Update translations for v0.5.5

Regenerated .pot template and recompiled German translations. All 391 strings translated. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Fix critical signature compatibility with client library (v0.5.5)
2026-01-26 17:07:36 +01:00 · 2026-01-26 17:06:18 +01:00 · 2026-01-26 17:02:03 +01:00 · 2026-01-26 17:00:52 +01:00 · 2026-01-26 16:15:51 +01:00 · 2026-01-26 16:14:15 +01:00
25 changed files with 2037 additions and 459 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,81 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [0.5.5] - 2026-01-26
+
+### Fixed
+
+- **CRITICAL:** Response signing key derivation now uses native `hash_hkdf()` for RFC 5869 compliance
+- Key derivation now matches client library (`SecureLicenseClient`) exactly
+- Added missing domain validation to `/activate` endpoint (1-255 characters)
+
+### Changed
+
+- `ResponseSigner::deriveCustomerSecret()` now uses `hash_hkdf('sha256', $serverSecret, 32, $licenseKey)`
+- Previous custom HKDF-like implementation was incompatible with client library
+
+### Security
+
+- Signatures generated by server now verify correctly with `magdev/wc-licensed-product-client`
+- All three API endpoints now have consistent parameter validation
+
+## [0.5.4] - 2026-01-26
+
+### Fixed
+
+- REST API `/validate` endpoint now returns HTTP 404 for `license_not_found` error (was 403)
+- License key validation now enforces minimum 8 characters per API documentation
+
+### Added
+
+- Configurable rate limiting via `WC_LICENSE_RATE_LIMIT` and `WC_LICENSE_RATE_WINDOW` constants
+- Rate limit now defaults to 30 requests per 60 second window (configurable)
+
+### Changed
+
+- Improved HTTP status code mapping: 404 for not found, 500 for server errors, 403 for all other errors
+- Rate limiting implementation now uses configurable constants instead of hardcoded values
+
+## [0.5.3] - 2026-01-26
+
+### Added
+
+- Variable licensed product type (`licensed-variable`) for selling licenses with different durations
+- Support for monthly, yearly, quarterly, or lifetime license variations
+- `LicensedVariableProduct` class extending `WC_Product_Variable`
+- `LicensedProductVariation` class for individual variation license settings
+- Variation-specific license duration settings in product edit page
+- Duration labels displayed in checkout domain fields (e.g., "Yearly License")
+- Variation ID tracking in order domain meta for proper license generation
+
+### Changed
+
+- Updated `LicenseManager::generateLicense()` to accept optional variation ID
+- Checkout now handles variations with separate domain fields per product/variation
+- WooCommerce Blocks checkout updated to display variation duration labels
+- Store API extension updated to include variation_id in domain data schema
+
+## [0.5.2] - 2026-01-26
+
+### Added
+
+- Per-license customer secrets for API response verification
+- "API Verification Secret" section in customer account licenses page (collapsible)
+- Copy button for customer secrets with clipboard support
+- Documentation for per-license secret derivation and usage
+
+### Security
+
+- Customers no longer need the master server secret for signature verification
+- Each license key has a unique derived secret using HKDF-like key derivation
+- If one customer's secret is compromised, other customers remain unaffected
+
+### Changed
+
+- Updated `ResponseSigner` with static methods for secret derivation
+- Updated `server-implementation.md` with per-license secret documentation
+- Added new translation strings for secret-related UI
+
 ## [0.5.1] - 2026-01-26

 ### Fixed
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -32,18 +32,10 @@ This project is proudly **"vibe-coded"** using Claude.AI - the entire codebase w

 **Note for AI Assistants:** Clean this section after the specific features are done or new releases are made. Effective changes are tracked in `CHANGELOG.md`. Do not add completed versions here - document them in the Session History section at the end of this file.

