diff --git a/backend/cmd/gencode/main.go b/backend/cmd/gencode/main.go
new file mode 100644
index 0000000..dae3038
--- /dev/null
+++ b/backend/cmd/gencode/main.go
@@ -0,0 +1,90 @@
+// gencode — 平台方批量生成兑换券（激活码）并写入码池 license_codes。
+//
+// 用法（在 backend/ 目录下执行，读 config/env 取数据库 DSN）：
+//
+//	go run ./cmd/gencode -type annual -days 365 -count 100 -batch 2026-summer
+//	go run ./cmd/gencode -days 30 -count 10 -note "试用补偿"
+//	go run ./cmd/gencode -type lifetime -days 0 -count 1        # 永久授权码
+//
+// 生成的码以 JIUKU-XXXX-XXXX 格式打印（status=unused），分发给用户在 App 内兑换。
+package main
+
+import (
+	"flag"
+	"fmt"
+	stdlog "log"
+	"os"
+	"time"
+
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+
+	"github.com/wangjia/jiu/backend/config"
+	"github.com/wangjia/jiu/backend/internal/model"
+	"github.com/wangjia/jiu/backend/internal/util"
+)
+
+func main() {
+	licType := flag.String("type", "annual", "计费/时长标签：trial|monthly|annual|lifetime")
+	tier := flag.String("tier", "standard", "档位（当前仅 standard）")
+	days := flag.Int("days", 365, "授予时长（天）；0 = 永久")
+	devices := flag.Int("devices", 0, "授予设备上限；0 = 兑换时不改变门店现值")
+	count := flag.Int("count", 1, "生成数量")
+	batch := flag.String("batch", "", "发放批次/活动名（便于追踪）")
+	note := flag.String("note", "", "备注")
+	flag.Parse()
+
+	if *count < 1 {
+		fmt.Fprintln(os.Stderr, "error: -count 必须 >= 1")
+		os.Exit(1)
+	}
+
+	config.Load()
+	db, err := gorm.Open(mysql.Open(config.C.Database.DSN), &gorm.Config{
+		Logger: logger.New(
+			stdlog.New(os.Stdout, "\r\n", stdlog.LstdFlags),
+			logger.Config{LogLevel: logger.Warn, IgnoreRecordNotFoundError: true},
+		),
+	})
+	if err != nil {
+		stdlog.Fatalf("连接数据库失败: %v", err)
+	}
+	if err := db.AutoMigrate(&model.LicenseCode{}); err != nil {
+		stdlog.Fatalf("迁移 license_codes 失败: %v", err)
+	}
+
+	display := make([]string, 0, *count)
+	for i := 0; i < *count; i++ {
+		// 重试避免极小概率的唯一冲突
+		var shown string
+		for attempt := 0; attempt < 5; attempt++ {
+			shown = util.GenerateRedeemCode()
+			lc := model.LicenseCode{
+				Code:         util.NormalizeCode(shown),
+				Type:         *licType,
+				Tier:         *tier,
+				DurationDays: *days,
+				MaxDevices:   *devices,
+				Status:       "unused",
+				Batch:        *batch,
+				Note:         *note,
+			}
+			err := db.Create(&lc).Error
+			if err == nil {
+				break
+			}
+			if attempt == 4 {
+				stdlog.Fatalf("写入兑换码失败（连续冲突）: %v", err)
+			}
+		}
+		display = append(display, shown)
+	}
+
+	fmt.Printf("\n✅ 已生成 %d 个兑换码（type=%s tier=%s 时长=%d天 设备=%d batch=%q）于 %s：\n\n",
+		*count, *licType, *tier, *days, *devices, *batch, time.Now().Format("2006-01-02 15:04:05"))
+	for _, c := range display {
+		fmt.Println("   " + c)
+	}
+	fmt.Println()
+}
diff --git a/backend/cmd/genkey/main.go b/backend/cmd/genkey/main.go
deleted file mode 100644
index 04cd24d..0000000
--- a/backend/cmd/genkey/main.go
+++ /dev/null
@@ -1,59 +0,0 @@
-// genkey generates an Ed25519 keypair for license signing.
-// Run once; store the private key in Bitwarden and set the public key in config.
-//
-// Usage: go run ./cmd/genkey
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/wangjia/jiu/backend/internal/util"
-)
-
-func main() {
-	priv, pub, err := util.GenerateEd25519KeyPair()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "failed to generate keypair: %v\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Println("=== Ed25519 License Keypair ===")
-	fmt.Println()
-	fmt.Println("[Bitwarden] Private key (keep secret, never commit):")
-	fmt.Println(priv)
-	fmt.Println()
-	fmt.Println("[Config / LICENSE_ED25519_PUBLIC_KEY] Public key:")
-	fmt.Println(pub)
-	fmt.Println()
-
-	// Demo: issue and verify a sample token to confirm the keypair works
-	now := time.Now()
-	exp := now.Add(30 * 24 * time.Hour).Unix()
-	sample := util.LicensePayload{
-		ShopID:     1,
-		LicenseID:  1,
-		Type:       "trial",
-		IssuedAt:   now.Unix(),
-		ExpiresAt:  &exp,
-		MaxDevices: 3,
-	}
-	token, err := util.IssueLicenseToken(sample, priv)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "demo sign failed: %v\n", err)
-		os.Exit(1)
-	}
-	verified, err := util.VerifyLicenseToken(token, pub)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "demo verify failed: %v\n", err)
-		os.Exit(1)
-	}
-	out, _ := json.MarshalIndent(verified, "", "  ")
-	fmt.Println("[Demo] Sample token (30-day trial, shop_id=1):")
-	fmt.Println(token)
-	fmt.Println()
-	fmt.Println("[Demo] Verified payload:")
-	fmt.Println(string(out))
-}
diff --git a/backend/cmd/issue/main.go b/backend/cmd/issue/main.go
deleted file mode 100644
index 31a4d1a..0000000
--- a/backend/cmd/issue/main.go
+++ /dev/null
@@ -1,72 +0,0 @@
-// issue signs a license token for a specific shop.
-// Usage: go run ./cmd/issue -shop 1 -days 365 -type annual -key <base64-private-key>
-// Or use env var: LICENSE_ED25519_PRIVATE_KEY=<key> go run ./cmd/issue -shop 1 -days 365
-package main
-
-import (
-	"encoding/json"
-	"flag"
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/wangjia/jiu/backend/internal/util"
-)
-
-func main() {
-	shopID := flag.Uint64("shop", 0, "shop ID (required)")
-	licenseID := flag.Uint64("license", 0, "license record ID (optional, 0 = omit)")
-	days := flag.Int("days", 365, "validity days; 0 = perpetual (no expiry)")
-	licType := flag.String("type", "annual", "license type: trial | annual | lifetime")
-	maxDevices := flag.Int("devices", 3, "max devices")
-	privKey := flag.String("key", "", "Ed25519 private key (base64); falls back to LICENSE_ED25519_PRIVATE_KEY env")
-	flag.Parse()
-
-	if *shopID == 0 {
-		fmt.Fprintln(os.Stderr, "error: -shop is required")
-		flag.Usage()
-		os.Exit(1)
-	}
-
-	key := *privKey
-	if key == "" {
-		key = os.Getenv("LICENSE_ED25519_PRIVATE_KEY")
-	}
-	if key == "" {
-		fmt.Fprintln(os.Stderr, "error: provide -key or set LICENSE_ED25519_PRIVATE_KEY")
-		os.Exit(1)
-	}
-
-	now := time.Now()
-	payload := util.LicensePayload{
-		ShopID:     *shopID,
-		Type:       *licType,
-		IssuedAt:   now.Unix(),
-		MaxDevices: *maxDevices,
-	}
-	if *licenseID > 0 {
-		payload.LicenseID = *licenseID
-	}
-	if *days > 0 {
-		exp := now.Add(time.Duration(*days) * 24 * time.Hour).Unix()
-		payload.ExpiresAt = &exp
-	}
-
-	token, err := util.IssueLicenseToken(payload, key)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "sign failed: %v\n", err)
-		os.Exit(1)
-	}
-
-	out, _ := json.MarshalIndent(payload, "", "  ")
-	fmt.Println("=== License Token ===")
-	fmt.Println(token)
-	fmt.Println()
-	fmt.Println("=== Payload ===")
-	fmt.Println(string(out))
-	if payload.ExpiresAt != nil {
-		fmt.Printf("\nExpires: %s\n", time.Unix(*payload.ExpiresAt, 0).Format("2006-01-02 15:04:05"))
-	} else {
-		fmt.Println("\nExpires: never (perpetual)")
-	}
-}
diff --git a/backend/cmd/seed/main.go b/backend/cmd/seed/main.go
index 5343abf..3b00785 100644
--- a/backend/cmd/seed/main.go
+++ b/backend/cmd/seed/main.go
@@ -26,6 +26,7 @@ var allModels = []any{
 	&model.Shop{},
 	&model.User{},
 	&model.License{},
+	&model.LicenseCode{},
 	&model.ProductCategory{},
 	&model.Product{},
 	&model.ProductNameOption{},
diff --git a/backend/config/config.go b/backend/config/config.go
index 5074b20..ac7a1f2 100644
--- a/backend/config/config.go
+++ b/backend/config/config.go
@@ -11,7 +11,6 @@ type Config struct {
 	Server   ServerConfig
 	Database DatabaseConfig
 	JWT      JWTConfig
-	License  LicenseConfig
 	Storage  StorageConfig
 	Session  SessionConfig
 }
@@ -34,12 +33,6 @@ type JWTConfig struct {
 	RefreshExpireH  int    `mapstructure:"refresh_expire_h"`  // Refresh Token 有效小时数
 }
 
