diff --git a/src/apisix/plugins/bk-components/bk-apigateway-core.lua b/src/apisix/plugins/bk-components/bk-apigateway-core.lua
index 24c0f39..8e7a12d 100644
--- a/src/apisix/plugins/bk-components/bk-apigateway-core.lua
+++ b/src/apisix/plugins/bk-components/bk-apigateway-core.lua
@@ -27,7 +27,7 @@ local string_format = string.format
 local QUERY_PERMISSION_URL = "/api/v1/micro-gateway/%s/permissions/"
 local QUERY_PUBLIC_KEY_URL = "/api/v1/micro-gateway/%s/public_keys/"
 -- NOTE: important, if you change the timeout here, you should reset the timeout/exptime in bk-cache-fallback lock
-local BKCORE_TIMEOUT_MS = 5 * 1000
+local BKCORE_TIMEOUT_MS = 2400
 
 local _M = {
     host = bk_core.config.get_bk_apigateway_core_addr(),
@@ -58,6 +58,19 @@ local function bk_apigateway_core_do_get(instance_id, instance_secret, host, pat
         }
     )
 
+    if err == "timeout" then
+        res, err = client:request_uri(url,
+            {
+                method = "GET",
+                headers = {
+                    ["X-Bk-Micro-Gateway-Instance-Id"] = instance_id,
+                    ["X-Bk-Micro-Gateway-Instance-Secret"] = instance_secret,
+                },
+                query = query
+            }
+        )
+    end
+
     if not res then
         err = "request failed, err: " .. err
         return nil, err
diff --git a/src/apisix/plugins/bk-components/bkauth.lua b/src/apisix/plugins/bk-components/bkauth.lua
index b841857..d9d378e 100644
--- a/src/apisix/plugins/bk-components/bkauth.lua
+++ b/src/apisix/plugins/bk-components/bkauth.lua
@@ -29,7 +29,7 @@ local VERIFY_APP_SECRET_URL = "/api/v1/apps/%s/access-keys/verify"
 local LIST_APP_SECRETS_URL = "/api/v1/apps/%s/access-keys"
 local VERIFY_ACCESS_TOKEN_URL = "/api/v1/oauth/tokens/verify"
 
-local BKAUTH_TIMEOUT_MS = 5 * 1000
+local BKAUTH_TIMEOUT_MS = 3 * 1000
 
 local bkapp = bk_core.config.get_bkapp() or {}
 
@@ -70,6 +70,28 @@ function _M.verify_app_secret(app_code, app_secret)
         }
     )
 
+    -- if got timeout, retry here
+    if err == "timeout" then
+        res, err = http_client:request_uri(
+            url, {
+                method = "POST",
+                body = core.json.encode(
+                    {
+                        bk_app_secret = app_secret,
+                    }
+                ),
+                ssl_verify = false,
+
+                headers = {
+                    ["X-Bk-App-Code"] = _M.app_code,
+                    ["X-Bk-App-Secret"] = _M.app_secret,
+                    ["X-Request-Id"] = request_id,
+                    ["Content-Type"] = "application/json",
+                },
+            }
+        )
+    end
+
     if not (res and res.body) then
         err = string_format("failed to request third-party api, url: %s, request_id: %s, err: %s, response: nil", url,
             request_id, err)
@@ -89,22 +111,21 @@ function _M.verify_app_secret(app_code, app_secret)
     if result == nil then
         core.log.error(
             string_format(
-                "failed to request %s, request_id: %s, response is not valid json, status: %s, response: %s", url,
-                request_id, res.status, res.body
+                "failed to request %s, request_id: %s, response is not valid json, status: %s, response: %s",
+                url, request_id, res.status, res.body
             )
         )
         return nil, string_format(
-            "failed to request third-party api, response is not valid json, url: %s, request_id: %s, status: %s", url,
-            request_id, res.status
+            "failed to request third-party api, response is not valid json, url: %s, request_id: %s, status: %s",
+            url, request_id, res.status
         )
     end
 
     if result.code ~= 0 or res.status ~= 200 then
         core.log.error(
             string_format(
-                "failed to request %s, request_id: %s, result.code!=0 or status!=200, status: %s, response: %s", url,
-                request_id, res.status,
-                res.body
+                "failed to request %s, request_id: %s, result.code!=0 or status!=200, status: %s, response: %s",
+                url, request_id, res.status, res.body
             )
         )
         return nil, string_format(