-### Known Bugs
-
-No known bugs at the moment.
-
 ### Version 0.6.0

 *No planned features yet.*

-### Version 0.5.1
-
-*No planned bugfixes yet.*
-
 ## Technical Stack

 - **Language:** PHP 8.3.x
@@ -1268,3 +1260,180 @@ Major feature release enabling customers to purchase multiple licenses for diffe
 - Created release package: `releases/wc-licensed-product-0.5.0.zip` (863 KB)
 - SHA256: `446804948e5f99d705b548061d5b78180856984c58458640a910ada8f27f5316`
 - Tagged as `v0.5.0` and pushed to `main` branch
+
+### 2026-01-26 - Version 0.5.1 - Admin UI Fixes
+
+**Overview:**
+
+Bug fix release improving admin UI usability for version management and license overview.
+
+**Bug Fixes:**
+
+- Fixed: Product versions in admin now sort by version DESC when adding via AJAX
+- Fixed: License actions in admin overview are now always visible (not just on hover)
+
+**Modified files:**
+
+- `assets/css/admin.css` - Added `!important` to `.licenses-table .row-actions` for permanent visibility
+- `assets/js/versions.js` - Added `compareVersions()` function and sorted insertion for AJAX-added versions
+
+**Technical notes:**
+
+- Version sorting uses semantic version comparison (major.minor.patch)
+- New versions are inserted in correct sorted position in the table instead of always appending
+- CSS override uses `!important` to overcome WordPress default hover-only behavior for row actions
+- `compareVersions()` function compares version strings numerically (1.10.0 > 1.9.0)
+
+**Release v0.5.1:**
+
+- Created release package: `releases/wc-licensed-product-0.5.1.zip` (863 KB)
+- SHA256: `a489f0b8cfcd7d5d9b2021b7ff581b9f1a56468dfde87bbb06bb4555d11f7556`
+- Tagged as `v0.5.1` and pushed to `main` branch
+
+### 2026-01-26 - Version 0.5.2 - Per-License Customer Secrets
+
+**Overview:**
+
+Security enhancement release adding per-license customer secrets for API response verification. Each customer now receives a unique secret derived from their license key, eliminating the need to share a global server secret.
+
+**Implemented:**
+
+- Per-license secret derivation using HKDF-like approach
+- Customer account UI showing API verification secret with collapsible section
+- Copy-to-clipboard functionality for customer secrets
+- Static helper methods in ResponseSigner for secret derivation
+
+**New methods in ResponseSigner:**
+
+- `deriveCustomerSecret()` - Static method to derive customer secret from license key and server secret
+- `getCustomerSecretForLicense()` - Static method to get customer secret using configured server secret
+- `isSigningEnabled()` - Static method to check if response signing is configured
+
+**Modified files:**
+
+- `src/Api/ResponseSigner.php` - Added static methods for customer secret derivation
+- `src/Frontend/AccountController.php` - Added `signing_enabled` and `customer_secret` to template data
+- `templates/frontend/licenses.html.twig` - Added collapsible secret section with toggle and copy button
+- `assets/css/frontend.css` - Added styles for `.license-row-secret`, `.secret-toggle`, `.secret-content`
+- `assets/js/frontend.js` - Added `toggleSecret()` and `copySecret()` event handlers
+- `docs/server-implementation.md` - Added documentation for per-license secrets
+
+**Technical notes:**
+
+- Secret derivation uses HKDF-like approach: `HMAC-SHA256(HMAC-SHA256(license_key, server_secret) + "\x01", server_secret)`
+- Each license gets a unique 64-character hex secret
+- Secrets are only shown when `WC_LICENSE_SERVER_SECRET` is configured
+- Collapsible UI prevents accidental secret exposure
+- If server secret is rotated, all customer secrets change automatically
+
+**Security improvement:**
+
+- Customers no longer need access to the master `WC_LICENSE_SERVER_SECRET`
+- If one customer's secret is leaked, other customers are not affected
+- Each license key derives its own unique verification secret
+
+**Release v0.5.2:**
+
+- Created release package: `releases/wc-licensed-product-0.5.2.zip` (845 KB)
+- SHA256: `2d61a78ac5ba0f1d115a6401e6dded5b872b18f5530027c371604cbd18e9e27c`
+- Tagged as `v0.5.2` and pushed to `main` branch
+
+### 2026-01-26 - Version 0.5.3 - Variable Licensed Products
+
+**Overview:**
+
+Major feature release adding support for WooCommerce variable products. Customers can now purchase licenses with different durations (monthly, yearly, lifetime) as product variations.
+
+**New files:**
+
+- `src/Product/LicensedVariableProduct.php` - Variable product class extending `WC_Product_Variable`
+- `src/Product/LicensedProductVariation.php` - Variation class with license settings
+
+**Implemented:**
+
+- New `licensed-variable` product type for selling licenses with different durations
+- `LicensedVariableProduct` class extending WooCommerce variable products
+- `LicensedProductVariation` class for individual variation license settings
+- Variation-specific license duration fields in product edit page (days, max activations)
+- Duration labels (Monthly, Quarterly, Yearly, Lifetime) displayed in checkout
+- Variation ID tracking in order domain meta for proper license generation
+- WooCommerce Blocks checkout updated to handle variations with duration labels
+
+**Modified files:**
+
+- `src/Product/LicensedProductType.php` - Added licensed-variable type registration, variation hooks
+- `src/License/LicenseManager.php` - Added `isLicensedProduct()` helper, variation support in `generateLicense()`
+- `src/Plugin.php` - Updated license generation to handle variations
+- `src/Checkout/CheckoutController.php` - Variation support in domain field rendering
+- `src/Checkout/CheckoutBlocksIntegration.php` - Variation data in blocks checkout
+- `src/Checkout/StoreApiExtension.php` - Variation ID in Store API schema
+- `assets/js/checkout-blocks.js` - Variation handling in React components and DOM fallback
+
+**Technical notes:**
+
+- Variable product type shows in WooCommerce product type selector as "Licensed Variable Product"
+- Each variation can override parent's license duration and max activations
+- Variations are always virtual (licensed products don't ship)
+- `LicensedProductVariation::get_license_duration_label()` returns human-readable duration
+- Order meta `_licensed_product_domains` now includes optional `variation_id` field
+- License generation uses variation settings when `variation_id` is present in order item
+- Backward compatible: existing simple licensed products continue to work unchanged
+
+### 2026-01-26 - Version 0.5.4 - API Compliance
+
+**Overview:**
+
+Bug fix release aligning server implementation with client documentation at `magdev/wc-licensed-product-client`.
+
+**Fixed:**
+
+- `/validate` endpoint now returns HTTP 404 for `license_not_found` error (was returning 403)
+- License key validation now enforces minimum 8 characters across all API endpoints
+
+**Implemented:**
+
+- Configurable rate limiting via `WC_LICENSE_RATE_LIMIT` constant (default: 30 requests)
+- Configurable rate window via `WC_LICENSE_RATE_WINDOW` constant (default: 60 seconds)
+- HTTP status code mapping: 404 for not found, 500 for server errors, 403 for all other errors
+
+**Modified files:**
+
+- `src/Api/RestApiController.php` - Added configurable rate limiting, fixed HTTP status codes, added license_key validation
+
+**Technical notes:**
+
+- Rate limiting now uses `getRateLimit()` and `getRateWindow()` methods instead of constants
+- New `getStatusCodeForResult()` method maps error codes to HTTP status codes
+- License key validation callback added to all three endpoints (validate, status, activate)
+- Uses PHP 8 match expression for status code mapping
+
+### 2026-01-26 - Version 0.5.5 - Critical Signature Fix
+
+**Overview:**
+
+Critical bug fix for response signing. The key derivation algorithm was incompatible with the client library, causing signature verification failures.
+
+**Critical Fix:**
+
+- Key derivation now uses PHP's native `hash_hkdf()` function per RFC 5869
+- Previous custom implementation produced different keys than the client library
+- Signatures now verify correctly with `magdev/wc-licensed-product-client`
+
+**Additional Fix:**
+
+- Added missing domain validation to `/activate` endpoint (1-255 characters)
+
+**Modified files:**
+
+- `src/Api/ResponseSigner.php` - Fixed key derivation to use `hash_hkdf()`
+- `src/Api/RestApiController.php` - Added domain validation to `/activate` endpoint
+
+**Technical notes:**
+
+- Old implementation: `hash_hmac('sha256', $prk . "\x01", $serverSecret)` - custom HKDF-like
+- New implementation: `bin2hex(hash_hkdf('sha256', $serverSecret, 32, $licenseKey))` - RFC 5869
+- Parameters match client's `ResponseSignature::deriveKey()` exactly:
+  - IKM (input keying material): server_secret
+  - Length: 32 bytes (256 bits)
+  - Info: license_key (context-specific info)
+- **Breaking change for existing signatures** - customer secrets will change after upgrade
--- a/assets/css/frontend.css
+++ b/assets/css/frontend.css
@@ -863,3 +863,118 @@
    color: #2271b1;
    font-weight: 500;
 }
+
+/* Customer Secret Section */
+.license-row-secret {
+    margin-top: 0.75em;
+    padding-top: 0.75em;
+    border-top: 1px dashed #e5e5e5;
+}
+
+.secret-toggle {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35em;
+    padding: 0.4em 0.75em;
+    background: transparent;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    font-size: 0.85em;
+    color: #666;
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.secret-toggle:hover {
+    background: #f5f5f5;
+    border-color: #ccc;
+    color: #333;
+}
+
+.secret-toggle .dashicons {
+    font-size: 14px;
+    width: 14px;
+    height: 14px;
+}
+
+.secret-toggle .toggle-arrow {
+    transition: transform 0.2s ease;
+}
+
+.secret-toggle[aria-expanded="true"] .toggle-arrow {
+    transform: rotate(180deg);
+}
+
+.secret-content {
+    margin-top: 0.75em;
+    padding: 1em;
+    background: #f8f9fa;
+    border-radius: 4px;
+    border: 1px solid #e5e5e5;
+}
+
+.secret-description {
+    margin: 0 0 0.75em 0;
+    font-size: 0.85em;
+    color: #666;
+}
+
+.secret-value-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 0.5em;
+}
+
+.secret-value {
+    font-family: 'SF Mono', Monaco, Consolas, monospace;
+    font-size: 0.75em;
+    background: #fff;
+    padding: 0.5em 0.75em;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    word-break: break-all;
+    flex: 1;
+    min-width: 0;
+    overflow-x: auto;
+}
+
+.copy-secret-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 32px;
+    height: 32px;
+    padding: 0;
+    background: #f0f0f0;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    cursor: pointer;
+    transition: all 0.2s ease;
+    flex-shrink: 0;
+}
+
+.copy-secret-btn:hover {
+    background: #e5e5e5;
+    border-color: #ccc;
+}
+
+.copy-secret-btn .dashicons {
+    font-size: 18px;
+    width: 18px;
+    height: 18px;
+}
+
+@media screen and (max-width: 768px) {
+    .secret-value-wrapper {
+        flex-direction: column;
+        align-items: stretch;
+    }
+
+    .secret-value {
+        font-size: 0.7em;
+    }
+
+    .copy-secret-btn {
+        align-self: flex-start;
+    }
+}
--- a/assets/js/checkout-blocks.js
+++ b/assets/js/checkout-blocks.js
@@ -110,6 +110,16 @@
        );
    };