-type LicenseConfig struct {
-	HMACSecret       string `mapstructure:"hmac_secret"`        // legacy, kept for backward compat
-	Ed25519PublicKey  string `mapstructure:"ed25519_public_key"`  // base64 Ed25519 public key for token verification
-	Ed25519PrivateKey string `mapstructure:"ed25519_private_key"` // base64 Ed25519 private key for token signing (keep in Bitwarden)
-}
-
 // SessionConfig 登录会话与并发限制（全局默认，可被每店 session_policy 覆盖）。
 type SessionConfig struct {
 	LimitDesktop int `mapstructure:"limit_desktop"` // 桌面端(win/mac/linux)最大并发会话，0=禁止
@@ -72,9 +65,6 @@ func Load() {
 	// 显式绑定没有默认值的 key，确保 AutomaticEnv 能找到对应 env var
 	_ = viper.BindEnv("database.dsn", "DATABASE_DSN")
 	_ = viper.BindEnv("jwt.secret", "JWT_SECRET")
-	_ = viper.BindEnv("license.hmac_secret", "LICENSE_HMAC_SECRET")
-	_ = viper.BindEnv("license.ed25519_public_key", "LICENSE_ED25519_PUBLIC_KEY")
-	_ = viper.BindEnv("license.ed25519_private_key", "LICENSE_ED25519_PRIVATE_KEY")
 	_ = viper.BindEnv("storage.upload_dir", "STORAGE_UPLOAD_DIR")
 	_ = viper.BindEnv("storage.base_url", "STORAGE_BASE_URL")
 	_ = viper.BindEnv("storage.public_url", "STORAGE_PUBLIC_URL")
diff --git a/backend/internal/handler/auth_test.go b/backend/internal/handler/auth_test.go
index 5bd776e..680ec07 100644
--- a/backend/internal/handler/auth_test.go
+++ b/backend/internal/handler/auth_test.go
@@ -11,10 +11,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/wangjia/jiu/backend/config"
 	"github.com/wangjia/jiu/backend/internal/middleware"
 	"github.com/wangjia/jiu/backend/internal/service"
-	"github.com/wangjia/jiu/backend/internal/util"
 	"github.com/wangjia/jiu/backend/testutil"
 )
 
@@ -301,16 +299,13 @@ func TestAuthHandler_Login_ResponseContainsUserInfo(t *testing.T) {
 // #8 心跳 /auth/ping 回带授权概况，客户端据此免去单独轮询 /license/info。
 func TestAuthHandler_Ping_ReturnsLicense(t *testing.T) {
 	db := testutil.SetupTestDB()
-	priv, _, err := util.GenerateEd25519KeyPair()
-	require.NoError(t, err)
-	config.C.License.Ed25519PrivateKey = priv
 
 	shop := testutil.CreateTestShop(db, "AHPING")
 	testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
 
 	authSvc := service.NewAuthService(db)
 	// 登录触发首登自动 trial。
-	_, _, err = authSvc.Login("AHPING", "admin", "password123", service.DeviceInfo{Platform: "windows"})
+	_, _, err := authSvc.Login("AHPING", "admin", "password123", service.DeviceInfo{Platform: "windows"})
 	require.NoError(t, err)
 
 	licSvc := service.NewLicenseService(db)
diff --git a/backend/internal/handler/license.go b/backend/internal/handler/license.go
index 810c567..c995cda 100644
--- a/backend/internal/handler/license.go
+++ b/backend/internal/handler/license.go
@@ -17,11 +17,12 @@ func NewLicenseHandler(svc *service.LicenseService) *LicenseHandler {
 	return &LicenseHandler{svc: svc}
 }
 
-// Activate POST /api/v1/license/activate
+// Activate POST /api/v1/license/activate — 兑换激活码（时长券），把时长叠加到门店授权。
+// 路由名保留 activate 以兼容客户端；内部走 Redeem 逻辑。
 func (h *LicenseHandler) Activate(c *gin.Context) {
 	shopID := middleware.GetShopID(c)
 	var req struct {
-		LicenseKey string `json:"license_key" binding:"required"`
+		LicenseKey string `json:"license_key" binding:"required"` // 承载激活码（短码）
 		DeviceID   string `json:"device_id" binding:"required"`
 		DeviceName string `json:"device_name"`
 		Platform   string `json:"platform"`
@@ -31,7 +32,7 @@ func (h *LicenseHandler) Activate(c *gin.Context) {
 		return
 	}
 
-	lic, err := h.svc.Activate(shopID, req.LicenseKey, req.DeviceID, req.DeviceName, req.Platform)
+	lic, err := h.svc.Redeem(shopID, req.LicenseKey, req.DeviceID, req.DeviceName, req.Platform)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
diff --git a/backend/internal/handler/license_test.go b/backend/internal/handler/license_test.go
index 6ef3cae..d20a2c3 100644
--- a/backend/internal/handler/license_test.go
+++ b/backend/internal/handler/license_test.go
@@ -19,28 +19,32 @@ func TestLicenseHandler_Activate_Success(t *testing.T) {
 	token := getAuthToken(user.ID, shop.ID, "admin")
 	r := setupProtectedRouter(db)
 
-	expiry := time.Now().Add(30 * 24 * time.Hour)
-	lic := &model.License{
-		ShopID:     shop.ID,
-		LicenseKey: "LHACT-BBBBB-CCCCC-DDDDD",
-		IsActive:   true,
-		ExpiresAt:  &expiry,
-		MaxDevices: 3,
-	}
-	require.NoError(t, db.Create(lic).Error)
+	// 码池里放一张未用兑换码（30 天）
+	require.NoError(t, db.Create(&model.LicenseCode{
+		Code: "JIUKUTEST0001", Type: "annual", Tier: "standard",
+		DurationDays: 30, MaxDevices: 3, Status: "unused",
+	}).Error)
 
+	// 请求带连字符/会被归一化为 JIUKUTEST0001
 	w := makeRequest(r, "POST", "/api/v1/license/activate", token, map[string]interface{}{
-		"license_key": "LHACT-BBBBB-CCCCC-DDDDD",
+		"license_key": "JIUKU-TEST-0001",
 		"device_id":   "device-123",
 		"device_name": "Test Machine",
 		"platform":    "windows",
 	})
 	assert.Equal(t, http.StatusOK, w.Code)
 
-	// Verify device was recorded in license_devices
+	// 兑换后门店生成授权行 + 设备绑定
+	var lic model.License
+	require.NoError(t, db.Where("shop_id = ?", shop.ID).First(&lic).Error)
 	var dev model.LicenseDevice
 	require.NoError(t, db.Where("license_id = ? AND device_id = ?", lic.ID, "device-123").First(&dev).Error)
 	assert.Equal(t, "Test Machine", dev.DeviceName)
+
+	// 码被标记已用
+	var lc model.LicenseCode
+	require.NoError(t, db.Where("code = ?", "JIUKUTEST0001").First(&lc).Error)
+	assert.Equal(t, "redeemed", lc.Status)
 }
 
 func TestLicenseHandler_Activate_MissingFields(t *testing.T) {
@@ -84,40 +88,31 @@ func TestLicenseHandler_Activate_DeviceLimitExceeded(t *testing.T) {
 	token := getAuthToken(user.ID, shop.ID, "admin")
 	r := setupProtectedRouter(db)
 
