diff --git a/packages/postcat-oauth-2/README.md b/packages/postcat-oauth-2/README.md
new file mode 100644
index 0000000..276969d
--- /dev/null
+++ b/packages/postcat-oauth-2/README.md
@@ -0,0 +1,61 @@
+# JWT authentication plugin
+
+Json Web Token (JWT) is an open JSON-based standard implemented for passing claims between web application environments.
+
+JWT is designed to be compact and secure, especially suitable for single sign-on (SSO) scenarios of distributed sites. JWT is generally used to transfer authenticated user identity information between identity providers and service providers, so as to obtain resources from resource servers, and can also add some additional statement information necessary for other business logic.
+
+## How to use
+
+After installing the plug-in, select authentication on the test page, and after filling in the data, the header `Authorization` will be automatically added to the request information.
+![](https://raw.githubusercontent.com/eolinker/postcat-extensions/main/packages/postcat-jwt/assets/images/2023-03-15-10-42-12.png)
+
+## JWT description
+
+```HTTP
+Client Request
+
+GET /security/somethings HTTP/1.1
+Authorization: Basic bmFtZTpwYXNzd29yZA==
+```
+
+including:
+
+**head**
+
+```json
+{
+  "alg": "HS256",
+  "typ": "JWT"
+}
+```
+
+**Payload**
+
+```json
+{
+  "name": "Postcat",
+  "introduce": "An extensible API tool."
+}
+```
+
+WT provides 7 default fields for developers to choose.
+
+- iss (issuer): issuer
+- exp (expiration time): expiration time
+- sub (subject): subject
+- aud (audience): Audience, equivalent to the recipient
+- nbf (Not Before): the start time to take effect
+- iat (Issued At): Issue time
+- jti (JWT ID): number, unique identifier
+
+**Signature**
+
+For each encryption algorithm, the signature corresponds to a calculation formula. For example, the signature of the SHA256 encryption algorithm is as follows:
+
+```
+HMACSHA256(
+base64UrlEncode(header) + "." +
+base64UrlEncode(payload) + "." +
+Secret
+)
+```
diff --git a/packages/postcat-oauth-2/README.zh-Hans.md b/packages/postcat-oauth-2/README.zh-Hans.md
new file mode 100644
index 0000000..279b47b
--- /dev/null
+++ b/packages/postcat-oauth-2/README.zh-Hans.md
@@ -0,0 +1,21 @@
+# OAuth 2.0 鉴权插件
+
+OAuth 2.0 是目前最流行的授权机制，用来授权第三方应用，获取用户数据。
+
+## 使用方式
+
+安装插件后，测试页面选中鉴权，填入数据后会自动在请求信息中添加头部 `Authorization`。
+![](https://raw.githubusercontent.com/eolinker/postcat-extensions/main/packages/postcat-jwt/assets/images/2023-03-15-10-42-12.png)
+
+## JWT 说明
+
+OAuth 2.0 规定了四种获得令牌的流程。你可以选择最适合自己的那一种，向第三方应用颁发令牌。下面就是这四种授权方式。
+
+- 授权码（authorization-code）
+- 隐藏式（implicit）
+- 密码式（password）：
+- 客户端凭证（client credentials）
+
+![](../assets/images/2023-04-10-14-49-55.png)
+
+> 引用自：https://www.ruanyifeng.com/blog/2019/04/oauth-grant-types.html
diff --git a/packages/postcat-oauth-2/assets/images/2023-03-15-10-42-12.png b/packages/postcat-oauth-2/assets/images/2023-03-15-10-42-12.png
new file mode 100644
index 0000000..c0e699b
Binary files /dev/null and b/packages/postcat-oauth-2/assets/images/2023-03-15-10-42-12.png differ
diff --git a/packages/postcat-oauth-2/assets/images/2023-04-10-14-49-55.png b/packages/postcat-oauth-2/assets/images/2023-04-10-14-49-55.png
new file mode 100644
index 0000000..4a35eaa
Binary files /dev/null and b/packages/postcat-oauth-2/assets/images/2023-04-10-14-49-55.png differ
diff --git a/packages/postcat-oauth-2/i18n/en-US.json b/packages/postcat-oauth-2/i18n/en-US.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/packages/postcat-oauth-2/i18n/en-US.json
@@ -0,0 +1 @@
+{}
diff --git a/packages/postcat-oauth-2/i18n/zh-Hans.json b/packages/postcat-oauth-2/i18n/zh-Hans.json
new file mode 100644
index 0000000..2f63b92
--- /dev/null
+++ b/packages/postcat-oauth-2/i18n/zh-Hans.json
@@ -0,0 +1,4 @@
+{
+  "title": "JWT 鉴权",
+  "description": "JSON Web Token (JWT) 鉴权方式，安装后会在请求头部 Authorization 加入鉴权值"
+}
diff --git a/packages/postcat-oauth-2/index.js b/packages/postcat-oauth-2/index.js
new file mode 100644
index 0000000..c16b7a2
--- /dev/null
+++ b/packages/postcat-oauth-2/index.js
@@ -0,0 +1,41 @@
+const OAuth = require('oauth')
+var OAuth2 = OAuth.OAuth2
