diff --git a/platformapi/weixinapi/msg.go b/platformapi/weixinapi/msg.go
new file mode 100644
index 00000000..da63c665
--- /dev/null
+++ b/platformapi/weixinapi/msg.go
@@ -0,0 +1,41 @@
+package weixinapi
+
+import (
+	"crypto/sha1"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.rosy.net.cn/baseapi"
+)
+
+func (a *API) SetMsgTokenAndKey(msgToken, msgKey string) {
+	a.locker.Lock()
+	defer a.locker.Unlock()
+
+	a.msgToken = msgToken
+	a.msgKey = msgKey
+}
+
+func (a *API) GetMsgTokenAndKey() (msgToken, msgKey string) {
+	a.locker.RLock()
+	defer a.locker.RUnlock()
+
+	return a.msgToken, a.msgKey
+}
+
+func (a *API) ValidateWXCallbackURL(signature, timestamp, nonce string) (isValid bool) {
+	msgToken, _ := a.GetMsgTokenAndKey()
+	if msgToken == "" {
+		panic("you must call SetMsgTokenAndKey first")
+	}
+	strList := []string{
+		msgToken,
+		timestamp,
+		nonce,
+	}
+	sort.Sort(sort.StringSlice(strList))
+	sha1Str := fmt.Sprintf("%x", sha1.Sum([]byte(strings.Join(strList, ""))))
+	baseapi.SugarLogger.Debugf("ValidateWXCallbackURL sha1Str:%s, signature:%s", sha1Str, signature)
+	return sha1Str == signature
+}
diff --git a/platformapi/weixinapi/weixinapi.go b/platformapi/weixinapi/weixinapi.go
index 998abffe..0f0c1bf7 100644
--- a/platformapi/weixinapi/weixinapi.go
+++ b/platformapi/weixinapi/weixinapi.go
@@ -39,6 +39,9 @@ type API struct {
 	client *http.Client
 	config *platformapi.APIConfig
 	locker sync.RWMutex
+
+	msgToken string
+	msgKey   string
 }
 
 type SNSTokenInfo struct {