+	// 既有授权：1 个设备名额已占满
+	future := time.Now().Add(30 * 24 * time.Hour)
 	lic := &model.License{
-		ShopID: shop.ID, LicenseKey: "LHBND-BBBBB-CCCCC-DDDDD", IsActive: true, MaxDevices: 1,
+		ShopID: shop.ID, LicenseKey: "TRIAL-LH004", IsActive: true, MaxDevices: 1, ExpiresAt: &future,
 	}
 	require.NoError(t, db.Create(lic).Error)
-	// Fill the single allowed slot
 	require.NoError(t, db.Create(&model.LicenseDevice{
 		LicenseID: lic.ID, ShopID: shop.ID, DeviceID: "existing-device",
 	}).Error)
+	// 码不提升设备上限（max_devices=0）
+	require.NoError(t, db.Create(&model.LicenseCode{
+		Code: "JIUKUDEVLIMIT1", Type: "annual", Tier: "standard",
+		DurationDays: 365, MaxDevices: 0, Status: "unused",
+	}).Error)
 
 	w := makeRequest(r, "POST", "/api/v1/license/activate", token, map[string]interface{}{
-		"license_key": "LHBND-BBBBB-CCCCC-DDDDD",
+		"license_key": "JIUKU-DEVL-IMIT1",
 		"device_id":   "different-device",
 	})
 	assert.Equal(t, http.StatusBadRequest, w.Code)
-}
 
-func TestLicenseHandler_Activate_Expired(t *testing.T) {
-	db := testutil.SetupTestDB()
-	shop := testutil.CreateTestShop(db, "LH005")
-	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
-	token := getAuthToken(user.ID, shop.ID, "admin")
-	r := setupProtectedRouter(db)
-
-	expiry := time.Now().Add(-24 * time.Hour)
-	lic := &model.License{
-		ShopID: shop.ID, LicenseKey: "LHEXP-BBBBB-CCCCC-DDDDD", IsActive: true, ExpiresAt: &expiry, MaxDevices: 3,
-	}
-	require.NoError(t, db.Create(lic).Error)
-
-	w := makeRequest(r, "POST", "/api/v1/license/activate", token, map[string]interface{}{
-		"license_key": "LHEXP-BBBBB-CCCCC-DDDDD",
-		"device_id":   "device-123",
-	})
-	assert.Equal(t, http.StatusBadRequest, w.Code)
+	// 设备超限 → 整笔回滚：码仍未使用
+	var lc model.LicenseCode
+	require.NoError(t, db.Where("code = ?", "JIUKUDEVLIMIT1").First(&lc).Error)
+	assert.Equal(t, "unused", lc.Status)
 }
 
 func TestLicenseHandler_Activate_NoAuth(t *testing.T) {
diff --git a/backend/internal/middleware/license_guard_test.go b/backend/internal/middleware/license_guard_test.go
index 97ab7f2..2f636d6 100644
--- a/backend/internal/middleware/license_guard_test.go
+++ b/backend/internal/middleware/license_guard_test.go
@@ -60,7 +60,7 @@ func TestLicenseGuardUsesLiveDBPhase(t *testing.T) {
 		id INTEGER PRIMARY KEY AUTOINCREMENT,
 		created_at DATETIME, updated_at DATETIME, deleted_at DATETIME,
 		shop_id INTEGER NOT NULL,
-		license_key TEXT, type TEXT, expires_at DATETIME,
+		license_key TEXT, type TEXT, tier TEXT DEFAULT 'standard', expires_at DATETIME,
 		is_active INTEGER DEFAULT 1, max_devices INTEGER DEFAULT 3,
 		features TEXT, device_id TEXT, activated_at DATETIME
 	)`).Error)
@@ -125,7 +125,7 @@ func TestLicenseGuardRevokedAndInvalidation(t *testing.T) {
 		id INTEGER PRIMARY KEY AUTOINCREMENT,
 		created_at DATETIME, updated_at DATETIME, deleted_at DATETIME,
 		shop_id INTEGER NOT NULL,
-		license_key TEXT, type TEXT, expires_at DATETIME,
+		license_key TEXT, type TEXT, tier TEXT DEFAULT 'standard', expires_at DATETIME,
 		is_active INTEGER DEFAULT 1, max_devices INTEGER DEFAULT 3,
 		features TEXT, device_id TEXT, activated_at DATETIME
 	)`).Error)
diff --git a/backend/internal/model/license.go b/backend/internal/model/license.go
index 6d5551d..318d2c3 100644
--- a/backend/internal/model/license.go
+++ b/backend/internal/model/license.go
@@ -7,7 +7,9 @@ type License struct {
 	ShopID     uint64     `gorm:"not null;index" json:"shop_id"`
 	LicenseKey string     `gorm:"size:768;uniqueIndex" json:"license_key"`
 	Type       string     `gorm:"type:enum('trial','monthly','annual','lifetime');default:'trial'" json:"type"`
-	ExpiresAt  *time.Time `json:"expires_at"`
+	// Tier 当前权益档位（标准/pro/max…），随兑换码写入；当前默认 'standard'，暂不据此做能力差异。
+	Tier      string     `gorm:"size:32;not null;default:'standard'" json:"tier"`
+	ExpiresAt *time.Time `json:"expires_at"`
 	IsActive   bool       `gorm:"default:true" json:"is_active"`
 	MaxDevices int        `gorm:"default:3" json:"max_devices"`
 	Features   JSON       `gorm:"type:json" json:"features,omitempty"`
diff --git a/backend/internal/model/license_code.go b/backend/internal/model/license_code.go
new file mode 100644
index 0000000..6c74e8f
--- /dev/null
+++ b/backend/internal/model/license_code.go
@@ -0,0 +1,27 @@
+package model
+
+import "time"
+
+// LicenseCode 兑换券（激活码）。由平台方批量生成，用户购买/活动获得后在自己门店兑换。
+// 每张码代表一段时长（duration_days），兑换时叠加到门店当前到期时间上；一码一次（status 控制）。
+type LicenseCode struct {
+	ID   uint64 `gorm:"primaryKey;autoIncrement" json:"id"`
+	Code string `gorm:"size:32;uniqueIndex;not null" json:"code"` // 归一化大写无连字符存储
+
+	Type string `gorm:"type:enum('trial','monthly','annual','lifetime');default:'annual'" json:"type"` // 计费/时长标签
+	// Tier 档位钩子（类似 pro/max）。当前只用 'standard' 一种，分档能力/消费模式后续设计。
+	Tier         string `gorm:"size:32;not null;default:'standard'" json:"tier"`
+	DurationDays int    `gorm:"not null;default:0" json:"duration_days"` // 授予时长；0 = 永久（lifetime）
+	MaxDevices   int    `gorm:"not null;default:0" json:"max_devices"`   // 授予设备上限；0 = 不改变现值
+
+	Status           string     `gorm:"type:enum('unused','redeemed','void');default:'unused';index" json:"status"`
+	RedeemedShopID   *uint64    `gorm:"index" json:"redeemed_shop_id,omitempty"`
+	RedeemedAt       *time.Time `json:"redeemed_at,omitempty"`
+	RedeemedDeviceID string     `gorm:"size:255" json:"redeemed_device_id,omitempty"`
+
+	Batch string `gorm:"size:64" json:"batch,omitempty"` // 发放批次/活动名
+	Note  string `gorm:"size:255" json:"note,omitempty"`
+
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
diff --git a/backend/internal/service/auth_test.go b/backend/internal/service/auth_test.go
index e5d518f..261feaf 100644
--- a/backend/internal/service/auth_test.go
+++ b/backend/internal/service/auth_test.go
@@ -7,9 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/wangjia/jiu/backend/config"
 	"github.com/wangjia/jiu/backend/internal/model"
-	"github.com/wangjia/jiu/backend/internal/util"
 	"github.com/wangjia/jiu/backend/testutil"
 )
 
@@ -31,9 +29,6 @@ func TestAuthService_Login_Success(t *testing.T) {
 
 func TestAuthService_Login_AutoTrialOnFirstUse(t *testing.T) {
 	db := testutil.SetupTestDB()
-	priv, _, err := util.GenerateEd25519KeyPair()
-	require.NoError(t, err)
-	config.C.License.Ed25519PrivateKey = priv
 
 	shop := testutil.CreateTestShop(db, "TRIAL001")
 	testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
@@ -46,7 +41,7 @@ func TestAuthService_Login_AutoTrialOnFirstUse(t *testing.T) {
 	svc := NewAuthService(db)
 
 	// 首次登录 → 自动签发 30 天 trial
-	_, _, err = svc.Login("TRIAL001", "admin", "password123", DeviceInfo{Platform: "windows"})
+	_, _, err := svc.Login("TRIAL001", "admin", "password123", DeviceInfo{Platform: "windows"})
 	require.NoError(t, err)
 
 	var lic model.License
diff --git a/backend/internal/service/license.go b/backend/internal/service/license.go
index abb5b5a..4eddef7 100644
--- a/backend/internal/service/license.go
+++ b/backend/internal/service/license.go
@@ -1,18 +1,13 @@
 package service
 
 import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base32"
 	"errors"
-	"fmt"
 	"log"
-	"strings"
 	"time"
 
+	"github.com/google/uuid"
 	"gorm.io/gorm"
 
