diff --git a/src/main/java/com/eactive/eai/adapter/http/dynamic/filter/ApiAuthFilter.java b/src/main/java/com/eactive/eai/adapter/http/dynamic/filter/ApiAuthFilter.java
index d93863c..912dbfe 100644
--- a/src/main/java/com/eactive/eai/adapter/http/dynamic/filter/ApiAuthFilter.java
+++ b/src/main/java/com/eactive/eai/adapter/http/dynamic/filter/ApiAuthFilter.java
@@ -50,6 +50,7 @@ public class ApiAuthFilter implements HttpAdapterFilter {
 
 	public static final String PROP_GROUP_AUTH_SERVER = "OAuthServer";
 	public static final String PROP_KEYSTORE_PATH = "certification.publicKeyPath";
+	public static final String PASS_SCOPE_LIST = "pass.scope.list";
 
 	public static final String ERROR_AUTHENTICATION_FAIL = "E.AUTHENTICATION_FAIL";
 	public static final String ERROR_AUTHORIZATION_FAIL = "E.AUTHORIZATION_FAIL";
@@ -59,7 +60,7 @@ public class ApiAuthFilter implements HttpAdapterFilter {
 	public static final String PAYLOAD_PARAM_NAME_CLIENT_ID = "client_id";
 
 	private JWSVerifier jwsVerifier;
-
+	private String[] passScopeArr = {};
 //    // CA 토큰 저장소
 //    private final Map<String, BearerTokenInfo> CATokenStore = new ConcurrentHashMap<>();
 
@@ -89,6 +90,10 @@ public class ApiAuthFilter implements HttpAdapterFilter {
 		} catch (IOException | NoSuchAlgorithmException | RuntimeException | InvalidKeySpecException e) {
 			throw new RuntimeException(e);
 		}
+		
+		String passScope = vo.getProperty(PASS_SCOPE_LIST, "oob,public");
+		passScopeArr = org.springframework.util.StringUtils.tokenizeToStringArray(passScope, ",");
+
 	}
 
 	@Override
@@ -316,9 +321,6 @@ public class ApiAuthFilter implements HttpAdapterFilter {
 			return false;
 		}
 		
-		String passScope = "oob,public";
-		String[] passScopeArr = org.springframework.util.StringUtils.tokenizeToStringArray(passScope, ",");
-
 		for (String scope : scopeArr) {
 			for (String pScope : passScopeArr) {
 				if ( StringUtils.equalsAny(scope, pScope)) {