diff --git a/app/api/endpoints/message.py b/app/api/endpoints/message.py
index 8353f0a29..af2b5840a 100644
--- a/app/api/endpoints/message.py
+++ b/app/api/endpoints/message.py
@@ -337,7 +337,7 @@ def incoming_verify(
     微信/VoceChat等验证响应
     """
     logger.info(
-        f"收到验证请求: token={token}, echostr={echostr}, "
+        f"收到验证请求: echostr={echostr}, "
         f"msg_signature={msg_signature}, timestamp={timestamp}, nonce={nonce}"
     )
     if echostr and msg_signature and timestamp and nonce:
diff --git a/tests/test_message_notifications.py b/tests/test_message_notifications.py
index 9143e7209..07a364e1b 100644
--- a/tests/test_message_notifications.py
+++ b/tests/test_message_notifications.py
@@ -2,6 +2,7 @@ import asyncio
 import json
 from unittest.mock import Mock
 
+from app.api.endpoints import message as message_endpoint
 from app.api.endpoints.message import clear_notification_message, get_notification_message
 from app.api.endpoints.system import get_message
 from app.chain.base import ChainBase
@@ -212,6 +213,20 @@ def test_sse_endpoint_flushes_backlog_in_one_tick() -> None:
     assert helper.get() is None
 
 
+def test_incoming_verify_log_omits_token(monkeypatch) -> None:
+    """
+    回调验证日志只记录排查所需的参数，不输出 token。
+    """
+    logged: list[str] = []
+    monkeypatch.setattr(message_endpoint.logger, "info", lambda msg, *args, **kwargs: logged.append(str(msg)))
+
+    result = message_endpoint.incoming_verify(token="callback-token-value", source="vocechat")
+
+    assert result == {"status": "OK"}
+    assert logged
+    assert all("callback-token-value" not in line for line in logged)
+
+
 def test_agent_helper_message_does_not_enter_sse_queue() -> None:
     """
     智能体消息不进入前端 SSE 队列。