diff --git a/.env b/.env
index 8741b76..78df136 100644
--- a/.env
+++ b/.env
@@ -21,4 +21,9 @@ SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
 SMTP_USER=turbosoft11@gmail.com
 SMTP_PASS="kojl sxbx pdfi yhxz"
-SMTP_FROM=업무관리프로그램 <turbosoft11@gmail.com>
\ No newline at end of file
+SMTP_FROM=업무관리프로그램 <turbosoft11@gmail.com>
+
+SYNOLOGY_SERVER_URL=https://sso.osolit.net
+SYNOLOGY_CLIENT_ID=afa90b7b4a9773af41f2c7b110f92d6e
+SYNOLOGY_CLIENT_SECRET=
+SYNOLOGY_REDIRECT_URI=https://weeklyreport.turbosoft.kr/api/auth/synology/callback
diff --git a/.env.prod b/.env.prod
index 9d34358..c720b27 100644
--- a/.env.prod
+++ b/.env.prod
@@ -16,4 +16,10 @@ SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
 SMTP_USER=turbosoft11@gmail.com
 SMTP_PASS="kojl sxbx pdfi yhxz"
-SMTP_FROM=업무관리프로그램 <turbosoft11@gmail.com>
\ No newline at end of file
+SMTP_FROM=업무관리프로그램 <turbosoft11@gmail.com>
+
+
+SYNOLOGY_SERVER_URL=https://sso.osolit.net
+SYNOLOGY_CLIENT_ID=afa90b7b4a9773af41f2c7b110f92d6e
+SYNOLOGY_CLIENT_SECRET=
+SYNOLOGY_REDIRECT_URI=https://weeklyreport.turbosoft.kr/api/auth/synology/callback
diff --git a/server/api/auth/synology/callback.get.ts b/server/api/auth/synology/callback.get.ts
index 7e73df2..9c61eb6 100644
--- a/server/api/auth/synology/callback.get.ts
+++ b/server/api/auth/synology/callback.get.ts
@@ -26,16 +26,20 @@ export default defineEventHandler(async (event) => {
   
   try {
     // 1. 코드로 액세스 토큰 교환
+    const tokenParams = new URLSearchParams({
+      grant_type: 'authorization_code',
+      code: code,
+      client_id: config.synologyClientId,
+      redirect_uri: config.synologyRedirectUri
+    })
+    if (config.synologyClientSecret) {
+      tokenParams.set('client_secret', config.synologyClientSecret)
+    }
+    
     const tokenResponse = await $fetch<any>(`${config.synologyServerUrl}/webman/sso/SSOAccessToken.cgi`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: new URLSearchParams({
-        grant_type: 'authorization_code',
-        code: code,
-        client_id: config.synologyClientId,
-        client_secret: config.synologyClientSecret,
-        redirect_uri: config.synologyRedirectUri
-      }).toString()
+      body: tokenParams.toString()
     })
     
     if (!tokenResponse.access_token) {