+    /**
+     * Get unique key for product (handles variations)
+     */
+    function getProductKey(product) {
+        if (product.variation_id && product.variation_id > 0) {
+            return `${product.product_id}_${product.variation_id}`;
+        }
+        return String(product.product_id);
+    }
+
    /**
     * Multi-Domain Component
     */
@@ -118,7 +128,8 @@
        const [domains, setDomains] = useState(() => {
            const init = {};
            products.forEach(p => {
-                init[p.product_id] = Array(p.quantity).fill('');
+                const key = getProductKey(p);
+                init[key] = Array(p.quantity).fill('');
            });
            return init;
        });
@@ -128,16 +139,16 @@
            return null;
        }

-        const handleChange = (productId, index, value) => {
+        const handleChange = (productKey, index, value) => {
            const normalized = normalizeDomain(value);
            const newDomains = { ...domains };
-            if (!newDomains[productId]) newDomains[productId] = [];
-            newDomains[productId] = [...newDomains[productId]];
-            newDomains[productId][index] = normalized;
+            if (!newDomains[productKey]) newDomains[productKey] = [];
+            newDomains[productKey] = [...newDomains[productKey]];
+            newDomains[productKey][index] = normalized;
            setDomains(newDomains);

            // Validate
-            const key = `${productId}_${index}`;
+            const key = `${productKey}_${index}`;
            const newErrors = { ...errors };
            if (normalized && !isValidDomain(normalized)) {
                newErrors[key] = settings.validationError || __('Please enter a valid domain.', 'wc-licensed-product');
@@ -145,14 +156,14 @@
                delete newErrors[key];
            }

-            // Check for duplicates within same product
-            const productDomains = newDomains[productId].filter(d => d);
+            // Check for duplicates within same product/variation
+            const productDomains = newDomains[productKey].filter(d => d);
            const uniqueDomains = new Set(productDomains.map(d => normalizeDomain(d)));
            if (productDomains.length !== uniqueDomains.size) {
                const seen = new Set();
-                newDomains[productId].forEach((d, idx) => {
+                newDomains[productKey].forEach((d, idx) => {
                    const normalizedD = normalizeDomain(d);
-                    const dupKey = `${productId}_${idx}`;
+                    const dupKey = `${productKey}_${idx}`;
                    if (normalizedD && seen.has(normalizedD)) {
                        newErrors[dupKey] = settings.duplicateError || __('Each license requires a unique domain.', 'wc-licensed-product');
                    } else if (normalizedD) {
@@ -163,11 +174,19 @@

            setErrors(newErrors);

-            // Update hidden field
-            const data = Object.entries(newDomains).map(([pid, doms]) => ({
-                product_id: parseInt(pid, 10),
-                domains: doms.filter(d => d),
-            })).filter(item => item.domains.length > 0);
+            // Update hidden field with variation support
+            const data = products.map(p => {
+                const pKey = getProductKey(p);
+                const doms = newDomains[pKey] || [];
+                const entry = {
+                    product_id: p.product_id,
+                    domains: doms.filter(d => d),
+                };
+                if (p.variation_id && p.variation_id > 0) {
+                    entry.variation_id = p.variation_id;
+                }
+                return entry;
+            }).filter(item => item.domains.length > 0);

