diff --git a/TestManage/routes.py b/TestManage/routes.py
index 5f83bbf..9defeb3 100644
--- a/TestManage/routes.py
+++ b/TestManage/routes.py
@@ -1,7 +1,7 @@
 from flask import Blueprint, request
 
 from TestManage.TestObj import TestObj
-from common.scripts import api_secret
+from common.security.APIAuth import api_secret
 
 test_route = Blueprint('test', __name__)
 
diff --git a/app.py b/app.py
index d15382c..8502642 100644
--- a/app.py
+++ b/app.py
@@ -4,6 +4,7 @@ from flask_cors import *
 from TestManage.routes import test_route
 from company.routes import company_route
 from rating.routes import rating_route
+from user.routes import user_route
 
 app = Flask(__name__)
 CORS(app, supports_credentials=True)
@@ -11,6 +12,7 @@ app.config['JSON_SORT_KEYS'] = False
 
 
 app.register_blueprint(test_route, url_prefix='/admin/test')
+app.register_blueprint(user_route, url_prefix='/admin/user')
 app.register_blueprint(company_route, url_prefix='/admin/company')
 app.register_blueprint(rating_route, url_prefix='/admin/rating')
 
diff --git a/common/scripts.py b/common/scripts.py
index ffc0c89..041d55c 100644
--- a/common/scripts.py
+++ b/common/scripts.py
@@ -1,10 +1,7 @@
 import os
 import json
-import functools
 
-from flask import request
-
-from setting import APP_NAME, API_SECRET
+from setting import APP_NAME
 
 
 def real_file_path(param):
@@ -35,22 +32,6 @@ def read_json_file(param):
         return result
 
 
-def api_secret(func):
-    """
-    校验token
-    """
-    @functools.wraps(func)
-    def internal(*args, **kwargs):
-        try:
-            token = request.headers.get('secret')
-            if token != API_SECRET:
-                return {"info": "接口密钥错误"}, 401
-        except Exception:
-            return {"info": "请求异常"}, 401
-        return func(*args, **kwargs)
-    return internal
-
-
 def sub_dict(param1, param2):
     """
     获取字典的子集
diff --git a/common/security/APIAuth.py b/common/security/APIAuth.py
new file mode 100644
index 0000000..6715232
--- /dev/null
+++ b/common/security/APIAuth.py
@@ -0,0 +1,22 @@
+import functools
+
+from flask import request
+
+# 接口密钥
+API_SECRET = "EZgo9ykxrYuBMYnYmmKIh"
+
+
+def api_secret(func):
+    """
+    校验接口请求密钥
+    """
+    @functools.wraps(func)
+    def internal(*args, **kwargs):
+        try:
+            token = request.headers.get('secret')
+            if token != API_SECRET:
+                return {"info": "接口密钥错误"}, 401
+        except Exception:
+            return {"info": "请求异常"}, 401
+        return func(*args, **kwargs)
+    return internal
diff --git a/company/routes.py b/company/routes.py
index 90ab404..d0b4021 100644
--- a/company/routes.py
+++ b/company/routes.py
@@ -1,5 +1,5 @@
 from flask import Blueprint, request
-from common.scripts import api_secret
+from common.security.APIAuth import api_secret
 from company.Company import Company
 
 company_route = Blueprint('company', __name__)
diff --git a/menus/__init__.py b/menus/__init__.py
deleted file mode 100644
index e69de29..0000000
diff --git a/rating/routes.py b/rating/routes.py
index 1881768..9c2d170 100644
--- a/rating/routes.py
+++ b/rating/routes.py
@@ -1,5 +1,5 @@
 from flask import Blueprint, request
-from common.scripts import api_secret
+from common.security.APIAuth import api_secret
 from rating.Rating import Rating
 
 rating_route = Blueprint('rating', __name__)
diff --git a/setting.py b/setting.py
index 8eb4973..adeb8be 100644
--- a/setting.py
+++ b/setting.py
@@ -1,6 +1,3 @@
 # 应用配置
 APP_NAME = 'tfse_admin'
 APP_PORT = '51013'
-
-# 接口密钥
-API_SECRET = "EZgo9ykxrYuBMYnYmmKIh"
diff --git a/user/User.py b/user/User.py
index 54c9a1a..d7cf9b8 100644
--- a/user/User.py
+++ b/user/User.py
@@ -57,12 +57,3 @@ class UserOperation(User):
     # 登录
     def login(self):
         pass
-
-
-if __name__ == '__main__':
-    um = UserManage()
-    um.email = "wangsichuan@fecr.com.cn"
-    um.name = "王思川"
-    um.pwd = "pVhsypYQ+Lf81gMHKkkU+xrEhB96jNjbH8PZ6smK8NGnWBuJwHEtr5XPZ+A4dPMsYVZldeyjfR7AVCG3deAWT0JR2aAHqG6pD2IMwA0VqMcXBI2c1uesGRoYNW3815CrAqdRwKlZunpqYkxnWnatfU4zuosuv/7TyY+JhOIS6rV50yiE/Nw/k/aXPtX/ShJI/oybmgzMU+GfODy7k3XnTn9I9vLfFYQrg/m8ybZIL7TGtX+HSUJLZ5ttmFq+cnykBVf2iK7Q3lV6f65tmVmIiU+e2xrBc4nMHyYxZksGJNWeVZ2F45QPrif14BML7X9g/QDqze7Jm3ZHg6fs/wV/ISrvw/C1fPFbSCRfjuLcusLY5fcFG3X0r7kST6vIzbr4ZYH3TZZ0p29+dgEEt+fj+d17URrd92xPzuLz2UIRi/pncNSvZb31PDHMY6pEfjigXOx6o4XTtbLqNIRuo8n+LX8XyJvMPc2EUQEMsRKet6KFpVJTnXGhJkI37lHh4Kc4qv0HIdLVjWd05dlo0R2Ggsm1Fb2vGL35l5YumjkFJjQDV5TV0IhzLWW56A56dluHaMDsOQXqFNVCdnpYmzNtm8pEVYfzxnKJwpq5a0xqaLcf7SO/VmLpFKXj+9ZSEEWK5RAzbSVSoQCIWISLYPDqNRnsXFS1CDwe3xv1+86H3nY="
-    um.role = "admin"
-    print(um.create_user())
diff --git a/user/process.py b/user/process.py
index f397b81..408da15 100644
--- a/user/process.py
+++ b/user/process.py
@@ -29,7 +29,7 @@ def create_user_process(email, name, pwd, role, duty):
         if role not in roles:
             return "用户角色异常"
 
-        duties = ['developers', 'analysts', None]
+        duties = ['developer', 'analysts', 'manager', None]
         if duty not in duties:
             return "成员职责异常"
 
diff --git a/user/routes.py b/user/routes.py
index e69de29..85212f3 100644
--- a/user/routes.py
+++ b/user/routes.py
@@ -0,0 +1,25 @@
+from flask import Blueprint, request
+
+from common.security.APIAuth import api_secret
+from user.User import UserManage
+
+user_route = Blueprint('user', __name__)
+
+
+@user_route.route('/create_user', methods=['POST'])
+@api_secret
+def create_user_route():
+    """
+    新建用户
+    """
+    um = UserManage()
+    um.email = request.json['email']
+    um.name = request.json['name']
+    um.pwd = request.json['pwd']
+    um.role = request.json['role']
+    um.duty = request.json['duty']
+    res = um.create_user()
+    if res is True:
+        return {"info": "新建用户成功"}, 200
+    else:
+        return {"info": res}, 200