diff --git a/wwwroot/api/rl_callback.dspy b/wwwroot/api/rl_callback.dspy
index ca66202..c48bfc1 100644
--- a/wwwroot/api/rl_callback.dspy
+++ b/wwwroot/api/rl_callback.dspy
@@ -1,27 +1,51 @@
-# Vendor callback POSTs JSON body with BytedToken.
-# The callback URL is configured when calling CreateVisualValidateSession.
-# Typical payload: {"BytedToken": "...", "ReqUUID": "...", "Status": "..."}
+import json
+from appPublic.log import debug
+
+# Vendor callback: GET or POST
+# Volcengine example (GET):
+#   ?bytedToken=xxx&resultCode=10000&algorithmBaseRespCode=0
+#   &reqMeasureInfoValue=1&verify_type=real_time
 # Return format depends on vendor requirements.
 
+debug(f"[rl_callback] params_kw keys: {list(params_kw.keys())}")
+debug(f"[rl_callback] params_kw: {params_kw}")
+
 body_str = http_request.get("body", "") or ""
 byted_token = ""
+result_code = ""
 
+# 1. Try POST body (JSON)
 try:
     body = json.loads(body_str) if body_str else {}
-    byted_token = body.get("BytedToken", "")
-    if not byted_token:
-        byted_token = body.get("byted_token", "")
-    if not byted_token:
-        byted_token = body.get("Token", "")
+    byted_token = (body.get("BytedToken") or body.get("bytedToken")
+                   or body.get("byted_token") or body.get("Token") or "")
+    result_code = body.get("resultCode") or body.get("ResultCode") or ""
 except:
-    byted_token = ""
+    pass
+
+# 2. Fallback: query string params (GET callback)
+if not byted_token:
+    byted_token = (params_kw.get("bytedToken")
+                   or params_kw.get("BytedToken")
+                   or params_kw.get("byted_token")
+                   or params_kw.get("BytedToken")
+                   or "")
+if not result_code:
+    result_code = params_kw.get("resultCode", "")
+
+debug(f"[rl_callback] byted_token={byted_token}, resultCode={result_code}")
 
 if not byted_token:
-    byted_token = params_kw.get("BytedToken", params_kw.get("byted_token", ""))
+    return json.dumps({"code": "400", "message": "Missing bytedToken"})
 
-if not byted_token:
-    return {"success": False, "message": "缺少 BytedToken 参数"}
-
-# vendor is determined by looking up the session record
+# Process callback
 result = await rl_handle_callback(byted_token, project_name="default")
-return result
+
+debug(f"[rl_callback] handle_callback result: {result}")
+
+# Volcengine expects HTTP 200 with any body for success.
+# Return a simple success/failure response.
+if result.get("success"):
+    return json.dumps({"code": "200", "message": "ok"})
+else:
+    return json.dumps({"code": "500", "message": result.get("message", "callback error")})