diff --git a/packages/core/client/src/application/Application.tsx b/packages/core/client/src/application/Application.tsx
index 2000208d1a..d7b6870ffb 100644
--- a/packages/core/client/src/application/Application.tsx
+++ b/packages/core/client/src/application/Application.tsx
@@ -157,7 +157,7 @@ export class Application {
 
   private initListeners() {
     this.eventBus.addEventListener('auth:tokenChanged', (event: CustomEvent) => {
-      this.setTokenInWebSocket(event.detail.token);
+      this.setTokenInWebSocket(event.detail);
     });
 
     this.eventBus.addEventListener('maintaining:end', () => {
diff --git a/packages/core/server/src/gateway/index.ts b/packages/core/server/src/gateway/index.ts
index 72d18119c0..c502f52325 100644
--- a/packages/core/server/src/gateway/index.ts
+++ b/packages/core/server/src/gateway/index.ts
@@ -444,6 +444,10 @@ export class Gateway extends EventEmitter {
           this.wsServer.setClientTag(clientId, tagKey, tagValue);
         });
 
+        app.on('ws:removeTag', ({ clientId, tagKey }) => {
+          this.wsServer.removeClientTag(clientId, tagKey);
+        });
+
         app.on('ws:sendToTag', ({ tagKey, tagValue, message }) => {
           this.wsServer.sendToConnectionsByTags(
             [
diff --git a/packages/core/server/src/gateway/ws-server.ts b/packages/core/server/src/gateway/ws-server.ts
index 54dad18259..4505cf10df 100644
--- a/packages/core/server/src/gateway/ws-server.ts
+++ b/packages/core/server/src/gateway/ws-server.ts
@@ -159,6 +159,16 @@ export class WSServer extends EventEmitter {
     console.log(`client tags: ${Array.from(client.tags)}`);
   }
 
+  removeClientTag(clientId: string, tagKey: string) {
+    const client = this.webSocketClients.get(clientId);
+    // remove all tags with the given tagKey
+    client.tags.forEach((tag) => {
+      if (tag.startsWith(tagKey)) {
+        client.tags.delete(tag);
+      }
+    });
+  }
+
   async setClientApp(client: WebSocketClient) {
     const req: IncomingRequest = {
       url: client.url,
diff --git a/packages/plugins/@nocobase/plugin-auth/src/server/plugin.ts b/packages/plugins/@nocobase/plugin-auth/src/server/plugin.ts
index 201c4ca684..1867c15fed 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/server/plugin.ts
+++ b/packages/plugins/@nocobase/plugin-auth/src/server/plugin.ts
@@ -125,6 +125,10 @@ export class PluginAuthServer extends Plugin {
 
       if (!user) {
         this.app.logger.error(`Invalid token: ${payload.token}`);
+        this.app.emit(`ws:removeTag`, {
+          clientId,
+          tagKey: 'userId',
+        });
         return;
       }