctx, AuthService_ExchangeOauthCode_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *authServiceClient) SystemCreateAccount(ctx context.Context, in *SystemCreateAccountRequest, opts ...grpc.CallOption) (*SystemCreateAccountResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SystemCreateAccountResponse)
@@ -228,6 +253,9 @@ type AuthServiceServer interface {
 	LogoutOther(context.Context, *LogoutRequest) (*LogoutResponse, error)
 	GetSessions(context.Context, *GetSessionRequest) (*GetSessionsResponse, error)
 	TerminateSession(context.Context, *TerminateSessionRequest) (*TerminateSessionResponse, error)
+	// === OAuth2 SSO ===
+	GenerateOauthCode(context.Context, *GenerateOauthCodeRequest) (*GenerateOauthCodeResponse, error)
+	ExchangeOauthCode(context.Context, *ExchangeOauthCodeRequest) (*ExchangeOauthCodeResponse, error)
 	// Системные методы для админа
 	SystemCreateAccount(context.Context, *SystemCreateAccountRequest) (*SystemCreateAccountResponse, error)
 	SystemChangeStatus(context.Context, *SystemChangeStatusRequest) (*SystemChangeStatusResponse, error)
@@ -270,6 +298,12 @@ func (UnimplementedAuthServiceServer) GetSessions(context.Context, *GetSessionRe
 func (UnimplementedAuthServiceServer) TerminateSession(context.Context, *TerminateSessionRequest) (*TerminateSessionResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method TerminateSession not implemented")
 }
+func (UnimplementedAuthServiceServer) GenerateOauthCode(context.Context, *GenerateOauthCodeRequest) (*GenerateOauthCodeResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GenerateOauthCode not implemented")
+}
+func (UnimplementedAuthServiceServer) ExchangeOauthCode(context.Context, *ExchangeOauthCodeRequest) (*ExchangeOauthCodeResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ExchangeOauthCode not implemented")
+}
 func (UnimplementedAuthServiceServer) SystemCreateAccount(context.Context, *SystemCreateAccountRequest) (*SystemCreateAccountResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method SystemCreateAccount not implemented")
 }
@@ -456,6 +490,42 @@ func _AuthService_TerminateSession_Handler(srv interface{}, ctx context.Context,
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AuthService_GenerateOauthCode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GenerateOauthCodeRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).GenerateOauthCode(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_GenerateOauthCode_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).GenerateOauthCode(ctx, req.(*GenerateOauthCodeRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AuthService_ExchangeOauthCode_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExchangeOauthCodeRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AuthServiceServer).ExchangeOauthCode(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AuthService_ExchangeOauthCode_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AuthServiceServer).ExchangeOauthCode(ctx, req.(*ExchangeOauthCodeRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _AuthService_SystemCreateAccount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(SystemCreateAccountRequest)
 	if err := dec(in); err != nil {
@@ -621,6 +691,14 @@ var AuthService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "TerminateSession",
 			Handler:    _AuthService_TerminateSession_Handler,
 		},
+		{
+			MethodName: "GenerateOauthCode",
+			Handler:    _AuthService_GenerateOauthCode_Handler,
+		},
+		{
+			MethodName: "ExchangeOauthCode",
+			Handler:    _AuthService_ExchangeOauthCode_Handler,
+		},
 		{
 			MethodName: "SystemCreateAccount",
 			Handler:    _AuthService_SystemCreateAccount_Handler,
diff --git a/gen/sso/auth.ts b/gen/sso/auth.ts
index c17c3af..a9f01d5 100644
--- a/gen/sso/auth.ts
+++ b/gen/sso/auth.ts
@@ -106,6 +106,25 @@ export interface TerminateSessionResponse {
   message: string;
 }
 
+export interface GenerateOauthCodeRequest {
+  userId: string;
+}
+
+export interface GenerateOauthCodeResponse {
+  code: string;
+}
+
+export interface ExchangeOauthCodeRequest {
+  code: string;
+  clientId: string;
+  clientSecret: string;
+}
+
+export interface ExchangeOauthCodeResponse {
+  accessToken: string;
+  expiresIn: number;
+}
+
 export interface SystemCreateAccountRequest {
   username: string;
   /** Хеш пароля генерирует Admin Service и передает сюда */
@@ -202,6 +221,12 @@ export interface AuthServiceClient {
 
   terminateSession(request: TerminateSessionRequest, metadata?: Metadata): Observable<TerminateSessionResponse>;
 
+  /** === OAuth2 SSO === */
+
+  generateOauthCode(request: GenerateOauthCodeRequest, metadata?: Metadata): Observable<GenerateOauthCodeResponse>;
+
+  exchangeOauthCode(request: ExchangeOauthCodeRequest, metadata?: Metadata): Observable<ExchangeOauthCodeResponse>;
+
   /** Системные методы для админа */
 
   systemCreateAccount(
@@ -266,6 +291,18 @@ export interface AuthServiceController {
     metadata?: Metadata,
   ): Promise<TerminateSessionResponse> | Observable<TerminateSessionResponse> | TerminateSessionResponse;
 
+  /** === OAuth2 SSO === */
+
+  generateOauthCode(
+    request: GenerateOauthCodeRequest,
+    metadata?: Metadata,
+  ): Promise<GenerateOauthCodeResponse> | Observable<GenerateOauthCodeResponse> | GenerateOauthCodeResponse;
+
+  exchangeOauthCode(
+    request: ExchangeOauthCodeRequest,
+    metadata?: Metadata,
+  ): Promise<ExchangeOauthCodeResponse> | Observable<ExchangeOauthCodeResponse> | ExchangeOauthCodeResponse;
+
   /** Системные методы для админа */
 
   systemCreateAccount(
@@ -315,6 +352,8 @@ export function AuthServiceControllerMethods() {
       "logoutOther",
       "getSessions",
       "terminateSession",
+      "generateOauthCode",
+      "exchangeOauthCode",
       "systemCreateAccount",
       "systemChangeStatus",
       "systemUpdatePassword",