diff --git a/app/api/pay/confirm/route.ts b/app/api/pay/confirm/route.ts
index 073c306..8c0d97a 100644
--- a/app/api/pay/confirm/route.ts
+++ b/app/api/pay/confirm/route.ts
@@ -39,8 +39,6 @@ function resolvePayApiUrl(request: NextRequest): string {
   const hostHeader = request.headers.get("host") || request.headers.get("x-forwarded-host");
   return (
     (hostHeader ? getApiUrlFromRequest(hostHeader) : null) ||
-    process.env.PAYMENT_API_URL ||
-    process.env.NEXT_PUBLIC_API_URL ||
     payConfig.apiUrl
   ).replace(/\/$/, "");
 }
diff --git a/app/api/pay/route.ts b/app/api/pay/route.ts
index a0e31c8..9676220 100644
--- a/app/api/pay/route.ts
+++ b/app/api/pay/route.ts
@@ -133,8 +133,6 @@ export async function POST(request: NextRequest) {
     // 优先用请求 Host（等同 window.location.host）推断同机 payjsapi，访问 192.168.41.222:3002 即用 192.168.41.222:8007
     const apiUrl = (
       (hostHeader ? getApiUrlFromRequest(hostHeader) : null) ||
-      process.env.PAYMENT_API_URL ||
-      process.env.NEXT_PUBLIC_API_URL ||
       payConfig.apiUrl
     )
       .replace(/\/$/, "");
diff --git a/app/api/pay/status/route.ts b/app/api/pay/status/route.ts
index 2b8a43d..acca169 100644
--- a/app/api/pay/status/route.ts
+++ b/app/api/pay/status/route.ts
@@ -8,8 +8,6 @@ function resolvePayApiUrl(request: NextRequest): string {
   const hostHeader = request.headers.get("host") || request.headers.get("x-forwarded-host");
   return (
     (hostHeader ? getApiUrlFromRequest(hostHeader) : null) ||
-    process.env.PAYMENT_API_URL ||
-    process.env.NEXT_PUBLIC_API_URL ||
     payConfig.apiUrl
   ).replace(/\/$/, "");
 }
diff --git a/app/api/vip/check-by-email/route.ts b/app/api/vip/check-by-email/route.ts
index 9c59a29..abe5b8b 100644
--- a/app/api/vip/check-by-email/route.ts
+++ b/app/api/vip/check-by-email/route.ts
@@ -37,8 +37,6 @@ function resolvePayApiUrl(request: NextRequest): string {
   const hostHeader = request.headers.get("host") || request.headers.get("x-forwarded-host");
   return (
     (hostHeader ? getApiUrlFromRequest(hostHeader) : null) ||
-    process.env.PAYMENT_API_URL ||
-    process.env.NEXT_PUBLIC_API_URL ||
     payConfig.apiUrl
   ).replace(/\/$/, "");
 }
diff --git a/app/api/vip/check-by-user/route.ts b/app/api/vip/check-by-user/route.ts
index dbf336d..bad8bba 100644
--- a/app/api/vip/check-by-user/route.ts
+++ b/app/api/vip/check-by-user/route.ts
@@ -20,8 +20,6 @@ function resolvePayApiUrl(request: NextRequest): string {
   const hostHeader = request.headers.get("host") || request.headers.get("x-forwarded-host");
   return (
     (hostHeader ? getApiUrlFromRequest(hostHeader) : null) ||
-    process.env.PAYMENT_API_URL ||
-    process.env.NEXT_PUBLIC_API_URL ||
     payConfig.apiUrl
   ).replace(/\/$/, "");
 }
diff --git a/app/api/vip/linked-email/route.ts b/app/api/vip/linked-email/route.ts
index cccee87..3218433 100644
--- a/app/api/vip/linked-email/route.ts
+++ b/app/api/vip/linked-email/route.ts
@@ -15,8 +15,6 @@ function resolvePayApiUrl(request: NextRequest): string {
   const hostHeader = request.headers.get("host") || request.headers.get("x-forwarded-host");
   return (
     (hostHeader ? getApiUrlFromRequest(hostHeader) : null) ||
-    process.env.PAYMENT_API_URL ||
-    process.env.NEXT_PUBLIC_API_URL ||
     payConfig.apiUrl
   ).replace(/\/$/, "");
 }
diff --git a/config/services.config.ts b/config/services.config.ts
index c5db6fc..4b5b319 100644
--- a/config/services.config.ts
+++ b/config/services.config.ts
@@ -51,11 +51,20 @@ export function getApiUrlFromRequest(hostHeader: string | null): string {
   return isDev ? `http://${hostname}:${PAYJSAPI_PORT}` : "https://api.hackrobot.cn";
 }
 
-export function getPaymentConfig(): PaymentConfig {
-  const apiUrl =
+/** 生产环境若 PAYMENT_API_URL 指向 localhost，则忽略并使用 api 域名 */
+function resolvePaymentApiUrl(): string {
+  const url =
     process.env.PAYMENT_API_URL ||
     process.env.NEXT_PUBLIC_API_URL ||
     (isDev ? `http://127.0.0.1:${PAYJSAPI_PORT}` : "https://api.hackrobot.cn");
+  if (!isDev && /^(https?:\/\/)?(127\.0\.0\.1|localhost)(:\d+)?(\/|$)/i.test(url)) {
+    return "https://api.hackrobot.cn";
+  }
+  return url;
+}
+
+export function getPaymentConfig(): PaymentConfig {
+  const apiUrl = resolvePaymentApiUrl();
   return {
     apiUrl,
     provider: (process.env.PAYMENT_PROVIDER as "zpay" | "xorpay") || "zpay",