+var twitterConsumerKey = '9c7cfcd303eb07cca8541ba59e916f3eFHxoKHnCoUF'
+var twitterConsumerSecret = 'sRQn6ZzLnLA2B4alF9VzFwJb74ZwOYZc3AcvWagcDn'
+var oauth2 = new OAuth2(
+  twitterConsumerKey,
+  twitterConsumerSecret,
+  'https://api.twitter.com/',
+  null,
+  'oauth2/token',
+  null
+)
+oauth2.getOAuthAccessToken(
+  '',
+  { grant_type: 'client_credentials' },
+  function (e, access_token, refresh_token, results) {
+    console.log(e)
+    console.log('bearer: ', access_token)
+  }
+)
+
+// module.exports = {
+//   authAPI: (config) => {
+//     try {
+//       const authorizationValue = `Bearer ${jwt.sign(
+//         JSON.parse(config.payload),
+//         config.isBase64Encoded
+//           ? Buffer.from(config.Secret).toString('base64')
+//           : config.Secret,
+//         { algorithm: config.Algorithm }
+//       )}`
+
+//       return `pc.request.headers.add({
+//         key:'Authorization', value:'${authorizationValue}'
+//       })`
+//     } catch (err) {
+//       console.error(err)
+//       return null
+//     }
+//   }
+// }
diff --git a/packages/postcat-oauth-2/package.json b/packages/postcat-oauth-2/package.json
new file mode 100644
index 0000000..06bd23e
--- /dev/null
+++ b/packages/postcat-oauth-2/package.json
@@ -0,0 +1,88 @@
+{
+  "name": "postcat-oauth-2",
+  "title": "OAuth2.0 Authorization",
+  "version": "0.0.1",
+  "description": "OAuth2.0 Authorization",
+  "author": {
+    "name": "Postcat"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Postcatlab/postcat-extensions.git"
+  },
+  "logo": "https://data.eolink.com/5fwiFW182ef051fc6150c6a274fde19a83667432b534ef0",
+  "engines": {
+    "postcat": "^0.4.0"
+  },
+  "categories": [
+    "API Testing"
+  ],
+  "features": {
+    "authAPI": {
+      "action": "authAPI",
+      "label": "OAuth 2.0",
+      "configuration": {
+        "type": "object",
+        "properties": {
+          "token": {
+            "type": "string",
+            "ui": {
+              "widget": "select"
+            },
+            "required": true,
+            "default": "HS256",
+            "label": "Algorithm",
+            "enum": [
+              {
+                "label": "HS256",
+                "value": "HS256"
+              },
+              {
+                "label": "HS384",
+                "value": "HS384"
+              },
+              {
+                "label": "HS512",
+                "value": "HS512"
+              }
+            ]
+          },
+          "Secret": {
+            "type": "string",
+            "required": false,
+            "default": "",
+            "label": "Secret"
+          },
+          "isBase64Encoded": {
+            "ui": {
+              "widget": "checkbox"
+            },
+            "type": "boolean",
+            "label": "",
+            "title": "Secret Base64 encoded",
+            "default": false
+          },
+          "payload": {
+            "ui": {
+              "widget": "textarea",
+              "rows": 4
+            },
+            "placeholder": "Please enter Payload,the format must be json",
+            "type": "string",
+            "label": "Payload",
+            "default": ""
+          }
+        }
+      }
+    },
+    "i18n": {
+      "sourceLocale": "en-US",
+      "locales": [
+        "zh-Hans"
+      ]
+    }
+  },
+  "dependencies": {
+    "oauth": "^0.10.0"
+  }
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index eb04c9a..0a840fe 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -204,6 +204,12 @@ importers:
     dependencies:
       jsonwebtoken: 9.0.0
 
+  packages/postcat-oauth-2:
+    specifiers:
+      oauth: ^0.10.0
+    dependencies:
+      oauth: 0.10.0
+
   packages/postcat-openDLP:
     specifiers:
       '@rollup/plugin-node-resolve': ^15.0.0
@@ -5277,6 +5283,10 @@ packages:
       path-key: 4.0.0
     dev: true
 
+  /oauth/0.10.0:
+    resolution: {integrity: sha512-1orQ9MT1vHFGQxhuy7E/0gECD3fd2fCC+PIX+/jgmU/gI3EpRocXtmtvxCO5x3WZ443FLTLFWNDjl5MPJf9u+Q==}
+    dev: false
+
   /object-inspect/1.12.2:
     resolution: {integrity: sha512-z+cPxW0QGUp0mcqcsgQyLVRDoXFQbXOwBaqyF7VIgI4TWNQsDHrBpUQslRmIfAoYWdYzs6UlKJtB2XJpTaNSpQ==}
     dev: true