            const hiddenInput = document.getElementById('wclp-domains-hidden');
            if (hiddenInput) {
@@ -192,35 +211,43 @@
            createElement('p', { style: { marginBottom: '12px', color: '#666', fontSize: '0.9em' } },
                settings.fieldDescription || __('Enter a unique domain for each license.', 'wc-licensed-product')
            ),
-            products.map(product => createElement(
-                'div',
-                {
-                    key: product.product_id,
-                    style: {
-                        marginBottom: '16px',
-                        padding: '12px',
-                        backgroundColor: '#fff',
-                        borderRadius: '4px',
-                    }
-                },
-                createElement('strong', { style: { display: 'block', marginBottom: '8px' } },
-                    product.name + (product.quantity > 1 ? ` (×${product.quantity})` : '')
-                ),
-                Array.from({ length: product.quantity }, (_, i) => {
-                    const key = `${product.product_id}_${i}`;
-                    return createElement(
-                        'div',
-                        { key: i, style: { marginBottom: '8px' } },
-                        createElement(TextControl, {
-                            label: (settings.licenseLabel || __('License %d:', 'wc-licensed-product')).replace('%d', i + 1),
-                            value: domains[product.product_id]?.[i] || '',
-                            onChange: (val) => handleChange(product.product_id, i, val),
-                            placeholder: settings.fieldPlaceholder || 'example.com',
-                            help: errors[key] || '',
-                        })
-                    );
-                })
-            )),
+            products.map(product => {
+                const productKey = getProductKey(product);
+                const durationLabel = product.duration_label || '';
+                const displayName = durationLabel
+                    ? `${product.name} (${durationLabel})`
+                    : product.name;
+
+                return createElement(
+                    'div',
+                    {
+                        key: productKey,
+                        style: {
+                            marginBottom: '16px',
+                            padding: '12px',
+                            backgroundColor: '#fff',
+                            borderRadius: '4px',
+                        }
+                    },
+                    createElement('strong', { style: { display: 'block', marginBottom: '8px' } },
+                        displayName + (product.quantity > 1 ? ` ×${product.quantity}` : '')
+                    ),
+                    Array.from({ length: product.quantity }, (_, i) => {
+                        const key = `${productKey}_${i}`;
+                        return createElement(
+                            'div',
+                            { key: i, style: { marginBottom: '8px' } },
+                            createElement(TextControl, {
+                                label: (settings.licenseLabel || __('License %d:', 'wc-licensed-product')).replace('%d', i + 1),
+                                value: domains[productKey]?.[i] || '',
+                                onChange: (val) => handleChange(productKey, i, val),
+                                placeholder: settings.fieldPlaceholder || 'example.com',
+                                help: errors[key] || '',
+                            })
+                        );
+                    })
+                );
+            }),
            createElement('input', {
                type: 'hidden',
                id: 'wclp-domains-hidden',
@@ -291,10 +318,19 @@
                <p style="margin-bottom: 12px; color: #666; font-size: 0.9em;">
                    ${settings.fieldDescription || 'Enter a unique domain for each license.'}
                </p>
-                ${settings.licensedProducts.map(product => `
+                ${settings.licensedProducts.map(product => {
+                    const productKey = product.variation_id && product.variation_id > 0
+                        ? `${product.product_id}_${product.variation_id}`
+                        : product.product_id;
+                    const durationLabel = product.duration_label || '';
+                    const displayName = durationLabel
+                        ? `${product.name} (${durationLabel})`
+                        : product.name;
+
+                    return `
                    <div style="margin-bottom: 16px; padding: 12px; background: #fff; border-radius: 4px;">
                        <strong style="display: block; margin-bottom: 8px;">
-                            ${product.name}${product.quantity > 1 ? ` (×${product.quantity})` : ''}
+                            ${displayName}${product.quantity > 1 ? ` ×${product.quantity}` : ''}
                        </strong>
                        ${Array.from({ length: product.quantity }, (_, i) => `
                            <div style="margin-bottom: 8px;">
@@ -302,14 +338,20 @@
                                    ${(settings.licenseLabel || 'License %d:').replace('%d', i + 1)}
                                </label>
                                <input type="text"
-                                    name="licensed_domains[${product.product_id}][${i}]"
+                                    name="licensed_domains[${productKey}][${i}]"
                                    placeholder="${settings.fieldPlaceholder || 'example.com'}"
                                    style="width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;"
                                />
+                                ${product.variation_id && product.variation_id > 0 ? `
+                                    <input type="hidden"
+                                        name="licensed_variation_ids[${productKey}]"
+                                        value="${product.variation_id}"
+                                    />
+                                ` : ''}
                            </div>
                        `).join('')}
                    </div>
-                `).join('')}
+                `}).join('')}
            `;
        } else {
            container.innerHTML = `
--- a/assets/js/frontend.js
+++ b/assets/js/frontend.js
@@ -19,6 +19,7 @@

        bindEvents: function() {
            $(document).on('click', '.copy-license-btn', this.copyLicenseKey);
+            $(document).on('click', '.copy-secret-btn', this.copySecret);

            // Transfer modal events
            $(document).on('click', '.wclp-transfer-btn', this.openTransferModal.bind(this));
@@ -28,6 +29,9 @@
            // Older versions toggle
            $(document).on('click', '.older-versions-toggle', this.toggleOlderVersions);

+            // Secret toggle
+            $(document).on('click', '.secret-toggle', this.toggleSecret);
+
            // Close modal on escape key
            $(document).on('keyup', function(e) {
                if (e.key === 'Escape') {
@@ -50,6 +54,47 @@
            $list.slideToggle(200);
        },

+        /**
+         * Toggle secret visibility
+         */
+        toggleSecret: function(e) {
+            e.preventDefault();
+
+            var $btn = $(this);
+            var $content = $btn.siblings('.secret-content');
+            var isExpanded = $btn.attr('aria-expanded') === 'true';
+
+            $btn.attr('aria-expanded', !isExpanded);
+            $content.slideToggle(200);
+        },
+
+        /**
+         * Copy secret to clipboard
+         */
+        copySecret: function(e) {
+            e.preventDefault();
+
+            var $btn = $(this);
+            var secret = $btn.data('secret');
+
+            if (!secret) {
+                return;
+            }
+
+            // Use modern clipboard API if available
+            if (navigator.clipboard && navigator.clipboard.writeText) {
+                navigator.clipboard.writeText(secret)
+                    .then(function() {
+                        WCLicensedProductFrontend.showCopyFeedback($btn, true);
+                    })
+                    .catch(function() {
+                        WCLicensedProductFrontend.fallbackCopy(secret, $btn);
+                    });
+            } else {
+                WCLicensedProductFrontend.fallbackCopy(secret, $btn);
+            }
+        },
+
        /**
         * Copy license key to clipboard
         */
--- a/composer.lock
+++ b/composer.lock
@@ -12,7 +12,7 @@
            "source": {
                "type": "git",
                "url": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client.git",
-                "reference": "64d215cb265a64ff318cfbb954dd128b0076dc1d"
+                "reference": "5e4b5a970f75d0163c5496581d963a24ade4f276"
            },
            "require": {
                "php": "^8.3",
@@ -52,7 +52,7 @@
                "issues": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client/issues",
                "source": "https://src.bundespruefstelle.ch/magdev/wc-licensed-product-client"
            },
-            "time": "2026-01-24T13:32:11+00:00"
+            "time": "2026-01-26T15:54:37+00:00"
        },
        {
            "name": "psr/cache",
@@ -380,16 +380,16 @@
        },
        {
            "name": "symfony/http-client",
-            "version": "v7.4.3",
+            "version": "v7.4.4",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/http-client.git",
-                "reference": "d01dfac1e0dc99f18da48b18101c23ce57929616"
+                "reference": "d63c23357d74715a589454c141c843f0172bec6c"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-client/zipball/d01dfac1e0dc99f18da48b18101c23ce57929616",
-                "reference": "d01dfac1e0dc99f18da48b18101c23ce57929616",
+                "url": "https://api.github.com/repos/symfony/http-client/zipball/d63c23357d74715a589454c141c843f0172bec6c",
+                "reference": "d63c23357d74715a589454c141c843f0172bec6c",
                "shasum": ""
            },
            "require": {
@@ -457,7 +457,7 @@
                "http"
            ],
            "support": {
-                "source": "https://github.com/symfony/http-client/tree/v7.4.3"
+                "source": "https://github.com/symfony/http-client/tree/v7.4.4"
            },
            "funding": [
                {
@@ -477,7 +477,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2025-12-23T14:50:43+00:00"
+            "time": "2026-01-23T16:34:22+00:00"
        },
        {
            "name": "symfony/http-client-contracts",
--- a/docs/server-implementation.md
+++ b/docs/server-implementation.md
@@ -8,14 +8,16 @@ The security model works as follows:

 1. Server generates a unique signature for each response using HMAC-SHA256
 2. Signature includes a timestamp to prevent replay attacks
-3. Client verifies the signature using a shared secret
-4. Invalid signatures cause the client to reject the response
+3. Each license key has a unique derived secret (not the master secret)
+4. Client verifies the signature using their per-license secret
+5. Invalid signatures cause the client to reject the response

 This prevents attackers from:

 - Faking valid license responses
 - Replaying old responses
 - Tampering with response data
+- Using one customer's secret to verify another customer's responses

 ## Requirements

@@ -323,13 +325,49 @@ Adjust if needed:
 $signature = new ResponseSignature($key, timestampTolerance: 600); // 10 minutes
 ```

+### Per-License Secrets
+
+Each customer receives a unique secret derived from their license key. This means:
+
+- Customers only know their own secret, not the master server secret
+- If one customer's secret is leaked, other customers are not affected
+- The server uses HKDF-like derivation to create unique secrets
+
+#### How Customers Get Their Secret
+
+Customers can find their per-license verification secret in their account:
+
+1. Log in to the store
+2. Go to My Account > Licenses
+3. Click "API Verification Secret" under any license
+4. Copy the 64-character hex string
+
+This secret is automatically derived from the customer's license key and the server's master secret.
+
+#### Using the Customer Secret
+
+```php
+use Magdev\WcLicensedProductClient\SecureLicenseClient;
+use Symfony\Component\HttpClient\HttpClient;
+
+// Customer uses their per-license secret (from account page)
+$client = new SecureLicenseClient(
+    httpClient: HttpClient::create(),
+    baseUrl: 'https://shop.example.com',
+    serverSecret: 'customer-secret-from-account-page', // 64 hex chars
+);
+
+$info = $client->validate('XXXX-XXXX-XXXX-XXXX', 'example.com');
+```
+
 ### Secret Key Rotation

 To rotate the server secret:

 1. Deploy new secret to server
-2. Update client configurations
-3. Old signatures become invalid immediately
+2. All per-license secrets change automatically (they're derived)
+3. Customers must copy their new secret from their account page
+4. Old signatures become invalid immediately

 For zero-downtime rotation, implement versioned secrets:

--- a/languages/wc-licensed-product-de_CH.mo
+++ b/languages/wc-licensed-product-de_CH.mo
--- a/languages/wc-licensed-product-de_CH.po
+++ b/languages/wc-licensed-product-de_CH.po
@@ -5,7 +5,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: WC Licensed Product 0.5.0\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-25 18:32+0100\n"
+"POT-Creation-Date: 2026-01-26 17:06+0100\n"
 "PO-Revision-Date: 2026-01-25T18:30:00+00:00\n"
 "Last-Translator: Marco Graetsch <magdev3.0@gmail.com>\n"
 "Language-Team: German (Switzerland) <de_CH@li.org>\n"
@@ -248,7 +248,7 @@ msgstr "Version erfolgreich aktualisiert."
 #: src/Admin/AdminController.php:90 src/Admin/AdminController.php:1200
 #: src/Admin/OrderLicenseController.php:149
 #: src/Admin/OrderLicenseController.php:281
-#: src/Frontend/AccountController.php:90
+#: src/Frontend/AccountController.php:91
 msgid "Licenses"
 msgstr "Lizenzen"

@@ -295,7 +295,7 @@ msgstr "Bearbeiten"
 #: src/Admin/AdminController.php:149 src/Admin/AdminController.php:1341
 #: src/Admin/AdminController.php:1361 src/Admin/AdminController.php:1382
 #: src/Admin/AdminController.php:1537 src/Admin/OrderLicenseController.php:244
-#: src/Frontend/AccountController.php:384
+#: src/Frontend/AccountController.php:387
 msgid "Cancel"
 msgstr "Abbrechen"

@@ -310,17 +310,19 @@ msgstr "Speichern"
 #: src/Admin/AdminController.php:1373 src/Admin/AdminController.php:1613
 #: src/Admin/DashboardWidgetController.php:136
 #: src/Admin/OrderLicenseController.php:260
-#: src/Admin/SettingsController.php:192 src/Product/LicensedProductType.php:110
-#: src/Product/LicensedProductType.php:158
-#: src/Frontend/AccountController.php:283
+#: src/Admin/SettingsController.php:192 src/Product/LicensedProductType.php:136
+#: src/Product/LicensedProductType.php:184
+#: src/Product/LicensedProductType.php:379
+#: src/Product/LicensedProductVariation.php:139
+#: src/Frontend/AccountController.php:286
 msgid "Lifetime"
 msgstr "Lebenslang"

-#: src/Admin/AdminController.php:152 src/Frontend/AccountController.php:422
+#: src/Admin/AdminController.php:152 src/Frontend/AccountController.php:425
 msgid "Copied!"
 msgstr "Kopiert!"

-#: src/Admin/AdminController.php:153 src/Frontend/AccountController.php:423
+#: src/Admin/AdminController.php:153 src/Frontend/AccountController.php:426
 msgid "Copy failed"
 msgstr "Kopieren fehlgeschlagen"

@@ -408,7 +410,7 @@ msgstr "Lizenzschlüssel und Domain sind erforderlich."
 #: src/Admin/AdminController.php:531 src/Admin/AdminController.php:549
 #: src/Admin/AdminController.php:577 src/Admin/AdminController.php:621
 #: src/Admin/AdminController.php:811 src/Admin/SettingsController.php:469
-#: src/Frontend/AccountController.php:439
+#: src/Frontend/AccountController.php:442
 msgid "Security check failed."
 msgstr "Sicherheitsüberprüfung fehlgeschlagen."

@@ -677,8 +679,8 @@ msgstr "Kunde"

 #: src/Admin/AdminController.php:1294 src/Admin/AdminController.php:1445
 #: src/Admin/AdminController.php:1495 src/Admin/OrderLicenseController.php:205
-#: src/Checkout/CheckoutBlocksIntegration.php:129
-#: src/Checkout/CheckoutController.php:122
+#: src/Checkout/CheckoutBlocksIntegration.php:130
+#: src/Checkout/CheckoutController.php:161
 #: src/Email/LicenseEmailController.php:288
 msgid "Domain"
 msgstr "Domain"
@@ -698,7 +700,7 @@ msgstr "Läuft ab"
 msgid "No licenses found."
 msgstr "Keine Lizenzen gefunden."

-#: src/Admin/AdminController.php:1314 src/Frontend/AccountController.php:260
+#: src/Admin/AdminController.php:1314 src/Frontend/AccountController.php:263
 msgid "Copy to clipboard"
 msgstr "In Zwischenablage kopieren"

@@ -718,7 +720,7 @@ msgstr "Lizenz gegen API testen"
 msgid "Test"
 msgstr "Testen"

-#: src/Admin/AdminController.php:1400 src/Frontend/AccountController.php:267
+#: src/Admin/AdminController.php:1400 src/Frontend/AccountController.php:270