-	"github.com/wangjia/jiu/backend/config"
 	"github.com/wangjia/jiu/backend/internal/middleware"
 	"github.com/wangjia/jiu/backend/internal/model"
 	"github.com/wangjia/jiu/backend/internal/util"
@@ -22,7 +17,12 @@ var (
 	ErrLicenseNotFound   = errors.New("license not found")
 	ErrLicenseInactive   = errors.New("license is inactive")
 	ErrLicenseExpired    = errors.New("license has expired")
-	ErrDeviceLimitExceed = errors.New("device limit reached — deactivate another device first")
+	ErrDeviceLimitExceed = errors.New("设备数已达上限，请先在其它设备上解绑后再试")
+
+	// 兑换券（激活码）相关错误，消息直接面向用户。
+	ErrCodeNotFound = errors.New("无效激活码")
+	ErrCodeUsed     = errors.New("该激活码已被使用")
+	ErrCodeVoid     = errors.New("该激活码已失效")
 )
 
 type LicenseService struct {
@@ -33,69 +33,150 @@ func NewLicenseService(db *gorm.DB) *LicenseService {
 	return &LicenseService{db: db}
 }
 
-// GenerateKey 生成许可证激活码
-// 格式：HMAC-SHA256(shopID+licenseType+expiry, secret) → base32, 每5字符加'-'
-func GenerateKey(shopID uint64, licenseType string, expiresAt *time.Time) string {
-	payload := fmt.Sprintf("%d:%s", shopID, licenseType)
-	if expiresAt != nil {
-		payload += ":" + expiresAt.Format("20060102")
-	}
-	mac := hmac.New(sha256.New, []byte(config.C.License.HMACSecret))
-	mac.Write([]byte(payload))
-	raw := base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(mac.Sum(nil))
-	// 截取前20字符，分4段，每段5字符
-	raw = strings.ToUpper(raw)[:20]
-	return fmt.Sprintf("%s-%s-%s-%s", raw[0:5], raw[5:10], raw[10:15], raw[15:20])
-}
-
-// Activate 激活许可证并绑定设备到 license_devices 表。
-// 若该设备已绑定，则更新 last_seen_at（幂等）。
-// 若是新设备，则校验是否超出 max_devices 上限。
-func (s *LicenseService) Activate(shopID uint64, licenseKey, deviceID, deviceName, platform string) (*model.License, error) {
-	var lic model.License
-	if err := s.db.Where("license_key = ? AND shop_id = ?", licenseKey, shopID).First(&lic).Error; err != nil {
-		return nil, ErrLicenseNotFound
-	}
-	if !lic.IsActive {
-		return nil, ErrLicenseInactive
-	}
-	if lic.ExpiresAt != nil && time.Now().After(*lic.ExpiresAt) {
-		return nil, ErrLicenseExpired
+// Redeem 兑换一张激活码（时长券）：校验码有效且未使用 → 把时长叠加到门店当前授权的到期时间
+// → 标记码已用 → 绑定本设备。整个过程在单事务内，check-then-act 用 FOR UPDATE 锁行，
+// 保证一码只能被成功兑换一次（并发下恰一个成功）。
+//
+// 时长叠加规则：新到期 = max(今天, 当前到期) + duration_days；duration_days=0 视为永久（到期置 NULL）。
+func (s *LicenseService) Redeem(shopID uint64, rawCode, deviceID, deviceName, platform string) (*model.License, error) {
+	code := util.NormalizeCode(rawCode)
+	if code == "" {
+		return nil, ErrCodeNotFound
 	}
 
-	// 激活成功即清除该店 phase 缓存：续费/换新授权码后写权限即时恢复，不必等 30s TTL。
-	defer middleware.InvalidateLicensePhase(shopID)
-
-	var existing model.LicenseDevice
-	err := s.db.Where("license_id = ? AND device_id = ?", lic.ID, deviceID).First(&existing).Error
-	if err == nil {
-		// Device already bound — just touch last_seen_at (handled by autoUpdateTime)
-		if err := s.db.Model(&existing).Update("device_name", deviceName).Error; err != nil {
-			return nil, err
+	var result model.License
+	err := s.db.Transaction(func(tx *gorm.DB) error {
+		// 1) 锁定并校验兑换码
+		var lc model.LicenseCode
+		if err := tx.Set("gorm:query_option", "FOR UPDATE").
+			Where("code = ?", code).First(&lc).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return ErrCodeNotFound
+			}
+			return err
+		}
+		switch lc.Status {
+		case "redeemed":
+			return ErrCodeUsed
+		case "void":
+			return ErrCodeVoid
 		}
-		return &lic, nil
-	}
 
-	// New device — enforce max_devices
-	var count int64
-	if err := s.db.Model(&model.LicenseDevice{}).Where("license_id = ?", lic.ID).Count(&count).Error; err != nil {
+		now := time.Now()
+
+		// 2) 取本店最新有效授权行（锁行）；无则新建一行
+		var lic model.License
+		err := tx.Set("gorm:query_option", "FOR UPDATE").
+			Where("shop_id = ? AND is_active = ?", shopID, true).
+			Order("id DESC").First(&lic).Error
+		creating := errors.Is(err, gorm.ErrRecordNotFound)
+		if err != nil && !creating {
+			return err
+		}
+
+		// 3) 计算叠加后的到期时间
+		var newExpires *time.Time
+		if lc.DurationDays > 0 {
+			base := now
+			if lic.ExpiresAt != nil && lic.ExpiresAt.After(now) {
+				base = *lic.ExpiresAt
+			}
+			t := base.Add(time.Duration(lc.DurationDays) * 24 * time.Hour)
+			newExpires = &t
+		} // duration_days==0 → 永久授权，newExpires 保持 nil
+
+		maxDevices := lic.MaxDevices
+		if lc.MaxDevices > maxDevices {
+			maxDevices = lc.MaxDevices
+		}
+		if maxDevices == 0 {
+			maxDevices = 1
+		}
+
+		if creating {
+			lic = model.License{
+				ShopID:     shopID,
+				LicenseKey: "REDEEM-" + uuid.New().String(),
+				Type:       lc.Type,
+				Tier:       lc.Tier,
+				ExpiresAt:  newExpires,
+				IsActive:   true,
+				MaxDevices: maxDevices,
+			}
+			if err := tx.Create(&lic).Error; err != nil {
+				return err
+			}
+		} else {
+			// 不动 license_key（保留原值，licenses 行只表示"当前权益"）
+			if err := tx.Model(&lic).Updates(map[string]any{
+				"type":        lc.Type,
+				"tier":        lc.Tier,
+				"expires_at":  newExpires,
+				"is_active":   true,
+				"max_devices": maxDevices,
+			}).Error; err != nil {
+				return err
+			}
+			lic.ExpiresAt = newExpires
+			lic.Type = lc.Type
+			lic.Tier = lc.Tier
+			lic.MaxDevices = maxDevices
+		}
+
+		// 4) 绑定本设备（幂等 + max_devices 上限校验）
+		if err := bindDevice(tx, &lic, deviceID, deviceName, platform); err != nil {
+			return err
+		}
+
+		// 5) 标记码已用
+		if err := tx.Model(&model.LicenseCode{}).Where("id = ?", lc.ID).Updates(map[string]any{
+			"status":             "redeemed",
+			"redeemed_shop_id":   shopID,
+			"redeemed_at":        now,
+			"redeemed_device_id": deviceID,
+		}).Error; err != nil {
+			return err
+		}
+
+		result = lic
+		return nil
+	})
+	if err != nil {
 		return nil, err
 	}
-	if int(count) >= lic.MaxDevices {
-		return nil, ErrDeviceLimitExceed
-	}
 
-	dev := model.LicenseDevice{
+	// 事务提交后再失效 phase 缓存：此刻新到期对其它连接已可见，写权限即时恢复，不必等 30s TTL。
+	middleware.InvalidateLicensePhase(shopID)
+	return &result, nil
+}
+
+// bindDevice 把设备绑定到许可证（幂等：已绑则更新名称；新设备则校验 max_devices 上限）。
+func bindDevice(tx *gorm.DB, lic *model.License, deviceID, deviceName, platform string) error {
+	if deviceID == "" {
+		return nil // 无设备信息（如服务端工具调用）则跳过绑定
+	}
+	var existing model.LicenseDevice
+	err := tx.Where("license_id = ? AND device_id = ?", lic.ID, deviceID).First(&existing).Error
+	if err == nil {
+		return tx.Model(&existing).Update("device_name", deviceName).Error
+	}
+	if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return err
+	}
+	var count int64
+	if err := tx.Model(&model.LicenseDevice{}).Where("license_id = ?", lic.ID).Count(&count).Error; err != nil {
+		return err
+	}
+	if int(count) >= lic.MaxDevices {
+		return ErrDeviceLimitExceed
+	}
+	return tx.Create(&model.LicenseDevice{
 		LicenseID:  lic.ID,
-		ShopID:     shopID,
+		ShopID:     lic.ShopID,
 		DeviceID:   deviceID,
 		DeviceName: deviceName,
 		Platform:   platform,
-	}
-	if err := s.db.Create(&dev).Error; err != nil {
-		return nil, err
-	}
-	return &lic, nil
+	}).Error
 }
 
