diff --git a/src/lib/im-api.js b/src/lib/im-api.js
index a66841af..7a10db89 100644
--- a/src/lib/im-api.js
+++ b/src/lib/im-api.js
@@ -44,7 +44,14 @@ const REASON_MESSAGES = {
   REALNAME_REQUIRED: '需要先完成实名认证',
   YOUTH_MODE_RESTRICTED: '青少年模式下无法使用此功能',
   RISK_CONFIRMATION_REQUIRED: '需要先完成安全确认',
-  RISK_ACTION_BLOCKED: '该操作已被安全策略拦截'
+  RISK_ACTION_BLOCKED: '该操作已被安全策略拦截',
+  // 独立密码校验的两个 reason（对接文档 809 行有写），青少年模式关闭/开启走的都是这条接口。
+  // 原来没收录，报错时直接透传后端英文原文——PIN 输错显示 "code invalid"，连续错误锁定后
+  // 显示 "too many attempts"，且不告诉用户要等多久能重试。
+  CODE_INVALID: '独立密码不正确',
+  TOO_MANY_ATTEMPTS: details => details && details.retry_after_seconds
+    ? `连续输错次数过多，请 ${details.retry_after_seconds} 秒后重试`
+    : '连续输错次数过多，请稍后重试'
 };
 
 function requestId() {
@@ -123,7 +130,8 @@ export async function imRequest(path, {method = 'GET', body, headers, auth = tru
     // (not silently replaced with a generic string) since this backend's messages have consistently
     // been reasonable, specific, business-appropriate text in real testing, not raw internals -- only
     // reasons this app doesn't otherwise know how to react to fall through to it.
-    const known = payload.reason && REASON_MESSAGES[payload.reason];
+    const entry = payload.reason && REASON_MESSAGES[payload.reason];
+    const known = typeof entry === 'function' ? entry(payload.details) : entry;
     throw new ImApiError(known || payload.message || payload.reason || response.statusText || '请求失败',
       payload.reason, response.status, payload.details);
   }