 msgid "Transfer to new domain"
 msgstr "Auf neue Domain übertragen"

@@ -746,27 +748,27 @@ msgstr "Lizenzvalidierungstest"
 msgid "Testing license..."
 msgstr "Lizenz wird geprüft..."

-#: src/Admin/AdminController.php:1508 src/Frontend/AccountController.php:362
+#: src/Admin/AdminController.php:1508 src/Frontend/AccountController.php:365
 msgid "Close"
 msgstr "Schliessen"

-#: src/Admin/AdminController.php:1517 src/Frontend/AccountController.php:363
+#: src/Admin/AdminController.php:1517 src/Frontend/AccountController.php:366
 msgid "Transfer License to New Domain"
 msgstr "Lizenz auf neue Domain übertragen"

-#: src/Admin/AdminController.php:1524 src/Frontend/AccountController.php:368
+#: src/Admin/AdminController.php:1524 src/Frontend/AccountController.php:371
 msgid "Current Domain"
 msgstr "Aktuelle Domain"

-#: src/Admin/AdminController.php:1528 src/Frontend/AccountController.php:373
+#: src/Admin/AdminController.php:1528 src/Frontend/AccountController.php:376
 msgid "New Domain"
 msgstr "Neue Domain"

-#: src/Admin/AdminController.php:1531 src/Frontend/AccountController.php:377
+#: src/Admin/AdminController.php:1531 src/Frontend/AccountController.php:380
 msgid "Enter the new domain without http:// or www."
 msgstr "Geben Sie die neue Domain ohne http:// oder www ein."

-#: src/Admin/AdminController.php:1536 src/Frontend/AccountController.php:382
+#: src/Admin/AdminController.php:1536 src/Frontend/AccountController.php:385
 msgid "Transfer License"
 msgstr "Lizenz übertragen"

@@ -954,11 +956,11 @@ msgid "Domains specified during checkout (multi-domain order)."
 msgstr "Bei der Bestellung angegebene Domains (Multi-Domain-Bestellung)."

 #: src/Admin/OrderLicenseController.php:119
-#: src/Checkout/CheckoutController.php:436
-#: src/Checkout/CheckoutController.php:486
-#: src/Checkout/CheckoutController.php:496 src/License/LicenseManager.php:806
+#: src/Checkout/CheckoutController.php:530
+#: src/Checkout/CheckoutController.php:591
+#: src/Checkout/CheckoutController.php:613 src/License/LicenseManager.php:878
 #: src/Product/VersionManager.php:349 src/Product/VersionManager.php:361
-#: src/Frontend/AccountController.php:146
+#: src/Frontend/AccountController.php:148
 #: src/Email/LicenseExpirationEmail.php:107
 #: src/Email/LicenseExpiredEmail.php:99
 msgid "Unknown Product"
@@ -973,10 +975,10 @@ msgstr ""
 "automatisch bestehende Lizenz-Domains."

 #: src/Admin/OrderLicenseController.php:137
-#: src/Checkout/CheckoutBlocksIntegration.php:83
-#: src/Checkout/CheckoutBlocksIntegration.php:119
-#: src/Checkout/CheckoutController.php:130
-#: src/Checkout/CheckoutController.php:186
+#: src/Checkout/CheckoutBlocksIntegration.php:84
+#: src/Checkout/CheckoutBlocksIntegration.php:120
+#: src/Checkout/CheckoutController.php:169
+#: src/Checkout/CheckoutController.php:235
 msgid "example.com"
 msgstr "beispiel.ch"

@@ -1044,9 +1046,9 @@ msgid "Error. Please try again."
 msgstr "Fehler. Bitte versuchen Sie es erneut."

 #: src/Admin/OrderLicenseController.php:373
-#: src/Checkout/CheckoutBlocksIntegration.php:126
-#: src/Frontend/AccountController.php:427
-#: src/Frontend/AccountController.php:459
+#: src/Checkout/CheckoutBlocksIntegration.php:127
+#: src/Frontend/AccountController.php:430
+#: src/Frontend/AccountController.php:462
 msgid "Please enter a valid domain."
 msgstr "Bitte geben Sie eine gültige Domain ein."

@@ -1070,7 +1072,7 @@ msgstr "Bestellungs-Domain aktualisiert."

 #: src/Admin/OrderLicenseController.php:449
 #: src/Frontend/DownloadController.php:117
-#: src/Frontend/AccountController.php:465
+#: src/Frontend/AccountController.php:468
 msgid "License not found."
 msgstr "Lizenz nicht gefunden."

@@ -1280,98 +1282,98 @@ msgstr "Lizenz erfolgreich überprüft!"
 msgid "License validation failed."
 msgstr "Lizenzvalidierung fehlgeschlagen."

-#: src/Api/RestApiController.php:84
+#: src/Api/RestApiController.php:106
 msgid "Too many requests. Please try again later."
 msgstr "Zu viele Anfragen. Bitte versuchen Sie es später erneut."

-#: src/Api/RestApiController.php:345 src/Api/RestApiController.php:378
-#: src/License/LicenseManager.php:403
+#: src/Api/RestApiController.php:400 src/Api/RestApiController.php:433
+#: src/License/LicenseManager.php:475
 msgid "License key not found."
 msgstr "Lizenzschlüssel nicht gefunden."

-#: src/Api/RestApiController.php:386
+#: src/Api/RestApiController.php:441
 msgid "This license is not valid."
 msgstr "Diese Lizenz ist ungültig."

-#: src/Api/RestApiController.php:396
+#: src/Api/RestApiController.php:451
 msgid "License is already activated for this domain."
 msgstr "Die Lizenz ist bereits für diese Domain aktiviert."

-#: src/Api/RestApiController.php:405
+#: src/Api/RestApiController.php:460
 msgid "Maximum number of activations reached."
 msgstr "Maximale Anzahl der Aktivierungen erreicht."

-#: src/Api/RestApiController.php:416
+#: src/Api/RestApiController.php:471
 msgid "Failed to activate license."
 msgstr "Lizenz konnte nicht aktiviert werden."

-#: src/Api/RestApiController.php:422
+#: src/Api/RestApiController.php:477
 msgid "License activated successfully."
 msgstr "Lizenz erfolgreich aktiviert."

-#: src/Checkout/CheckoutBlocksIntegration.php:78
-#: src/Checkout/CheckoutBlocksIntegration.php:125
-#: src/Checkout/CheckoutController.php:119
+#: src/Checkout/CheckoutBlocksIntegration.php:79
+#: src/Checkout/CheckoutBlocksIntegration.php:126
+#: src/Checkout/CheckoutController.php:158
 msgid "License Domain"
 msgstr "Lizenz-Domain"

-#: src/Checkout/CheckoutBlocksIntegration.php:85
+#: src/Checkout/CheckoutBlocksIntegration.php:86
 msgid "Enter a valid domain (without http:// or www)"
 msgstr "Geben Sie eine gültige Domain ein (ohne http:// oder www)"