 // Verify 验证设备许可证（客户端启动时调用）。
@@ -188,33 +269,15 @@ func (s *LicenseService) Deactivate(shopID uint64, deviceID string) error {
 		Delete(&model.LicenseDevice{}).Error
 }
 
-// issueTrialLicense 为门店签发并写入一条 30 天 trial license。
-// 私钥未配置或签发/落库失败时返回 error，由调用方决定如何处理（注册路径 Fatal、
-// 登录路径仅记日志）。
+// issueTrialLicense 为门店写入一条 30 天 trial license。直接建行（无需签名/私钥），
+// license_key 用合成唯一值占位以满足 NOT NULL/UNIQUE。落库失败返回 error。
 func issueTrialLicense(db *gorm.DB, shopID uint64) error {
-	privKey := config.C.License.Ed25519PrivateKey
-	if privKey == "" {
-		return fmt.Errorf("ed25519 private key not configured")
-	}
-
 	expiresAt := time.Now().Add(30 * 24 * time.Hour)
-	expiresUnix := expiresAt.Unix()
-	payload := util.LicensePayload{
-		ShopID:     shopID,
-		Type:       "trial",
-		IssuedAt:   time.Now().Unix(),
-		ExpiresAt:  &expiresUnix,
-		MaxDevices: 1,
-	}
-	token, err := util.IssueLicenseToken(payload, privKey)
-	if err != nil {
-		return err
-	}
-
 	lic := model.License{
 		ShopID:     shopID,
-		LicenseKey: token,
+		LicenseKey: "TRIAL-" + uuid.New().String(),
 		Type:       "trial",
+		Tier:       "standard",
 		ExpiresAt:  &expiresAt,
 		IsActive:   true,
 		MaxDevices: 1,
@@ -228,12 +291,8 @@ func issueTrialLicense(db *gorm.DB, shopID uint64) error {
 	return nil
 }
 
-// createTrialLicense 在注册事务中为新门店签发 30 天 trial license。
-// 私钥未配置时 Fatal，防止生产环境静默跳过导致新注册门店无 license。
+// createTrialLicense 在注册事务中为新门店写入 30 天 trial license。失败仅记日志、不阻断注册。
 func createTrialLicense(tx *gorm.DB, shopID uint64) {
-	if config.C.License.Ed25519PrivateKey == "" {
-		log.Fatalf("[license] Ed25519 private key not configured — cannot issue trial for shop %d; set License.Ed25519PrivateKey in config", shopID)
-	}
 	if err := issueTrialLicense(tx, shopID); err != nil {
 		log.Printf("[license] failed to create trial license for shop %d: %v", shopID, err)
 	}
diff --git a/backend/internal/service/license_test.go b/backend/internal/service/license_test.go
index 5bea32d..7f4f093 100644
--- a/backend/internal/service/license_test.go
+++ b/backend/internal/service/license_test.go
@@ -6,155 +6,185 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
 
 	"github.com/wangjia/jiu/backend/internal/model"
+	"github.com/wangjia/jiu/backend/internal/util"
 	"github.com/wangjia/jiu/backend/testutil"
 )
 
-func TestLicenseService_Activate_Success(t *testing.T) {
-	db := testutil.SetupTestDB()
-	shop := testutil.CreateTestShop(db, "LIC001")
-
-	expiry := time.Now().Add(30 * 24 * time.Hour)
-	lic := &model.License{
-		ShopID:     shop.ID,
-		LicenseKey: "AAAAA-BBBBB-CCCCC-DDDDD",
-		IsActive:   true,
-		ExpiresAt:  &expiry,
-		MaxDevices: 3,
-	}
-	require.NoError(t, db.Create(lic).Error)
-
-	svc := NewLicenseService(db)
-	result, err := svc.Activate(shop.ID, "AAAAA-BBBBB-CCCCC-DDDDD", "device-001", "Test PC", "windows")
-
-	require.NoError(t, err)
-	require.NotNil(t, result)
-
-	// Verify device record was created
-	var dev model.LicenseDevice
-	require.NoError(t, db.Where("license_id = ? AND device_id = ?", lic.ID, "device-001").First(&dev).Error)
-	assert.Equal(t, "Test PC", dev.DeviceName)
-	assert.Equal(t, "windows", dev.Platform)
+// createCode 在码池写入一张 unused 兑换码（默认 type=annual / tier=standard）。
+func createCode(t *testing.T, db *gorm.DB, code string, durationDays, maxDevices int) {
+	t.Helper()
+	require.NoError(t, db.Create(&model.LicenseCode{
+		Code:         util.NormalizeCode(code),
+		Type:         "annual",
+		Tier:         "standard",
+		DurationDays: durationDays,
+		MaxDevices:   maxDevices,
+		Status:       "unused",
+	}).Error)
 }
 
-func TestLicenseService_Activate_SameDeviceIdempotent(t *testing.T) {
-	db := testutil.SetupTestDB()
-	shop := testutil.CreateTestShop(db, "LIC002")
-
-	lic := &model.License{
-		ShopID:     shop.ID,
-		LicenseKey: "EEEEE-FFFFF-GGGGG-HHHHH",
-		IsActive:   true,
-		MaxDevices: 3,
+func daysFromNow(t *time.Time) float64 {
+	if t == nil {
+		return 0
 	}
-	require.NoError(t, db.Create(lic).Error)
-	// Pre-bind the device
-	require.NoError(t, db.Create(&model.LicenseDevice{
-		LicenseID: lic.ID, ShopID: shop.ID, DeviceID: "same-device",
+	return time.Until(*t).Hours() / 24
+}
+
+// 首次兑换（门店尚无授权行）：新建一行，到期 = 今天 + 时长，码标记已用并绑定设备。
+func TestLicenseService_Redeem_NewShop(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "RDM001")
+	createCode(t, db, "JIUKU-AAAA-BBBB", 365, 3)
+
+	svc := NewLicenseService(db)
+	// 传小写 + 连字符，验证归一化
+	lic, err := svc.Redeem(shop.ID, "jiuku-aaaa-bbbb", "dev-1", "Test PC", "windows")
+	require.NoError(t, err)
+	require.NotNil(t, lic)
+	assert.InDelta(t, 365, daysFromNow(lic.ExpiresAt), 1)
+	assert.Equal(t, 3, lic.MaxDevices)
+	assert.Equal(t, "standard", lic.Tier)
+	assert.Equal(t, "annual", lic.Type)
+
+	var lc model.LicenseCode
+	require.NoError(t, db.Where("code = ?", "JIUKUAAAABBBB").First(&lc).Error)
+	assert.Equal(t, "redeemed", lc.Status)
+	require.NotNil(t, lc.RedeemedShopID)
+	assert.Equal(t, shop.ID, *lc.RedeemedShopID)
+
+	var dev model.LicenseDevice
+	require.NoError(t, db.Where("license_id = ? AND device_id = ?", lic.ID, "dev-1").First(&dev).Error)
+	assert.Equal(t, "Test PC", dev.DeviceName)
+}
+
+// 在既有未过期授权上兑换：到期时间叠加在原到期之后。
+func TestLicenseService_Redeem_ExtendsExisting(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "RDM002")
+	expiry := time.Now().Add(10 * 24 * time.Hour)
+	require.NoError(t, db.Create(&model.License{
+		ShopID: shop.ID, LicenseKey: "TRIAL-RDM002", Type: "trial", Tier: "standard",
+		ExpiresAt: &expiry, IsActive: true, MaxDevices: 3,
+	}).Error)
+	createCode(t, db, "JIUKU-CCCC-DDDD", 365, 0)
+
+	svc := NewLicenseService(db)
+	lic, err := svc.Redeem(shop.ID, "JIUKU-CCCC-DDDD", "dev-1", "PC", "windows")
+	require.NoError(t, err)
+	// 原剩 10 天 + 365 ≈ 375
+	assert.InDelta(t, 375, daysFromNow(lic.ExpiresAt), 1)
+}
+
+// 叠加：连兑两张码，时长累加。
+func TestLicenseService_Redeem_Stacks(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "RDM003")
+	createCode(t, db, "JIUKU-1111-1111", 365, 1)
+	createCode(t, db, "JIUKU-2222-2222", 365, 1)
+
+	svc := NewLicenseService(db)
+	_, err := svc.Redeem(shop.ID, "JIUKU-1111-1111", "dev-1", "PC", "windows")
+	require.NoError(t, err)
+	lic, err := svc.Redeem(shop.ID, "JIUKU-2222-2222", "dev-1", "PC", "windows")
+	require.NoError(t, err)
+	assert.InDelta(t, 730, daysFromNow(lic.ExpiresAt), 1)
+}
+
+// 已过期门店兑换：从今天起算，不在过去叠加。
+func TestLicenseService_Redeem_ExpiredBase(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "RDM004")
+	past := time.Now().Add(-5 * 24 * time.Hour)
+	require.NoError(t, db.Create(&model.License{
+		ShopID: shop.ID, LicenseKey: "TRIAL-RDM004", Type: "trial", Tier: "standard",
+		ExpiresAt: &past, IsActive: true, MaxDevices: 1,
+	}).Error)
+	createCode(t, db, "JIUKU-EEEE-FFFF", 30, 0)
+
+	svc := NewLicenseService(db)
+	lic, err := svc.Redeem(shop.ID, "JIUKU-EEEE-FFFF", "dev-1", "PC", "windows")
+	require.NoError(t, err)
+	assert.InDelta(t, 30, daysFromNow(lic.ExpiresAt), 1)
+}
+
+// 永久码（duration=0）：到期置 NULL。
+func TestLicenseService_Redeem_Lifetime(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "RDM005")
+	createCode(t, db, "JIUKU-LIFE-TIME", 0, 1)
+
+	svc := NewLicenseService(db)
+	lic, err := svc.Redeem(shop.ID, "JIUKU-LIFE-TIME", "dev-1", "PC", "windows")
+	require.NoError(t, err)
+	assert.Nil(t, lic.ExpiresAt)
+}
+
+// 一码一次：同码兑换两次，第二次失败。
+func TestLicenseService_Redeem_AlreadyUsed(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "RDM006")
+	createCode(t, db, "JIUKU-USED-ONCE", 365, 1)
+
+	svc := NewLicenseService(db)
+	_, err := svc.Redeem(shop.ID, "JIUKU-USED-ONCE", "dev-1", "PC", "windows")
+	require.NoError(t, err)
+	_, err = svc.Redeem(shop.ID, "JIUKU-USED-ONCE", "dev-1", "PC", "windows")
+	assert.Equal(t, ErrCodeUsed, err)
+}
+
+func TestLicenseService_Redeem_NotFound(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "RDM007")
+
+	svc := NewLicenseService(db)
+	_, err := svc.Redeem(shop.ID, "JIUKU-NONE-XXXX", "dev-1", "", "")
+	assert.Equal(t, ErrCodeNotFound, err)
+}
+
+func TestLicenseService_Redeem_Void(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "RDM008")
+	require.NoError(t, db.Create(&model.LicenseCode{
+		Code: "JIUKUVOIDCODE0", Type: "annual", Tier: "standard",
+		DurationDays: 365, Status: "void",
 	}).Error)
 
 	svc := NewLicenseService(db)
-	// Re-activating same device should succeed (idempotent)
-	result, err := svc.Activate(shop.ID, "EEEEE-FFFFF-GGGGG-HHHHH", "same-device", "Updated Name", "windows")
-
-	require.NoError(t, err)
-	require.NotNil(t, result)
-
-	// Still only one device record
-	var count int64
-	db.Model(&model.LicenseDevice{}).Where("license_id = ?", lic.ID).Count(&count)
-	assert.Equal(t, int64(1), count)
+	_, err := svc.Redeem(shop.ID, "JIUKU-VOID-CODE0", "dev-1", "", "")
+	assert.Equal(t, ErrCodeVoid, err)
 }
 
-func TestLicenseService_Activate_DeviceLimitExceeded(t *testing.T) {
+// 设备超上限：兑换整体回滚——码保持 unused、到期不变。
+func TestLicenseService_Redeem_DeviceLimitRollsBack(t *testing.T) {
 	db := testutil.SetupTestDB()
-	shop := testutil.CreateTestShop(db, "LIC003")
-
+	shop := testutil.CreateTestShop(db, "RDM009")
+	expiry := time.Now().Add(10 * 24 * time.Hour)
 	lic := &model.License{
-		ShopID:     shop.ID,
-		LicenseKey: "IIIII-JJJJJ-KKKKK-LLLLL",
-		IsActive:   true,
-		MaxDevices: 2,
+		ShopID: shop.ID, LicenseKey: "TRIAL-RDM009", Type: "trial", Tier: "standard",
+		ExpiresAt: &expiry, IsActive: true, MaxDevices: 1,
 	}
 	require.NoError(t, db.Create(lic).Error)
-	// Fill up the device limit
-	require.NoError(t, db.Create(&model.LicenseDevice{LicenseID: lic.ID, ShopID: shop.ID, DeviceID: "dev-1"}).Error)
-	require.NoError(t, db.Create(&model.LicenseDevice{LicenseID: lic.ID, ShopID: shop.ID, DeviceID: "dev-2"}).Error)
+	// 已占满 1 个设备名额
+	require.NoError(t, db.Create(&model.LicenseDevice{
+		LicenseID: lic.ID, ShopID: shop.ID, DeviceID: "old-dev",
+	}).Error)
+	createCode(t, db, "JIUKU-DEVL-IMIT", 365, 0) // 不提升设备上限
 
 	svc := NewLicenseService(db)
-	result, err := svc.Activate(shop.ID, "IIIII-JJJJJ-KKKKK-LLLLL", "dev-3", "", "")
-
-	assert.Error(t, err)
+	_, err := svc.Redeem(shop.ID, "JIUKU-DEVL-IMIT", "new-dev", "New PC", "windows")
 	assert.Equal(t, ErrDeviceLimitExceed, err)
-	assert.Nil(t, result)
-}
 
-func TestLicenseService_Activate_NotFound(t *testing.T) {
-	db := testutil.SetupTestDB()
-	shop := testutil.CreateTestShop(db, "LIC004")
-
-	svc := NewLicenseService(db)
-	result, err := svc.Activate(shop.ID, "NONEX-ISTEN-TTTTT-LICCC", "device-001", "", "")
-
-	assert.Error(t, err)
-	assert.Equal(t, ErrLicenseNotFound, err)
-	assert.Nil(t, result)
-}
-
-func TestLicenseService_Activate_WrongShop(t *testing.T) {
-	db := testutil.SetupTestDB()
-	shop := testutil.CreateTestShop(db, "LIC004B")
-	otherShop := testutil.CreateTestShop(db, "LIC004C")
-
-	lic := &model.License{
-		ShopID: shop.ID, LicenseKey: "OTHSH-BBBBB-CCCCC-DDDDD", IsActive: true, MaxDevices: 3,
-	}
-	require.NoError(t, db.Create(lic).Error)
-
-	svc := NewLicenseService(db)
-	// otherShop cannot activate a license belonging to shop
-	result, err := svc.Activate(otherShop.ID, "OTHSH-BBBBB-CCCCC-DDDDD", "device-001", "", "")
-
-	assert.Error(t, err)
-	assert.Equal(t, ErrLicenseNotFound, err)
-	assert.Nil(t, result)
-}
-
-func TestLicenseService_Activate_Inactive(t *testing.T) {
-	db := testutil.SetupTestDB()
-	shop := testutil.CreateTestShop(db, "LIC005")
-
-	lic := &model.License{
-		ShopID: shop.ID, LicenseKey: "MMMMM-NNNNN-OOOOO-PPPPP", IsActive: true, MaxDevices: 3,
-	}
-	require.NoError(t, db.Create(lic).Error)
-	require.NoError(t, db.Model(lic).Update("is_active", false).Error)
-
-	svc := NewLicenseService(db)
-	result, err := svc.Activate(shop.ID, "MMMMM-NNNNN-OOOOO-PPPPP", "device-001", "", "")
-
-	assert.Error(t, err)
-	assert.Equal(t, ErrLicenseInactive, err)
-	assert.Nil(t, result)
-}
-
-func TestLicenseService_Activate_Expired(t *testing.T) {
-	db := testutil.SetupTestDB()
-	shop := testutil.CreateTestShop(db, "LIC006")
-
-	expiry := time.Now().Add(-24 * time.Hour)
-	lic := &model.License{
-		ShopID: shop.ID, LicenseKey: "QQQQQ-RRRRR-SSSSS-TTTTT", IsActive: true, ExpiresAt: &expiry, MaxDevices: 3,
-	}
-	require.NoError(t, db.Create(lic).Error)
-
-	svc := NewLicenseService(db)
-	result, err := svc.Activate(shop.ID, "QQQQQ-RRRRR-SSSSS-TTTTT", "device-001", "", "")
-
-	assert.Error(t, err)
-	assert.Equal(t, ErrLicenseExpired, err)
-	assert.Nil(t, result)
+	// 码仍未使用（回滚）
+	var lc model.LicenseCode
+	require.NoError(t, db.Where("code = ?", "JIUKUDEVLIMIT").First(&lc).Error)
+	assert.Equal(t, "unused", lc.Status)
+	// 到期不变
+	var after model.License
+	require.NoError(t, db.First(&after, lic.ID).Error)
+	assert.InDelta(t, 10, daysFromNow(after.ExpiresAt), 1)
 }
 