-#: src/Checkout/CheckoutBlocksIntegration.php:121
-#: src/Checkout/CheckoutController.php:150
+#: src/Checkout/CheckoutBlocksIntegration.php:122
+#: src/Checkout/CheckoutController.php:189
 msgid "Enter a unique domain for each license (without http:// or www)."
 msgstr ""
 "Geben Sie für jede Lizenz eine eindeutige Domain ein (ohne http:// oder www)."

-#: src/Checkout/CheckoutBlocksIntegration.php:122
-#: src/Checkout/CheckoutController.php:134
+#: src/Checkout/CheckoutBlocksIntegration.php:123
+#: src/Checkout/CheckoutController.php:173
 msgid ""
 "Enter the domain where you will use the license (without http:// or www)."
 msgstr ""
 "Geben Sie die Domain ein, auf der Sie die Lizenz verwenden möchten (ohne "
 "http:// oder www)."

-#: src/Checkout/CheckoutBlocksIntegration.php:124
-#: src/Checkout/CheckoutController.php:148
+#: src/Checkout/CheckoutBlocksIntegration.php:125
+#: src/Checkout/CheckoutController.php:187
 msgid "License Domains"
 msgstr "Lizenz-Domains"

-#: src/Checkout/CheckoutBlocksIntegration.php:127
+#: src/Checkout/CheckoutBlocksIntegration.php:128
 msgid "Each license requires a unique domain."
 msgstr "Jede Lizenz erfordert eine eindeutige Domain."

-#: src/Checkout/CheckoutBlocksIntegration.php:128
-#: src/Checkout/CheckoutController.php:175
+#: src/Checkout/CheckoutBlocksIntegration.php:129
+#: src/Checkout/CheckoutController.php:224
 #, php-format
 msgid "License %d:"
 msgstr "Lizenz %d:"

-#: src/Checkout/CheckoutController.php:123
-#: src/Checkout/CheckoutController.php:179
+#: src/Checkout/CheckoutController.php:162
+#: src/Checkout/CheckoutController.php:228
 msgid "required"
 msgstr "erforderlich"

-#: src/Checkout/CheckoutController.php:258
+#: src/Checkout/CheckoutController.php:323
 msgid "Please enter a domain for your license."
 msgstr "Bitte geben Sie eine Domain für Ihre Lizenz ein."

-#: src/Checkout/CheckoutController.php:264
+#: src/Checkout/CheckoutController.php:329
 msgid "Please enter a valid domain for your license."
 msgstr "Bitte geben Sie eine gültige Domain für Ihre Lizenz ein."

-#: src/Checkout/CheckoutController.php:287
+#: src/Checkout/CheckoutController.php:356
 #, php-format
 msgid "Please enter a domain for %1$s (License %2$d)."
 msgstr "Bitte geben Sie eine Domain für %1$s (Lizenz %2$d) ein."

-#: src/Checkout/CheckoutController.php:302
+#: src/Checkout/CheckoutController.php:371
 #, php-format
 msgid "Please enter a valid domain for %1$s (License %2$d)."
 msgstr "Bitte geben Sie eine gültige Domain für %1$s (Lizenz %2$d) ein."

-#: src/Checkout/CheckoutController.php:316
+#: src/Checkout/CheckoutController.php:385
 #, php-format
 msgid ""
 "The domain \"%1$s\" is used multiple times for %2$s. Each license requires a "
@@ -1380,23 +1382,29 @@ msgstr ""
 "Die Domain \"%1$s\" wird mehrfach für %2$s verwendet. Jede Lizenz erfordert "
 "eine eindeutige Domain."

-#: src/Checkout/CheckoutController.php:419
-#: src/Checkout/CheckoutController.php:466
-#: src/Checkout/CheckoutController.php:470
+#: src/Checkout/CheckoutController.php:500
+#: src/Checkout/CheckoutController.php:561
+#: src/Checkout/CheckoutController.php:565
 msgid "License Domain:"
 msgstr "Lizenz-Domain:"

-#: src/Checkout/CheckoutController.php:432
-#: src/Checkout/CheckoutController.php:483
-#: src/Checkout/CheckoutController.php:492
+#: src/Checkout/CheckoutController.php:513
+#: src/Checkout/CheckoutController.php:578
+#: src/Checkout/CheckoutController.php:599
 msgid "License Domains:"
 msgstr "Lizenz-Domains:"

+#: src/Checkout/CheckoutController.php:522
+#: src/Checkout/CheckoutController.php:585
+#: src/Checkout/CheckoutController.php:607
+msgid "Unknown Variation"
+msgstr "Unbekannte Variante"
+
 #: src/Checkout/StoreApiExtension.php:93
 msgid "Domains for license activation by product"
 msgstr "Domains für Lizenz-Aktivierung nach Produkt"

-#: src/Checkout/StoreApiExtension.php:117
+#: src/Checkout/StoreApiExtension.php:120
 msgid "Domain for license activation"
 msgstr "Domain für Lizenz-Aktivierung"

@@ -1408,87 +1416,22 @@ msgstr "Lizenzeinstellungen nicht konfiguriert."
 msgid "Could not connect to license server."
 msgstr "Verbindung zum Lizenzserver konnte nicht hergestellt werden."

-#: src/License/LicenseManager.php:412
+#: src/License/LicenseManager.php:484
 msgid "This license has been revoked."
 msgstr "Diese Lizenz wurde widerrufen."

-#: src/License/LicenseManager.php:422
+#: src/License/LicenseManager.php:494
 msgid "This license has expired."
 msgstr "Diese Lizenz ist abgelaufen."

-#: src/License/LicenseManager.php:430
+#: src/License/LicenseManager.php:502
 msgid "This license is inactive."
 msgstr "Diese Lizenz ist inaktiv."

-#: src/License/LicenseManager.php:440
+#: src/License/LicenseManager.php:512
 msgid "This license is not valid for this domain."
 msgstr "Diese Lizenz ist für diese Domain nicht gültig."

-#: src/Product/LicensedProductType.php:61
-msgid "Licensed Product"
-msgstr "Lizensiertes Produkt"
-
-#: src/Product/LicensedProductType.php:82
-msgid "License Settings"
-msgstr "Lizenz-Einstellungen"
-
-#: src/Product/LicensedProductType.php:109
-#, php-format
-msgid "%d days"
-msgstr "%d Tage"
-
-#: src/Product/LicensedProductType.php:119
-#, php-format
-msgid "Leave fields empty to use default settings from %s."
-msgstr "Felder leer lassen, um Standardeinstellungen von %s zu verwenden."
-
-#: src/Product/LicensedProductType.php:121
-msgid "WooCommerce > Settings > Licensed Products"
-msgstr "WooCommerce > Einstellungen > Lizensierte Produkte"
-
-#: src/Product/LicensedProductType.php:128
-msgid "Max Activations"
-msgstr "Max. Aktivierungen"
-
-#: src/Product/LicensedProductType.php:131
-#, php-format
-msgid "Maximum number of domain activations per license. Default: %d"