 func TestLicenseService_Verify_Success(t *testing.T) {
@@ -229,17 +259,3 @@ func TestLicenseService_Verify_NoExpiry(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, result)
 }
-
-func TestGenerateKey(t *testing.T) {
-	testutil.InitConfig()
-
-	expiry := time.Now().Add(30 * 24 * time.Hour)
-	key := GenerateKey(1, "annual", &expiry)
-
-	assert.NotEmpty(t, key)
-	// 格式：XXXXX-XXXXX-XXXXX-XXXXX
-	assert.Equal(t, 23, len(key)) // 4*5 + 3 dashes = 23
-	assert.Equal(t, '-', rune(key[5]))
-	assert.Equal(t, '-', rune(key[11]))
-	assert.Equal(t, '-', rune(key[17]))
-}
diff --git a/backend/internal/util/license_key.go b/backend/internal/util/license_key.go
deleted file mode 100644
index ed397f6..0000000
--- a/backend/internal/util/license_key.go
+++ /dev/null
@@ -1,106 +0,0 @@
-package util
-
-import (
-	"crypto/ed25519"
-	"crypto/rand"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-)
-
-var (
-	ErrInvalidLicenseToken     = errors.New("invalid license token")
-	ErrInvalidLicenseSignature = errors.New("invalid license token signature")
-)
-
-// LicensePayload is the verified content extracted from a signed license token.
-type LicensePayload struct {
-	ShopID     uint64         `json:"shop_id"`
-	LicenseID  uint64         `json:"license_id,omitempty"`
-	Type       string         `json:"type"` // trial | monthly | annual | lifetime
-	IssuedAt   int64          `json:"issued_at"`
-	ExpiresAt  *int64         `json:"expires_at,omitempty"` // unix seconds; nil = perpetual
-	MaxDevices int            `json:"max_devices"`
-	Features   map[string]any `json:"features,omitempty"`
-}
-
-// GenerateEd25519KeyPair generates a new Ed25519 keypair.
-// Returns standard base64-encoded private key (64 bytes) and public key (32 bytes).
-// The private key must be stored securely (Bitwarden); the public key goes in config.
-func GenerateEd25519KeyPair() (privKeyB64, pubKeyB64 string, err error) {
-	pub, priv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		return "", "", err
-	}
-	return base64.StdEncoding.EncodeToString(priv),
-		base64.StdEncoding.EncodeToString(pub),
-		nil
-}
-
-// IssueLicenseToken signs a LicensePayload with the Ed25519 private key and returns
-// a compact token: base64url(header).base64url(payload).base64url(signature).
-// privKeyB64 is the standard base64-encoded 64-byte Ed25519 private key.
-func IssueLicenseToken(payload LicensePayload, privKeyB64 string) (string, error) {
-	privKeyBytes, err := base64.StdEncoding.DecodeString(privKeyB64)
-	if err != nil {
-		return "", fmt.Errorf("decode private key: %w", err)
-	}
-	if len(privKeyBytes) != ed25519.PrivateKeySize {
-		return "", fmt.Errorf("private key must be %d bytes, got %d", ed25519.PrivateKeySize, len(privKeyBytes))
-	}
-	privKey := ed25519.PrivateKey(privKeyBytes)
-
-	header := rawB64([]byte(`{"alg":"EdDSA","typ":"LIC"}`))
-	payloadJSON, err := json.Marshal(payload)
-	if err != nil {
-		return "", err
-	}
-	body := rawB64(payloadJSON)
-	signingInput := header + "." + body
-	sig := ed25519.Sign(privKey, []byte(signingInput))
-	return signingInput + "." + rawB64(sig), nil
-}
-
-// VerifyLicenseToken verifies the Ed25519 signature of a license token and returns
-// the decoded payload. Does NOT check expiry — callers must check ExpiresAt themselves.
-// pubKeyB64 is the standard base64-encoded 32-byte Ed25519 public key.
-func VerifyLicenseToken(token, pubKeyB64 string) (*LicensePayload, error) {
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return nil, ErrInvalidLicenseToken
-	}
-
-	pubKeyBytes, err := base64.StdEncoding.DecodeString(pubKeyB64)
-	if err != nil {
-		return nil, fmt.Errorf("decode public key: %w", err)
-	}
-	if len(pubKeyBytes) != ed25519.PublicKeySize {
-		return nil, fmt.Errorf("public key must be %d bytes, got %d", ed25519.PublicKeySize, len(pubKeyBytes))
-	}
-	pubKey := ed25519.PublicKey(pubKeyBytes)
-
-	signingInput := parts[0] + "." + parts[1]
-	sigBytes, err := base64.RawURLEncoding.DecodeString(parts[2])
-	if err != nil {
-		return nil, ErrInvalidLicenseToken
-	}
-	if !ed25519.Verify(pubKey, []byte(signingInput), sigBytes) {
-		return nil, ErrInvalidLicenseSignature
-	}
-
-	payloadJSON, err := base64.RawURLEncoding.DecodeString(parts[1])
-	if err != nil {
-		return nil, ErrInvalidLicenseToken
-	}
-	var p LicensePayload
-	if err := json.Unmarshal(payloadJSON, &p); err != nil {
-		return nil, ErrInvalidLicenseToken
-	}
-	return &p, nil
-}
-
-func rawB64(data []byte) string {
-	return base64.RawURLEncoding.EncodeToString(data)
-}
diff --git a/backend/internal/util/license_key_test.go b/backend/internal/util/license_key_test.go
deleted file mode 100644
index bb4b424..0000000
--- a/backend/internal/util/license_key_test.go
+++ /dev/null
@@ -1,110 +0,0 @@
-package util
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestLicenseKeyRoundTrip(t *testing.T) {
-	priv, pub, err := GenerateEd25519KeyPair()
-	require.NoError(t, err)
-
-	exp := time.Now().Add(30 * 24 * time.Hour).Unix()
-	payload := LicensePayload{
-		ShopID:     42,
-		LicenseID:  7,
-		Type:       "annual",
-		IssuedAt:   time.Now().Unix(),
-		ExpiresAt:  &exp,
-		MaxDevices: 3,
-	}
-
-	token, err := IssueLicenseToken(payload, priv)
-	require.NoError(t, err)
-	assert.NotEmpty(t, token)
-
-	got, err := VerifyLicenseToken(token, pub)
-	require.NoError(t, err)
-	assert.Equal(t, payload.ShopID, got.ShopID)
-	assert.Equal(t, payload.Type, got.Type)
-	assert.Equal(t, payload.MaxDevices, got.MaxDevices)
-	assert.Equal(t, *payload.ExpiresAt, *got.ExpiresAt)
-}
-
-func TestVerifyLicenseToken_TamperedPayload(t *testing.T) {
-	priv, pub, err := GenerateEd25519KeyPair()
-	require.NoError(t, err)
-
-	exp := time.Now().Add(30 * 24 * time.Hour).Unix()
-	token, err := IssueLicenseToken(LicensePayload{
-		ShopID: 1, Type: "trial", IssuedAt: time.Now().Unix(), ExpiresAt: &exp, MaxDevices: 1,
-	}, priv)
-	require.NoError(t, err)
-
-	// Flip the last byte of the signature to simulate tampering
-	tampered := token[:len(token)-2] + "XX"
-	_, err = VerifyLicenseToken(tampered, pub)
-	assert.Error(t, err, "tampered token must be rejected")
-}
-
-func TestVerifyLicenseToken_WrongKey(t *testing.T) {
-	priv, _, err := GenerateEd25519KeyPair()
-	require.NoError(t, err)
-	_, otherPub, err := GenerateEd25519KeyPair()
-	require.NoError(t, err)
-
-	exp := time.Now().Add(30 * 24 * time.Hour).Unix()
-	token, err := IssueLicenseToken(LicensePayload{
-		ShopID: 1, Type: "trial", IssuedAt: time.Now().Unix(), ExpiresAt: &exp, MaxDevices: 1,
-	}, priv)
-	require.NoError(t, err)
-
-	_, err = VerifyLicenseToken(token, otherPub)
-	assert.ErrorIs(t, err, ErrInvalidLicenseSignature)
-}
-
-func TestVerifyLicenseToken_InvalidFormat(t *testing.T) {
-	_, pub, err := GenerateEd25519KeyPair()
-	require.NoError(t, err)
-
-	_, err = VerifyLicenseToken("not-a-valid-token", pub)
-	assert.ErrorIs(t, err, ErrInvalidLicenseToken)
-}
-
-// TestLicenseTokenFitsColumnLimit verifies that a realistic (even worst-case)
-// license token fits within the VARCHAR(768) column limit imposed by the
-// InnoDB index constraint (768 chars × 4 bytes/char = 3072 bytes max).
-func TestLicenseTokenFitsColumnLimit(t *testing.T) {
-	const columnLimit = 768
-
-	priv, _, err := GenerateEd25519KeyPair()
-	require.NoError(t, err)
-
-	// Use a large features map to simulate a worst-case payload.
-	exp := time.Now().Add(365 * 24 * time.Hour).Unix()
-	payload := LicensePayload{
-		ShopID:    999999999,
-		LicenseID: 999999999,
-		Type:      "lifetime",
-		IssuedAt:  time.Now().Unix(),
-		ExpiresAt: &exp,
-		MaxDevices: 99,
-		Features: map[string]any{
-			"finance":    true,
-			"inventory":  true,
-			"reports":    true,
-			"export":     true,
-			"multi_shop": true,
-			"api_access": true,
-		},
-	}
-
-	token, err := IssueLicenseToken(payload, priv)
-	require.NoError(t, err)
-
-	assert.LessOrEqual(t, len(token), columnLimit,
-		"license token length %d exceeds VARCHAR(%d) column limit", len(token), columnLimit)
-}
diff --git a/backend/internal/util/redeem_code.go b/backend/internal/util/redeem_code.go
new file mode 100644
index 0000000..03cf45f
--- /dev/null
+++ b/backend/internal/util/redeem_code.go
@@ -0,0 +1,40 @@
+package util
+
+import (
+	"crypto/rand"
+	"strings"
+)
+
+// codeAlphabet 兑换码字母表：剔除易混字符 0/O/1/I/L，避免人工抄录歧义。
+const codeAlphabet = "23456789ABCDEFGHJKMNPQRSTUVWXYZ"
+
+// codePrefix 兑换码固定前缀，便于一眼识别归属。
+const codePrefix = "JIUKU"
+
+// GenerateRedeemCode 生成一个随机兑换码，展示格式 JIUKU-XXXX-XXXX（8 位随机段）。
+// 使用 crypto/rand + 无歧义字母表；归一化（NormalizeCode）后入库与比对。
+func GenerateRedeemCode() string {
+	const n = 8
+	buf := make([]byte, n)
+	if _, err := rand.Read(buf); err != nil {
+		// crypto/rand 失败属系统级异常，调用方（CLI 生码）应直接失败而非产出弱码。
+		panic("crypto/rand failed: " + err.Error())
+	}
+	out := make([]byte, n)
+	for i, b := range buf {
+		out[i] = codeAlphabet[int(b)%len(codeAlphabet)]
+	}
+	return codePrefix + "-" + string(out[:4]) + "-" + string(out[4:])
+}
+
+// NormalizeCode 归一化兑换码：转大写、去掉连字符/空格，得到入库与查表用的规范形式。
+func NormalizeCode(code string) string {
+	var b strings.Builder
+	for _, r := range strings.ToUpper(code) {
+		if r == '-' || r == ' ' || r == '\t' || r == '\n' || r == '\r' {
+			continue
+		}
+		b.WriteRune(r)
+	}
+	return b.String()
+}
diff --git a/backend/main.go b/backend/main.go
index 99ab650..16329c4 100644
--- a/backend/main.go
+++ b/backend/main.go
@@ -24,9 +24,6 @@ func main() {
 		if config.C.Server.CORSOrigin == "*" {
 			log.Fatal("server.cors_origin must not be '*' in production — set it to the actual frontend origin")
 		}
-		if config.C.License.Ed25519PrivateKey == "" {
-			log.Fatal("license.ed25519_private_key is required in production — store the key in Bitwarden and inject via env LICENSE_ED25519PRIVATEKEY")
-		}
 	}
 
 	// 初始化数据库
@@ -101,6 +98,7 @@ func autoMigrate(db *gorm.DB) {
 		&model.User{},
 		&model.License{},
 		&model.LicenseDevice{},
+		&model.LicenseCode{},
 		&model.UserSession{},
 		&model.LoginAttempt{},
 		&model.ProductCategory{},
diff --git a/backend/schema/schema.sql b/backend/schema/schema.sql
index b68a5e3..cfca168 100644
--- a/backend/schema/schema.sql
+++ b/backend/schema/schema.sql
@@ -107,6 +107,7 @@ CREATE TABLE IF NOT EXISTS `licenses` (
   `license_key`  VARCHAR(768)    NOT NULL COMMENT 'Ed25519 signed token',
   `device_id`    VARCHAR(255)    DEFAULT NULL COMMENT 'deprecated: use license_devices',
   `type`         ENUM('trial','monthly','annual','lifetime') NOT NULL DEFAULT 'trial',
+  `tier`         VARCHAR(32)     NOT NULL DEFAULT 'standard' COMMENT '权益档位钩子(pro/max-like)，当前默认 standard',
   `expires_at`   DATETIME        DEFAULT NULL COMMENT 'NULL=永久',
   `is_active`    TINYINT(1)      NOT NULL DEFAULT 1,
   `max_devices`  INT             NOT NULL DEFAULT 3 COMMENT '最大绑定设备数',
@@ -134,6 +135,28 @@ CREATE TABLE IF NOT EXISTS `license_devices` (
   KEY `idx_license_id` (`license_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='许可证设备绑定';
 
+-- 兑换券（激活码）码池：平台方批量生成，用户兑换后叠加时长到门店授权
+CREATE TABLE IF NOT EXISTS `license_codes` (
+  `id`                 BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+  `code`               VARCHAR(32)     NOT NULL COMMENT '归一化大写无连字符',
+  `type`               ENUM('trial','monthly','annual','lifetime') NOT NULL DEFAULT 'annual' COMMENT '计费/时长标签',
+  `tier`               VARCHAR(32)     NOT NULL DEFAULT 'standard' COMMENT '档位钩子(pro/max-like)，当前默认 standard',
+  `duration_days`      INT             NOT NULL DEFAULT 0 COMMENT '授予时长；0=永久(lifetime)',
+  `max_devices`        INT             NOT NULL DEFAULT 0 COMMENT '授予设备上限；0=不改变现值',
+  `status`             ENUM('unused','redeemed','void') NOT NULL DEFAULT 'unused',
+  `redeemed_shop_id`   BIGINT UNSIGNED DEFAULT NULL COMMENT '被哪个门店兑换',
+  `redeemed_at`        DATETIME        DEFAULT NULL,
+  `redeemed_device_id` VARCHAR(255)    DEFAULT NULL COMMENT '兑换设备(审计)',
+  `batch`              VARCHAR(64)     DEFAULT NULL COMMENT '发放批次/活动名',
+  `note`               VARCHAR(255)    DEFAULT NULL,
+  `created_at`         DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at`         DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `uk_code` (`code`),
+  KEY `idx_status` (`status`),
+  KEY `idx_redeemed_shop` (`redeemed_shop_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='兑换券码池';
+
 -- ------------------------------------------------------------
 -- 商品分类
 -- ------------------------------------------------------------
diff --git a/backend/testutil/setup.go b/backend/testutil/setup.go
index 5350912..0b6a9e8 100644
--- a/backend/testutil/setup.go
+++ b/backend/testutil/setup.go
@@ -27,9 +27,6 @@ func InitConfig() {
 			AccessExpireMin: 60,
 			RefreshExpireH:  168,
 		},
-		License: config.LicenseConfig{
-			HMACSecret: "test-license-hmac-secret",
-		},
 		Session: config.SessionConfig{
 			LimitDesktop: 2,
 			LimitMobile:  2,
@@ -125,12 +122,29 @@ func SetupTestDB() *gorm.DB {
 			license_key TEXT UNIQUE,
 			device_id TEXT,
 			type TEXT DEFAULT 'trial',
+			tier TEXT DEFAULT 'standard',
 			expires_at DATETIME,
 			is_active INTEGER DEFAULT 1,
 			max_devices INTEGER DEFAULT 3,
 			features TEXT,
 			activated_at DATETIME
 		)`,
+		`CREATE TABLE IF NOT EXISTS license_codes (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			code TEXT UNIQUE NOT NULL,
+			type TEXT DEFAULT 'annual',
+			tier TEXT DEFAULT 'standard',
+			duration_days INTEGER NOT NULL DEFAULT 0,
+			max_devices INTEGER NOT NULL DEFAULT 0,
+			status TEXT NOT NULL DEFAULT 'unused',
+			redeemed_shop_id INTEGER,
+			redeemed_at DATETIME,
+			redeemed_device_id TEXT,
+			batch TEXT,
+			note TEXT,
+			created_at DATETIME,
+			updated_at DATETIME
+		)`,
 		`CREATE TABLE IF NOT EXISTS license_devices (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
 			license_id INTEGER NOT NULL,