-msgstr "Maximale Anzahl der Domain-Aktivierungen pro Lizenz. Standard: %d"
-
-#: src/Product/LicensedProductType.php:146
-msgid "License Validity (Days)"
-msgstr "Lizenz-Gültigkeit (Tage)"
-
-#: src/Product/LicensedProductType.php:149
-#, php-format
-msgid "Number of days the license is valid. Leave empty for default (%s)."
-msgstr "Anzahl Tage, die die Lizenz gültig ist. Leer lassen für Standard (%s)."
-
-#: src/Product/LicensedProductType.php:164
-msgid "Bind to Major Version"
-msgstr "An Hauptversion binden"
-
-#: src/Product/LicensedProductType.php:167
-#, php-format
-msgid ""
-"If enabled, licenses are bound to the major version at purchase time. "
-"Default: %s"
-msgstr ""
-"Falls aktiviert, werden Lizenzen an die Hauptversion zum Kaufzeitpunkt "
-"gebunden. Standard: %s"
-
-#: src/Product/LicensedProductType.php:168
-msgid "Yes"
-msgstr "Ja"
-
-#: src/Product/LicensedProductType.php:168
-msgid "No"
-msgstr "Nein"
-
-#: src/Product/LicensedProductType.php:288
-msgid "Version:"
-msgstr "Version:"
-
 #: src/Product/VersionManager.php:166
 msgid "Attachment file not found."
 msgstr "Anhangs-Datei nicht gefunden."
@@ -1498,6 +1441,116 @@ msgstr "Anhangs-Datei nicht gefunden."
 msgid "File checksum does not match. Expected: %1$s, Got: %2$s"
 msgstr "Datei-Prüfsumme stimmt nicht überein. Erwartet: %1$s, Erhalten: %2$s"

+#: src/Product/LicensedProductType.php:72
+msgid "Licensed Product"
+msgstr "Lizensiertes Produkt"
+
+#: src/Product/LicensedProductType.php:73
+msgid "Licensed Variable Product"
+msgstr "Lizensiertes variables Produkt"
+
+#: src/Product/LicensedProductType.php:108
+msgid "License Settings"
+msgstr "Lizenz-Einstellungen"
+
+#: src/Product/LicensedProductType.php:135
+#: src/Product/LicensedProductType.php:378
+#, php-format
+msgid "%d days"
+msgstr "%d Tage"
+
+#: src/Product/LicensedProductType.php:145
+#, php-format
+msgid "Leave fields empty to use default settings from %s."
+msgstr "Felder leer lassen, um Standardeinstellungen von %s zu verwenden."
+
+#: src/Product/LicensedProductType.php:147
+msgid "WooCommerce > Settings > Licensed Products"
+msgstr "WooCommerce > Einstellungen > Lizensierte Produkte"
+
+#: src/Product/LicensedProductType.php:154
+#: src/Product/LicensedProductType.php:396
+msgid "Max Activations"
+msgstr "Max. Aktivierungen"
+
+#: src/Product/LicensedProductType.php:157
+#, php-format
+msgid "Maximum number of domain activations per license. Default: %d"
+msgstr "Maximale Anzahl der Domain-Aktivierungen pro Lizenz. Standard: %d"
+
+#: src/Product/LicensedProductType.php:172
+msgid "License Validity (Days)"
+msgstr "Lizenz-Gültigkeit (Tage)"
+
+#: src/Product/LicensedProductType.php:175
+#, php-format
+msgid "Number of days the license is valid. Leave empty for default (%s)."
+msgstr "Anzahl Tage, die die Lizenz gültig ist. Leer lassen für Standard (%s)."
+
+#: src/Product/LicensedProductType.php:190
+msgid "Bind to Major Version"
+msgstr "An Hauptversion binden"
+
+#: src/Product/LicensedProductType.php:193
+#, php-format
+msgid ""
+"If enabled, licenses are bound to the major version at purchase time. "
+"Default: %s"
+msgstr ""
+"Falls aktiviert, werden Lizenzen an die Hauptversion zum Kaufzeitpunkt "
+"gebunden. Standard: %s"
+
+#: src/Product/LicensedProductType.php:194
+msgid "Yes"
+msgstr "Ja"
+
+#: src/Product/LicensedProductType.php:194
+msgid "No"
+msgstr "Nein"
+
+#: src/Product/LicensedProductType.php:321
+msgid "Version:"
+msgstr "Version:"
+
+#: src/Product/LicensedProductType.php:349
+msgid "Licensed products are always virtual"
+msgstr "Lizenzierte Produkte sind immer virtuell"
+
+#: src/Product/LicensedProductType.php:351
+msgid "Virtual"
+msgstr "Virtuell"
+
+#: src/Product/LicensedProductType.php:384
+msgid "License Duration (Days)"
+msgstr "Lizenz-Gültigkeit (Tage)"
+
+#: src/Product/LicensedProductType.php:393
+msgid "Leave empty for parent default. 0 = Lifetime."
+msgstr "Leer lassen für übergeordneten Standard. 0 = Lebenslang."
+
+#: src/Product/LicensedProductType.php:405
+msgid "Leave empty for parent default."
+msgstr "Leer lassen für übergeordneten Standard."
+
+#: src/Product/LicensedProductVariation.php:143
+msgid "Monthly"
+msgstr "Monatlich"
+
+#: src/Product/LicensedProductVariation.php:147
+msgid "Quarterly"
+msgstr "Vierteljährlich"
+
+#: src/Product/LicensedProductVariation.php:151
+msgid "Yearly"
+msgstr "Jährlich"
+
+#: src/Product/LicensedProductVariation.php:156
+#, php-format
+msgid "%d day"
+msgid_plural "%d days"
+msgstr[0] "%d Tag"
+msgstr[1] "%d Tage"
+
 #: src/Frontend/DownloadController.php:77
 #: src/Frontend/DownloadController.php:101
 msgid "Invalid download link."
@@ -1549,48 +1602,48 @@ msgstr "Keine Download-Datei für diese Version verfügbar."
 msgid "Download file not found."
 msgstr "Download-Datei nicht gefunden."

-#: src/Frontend/AccountController.php:104
+#: src/Frontend/AccountController.php:105
 msgid "Please log in to view your licenses."
 msgstr "Bitte melden Sie sich an, um Ihre Lizenzen zu sehen."

-#: src/Frontend/AccountController.php:220
+#: src/Frontend/AccountController.php:223
 msgid "You have no licenses yet."
 msgstr "Sie haben noch keine Lizenzen."

-#: src/Frontend/AccountController.php:242
+#: src/Frontend/AccountController.php:245
 #, php-format
 msgid "Order #%s"
 msgstr "Bestellung #%s"

-#: src/Frontend/AccountController.php:293
+#: src/Frontend/AccountController.php:296
 msgid "Available Downloads"
 msgstr "Verfügbare Downloads"

-#: src/Frontend/AccountController.php:302
-#: src/Frontend/AccountController.php:335
+#: src/Frontend/AccountController.php:305
+#: src/Frontend/AccountController.php:338
 #, php-format
 msgid "Version %s"
 msgstr "Version %s"

-#: src/Frontend/AccountController.php:304
+#: src/Frontend/AccountController.php:307
 msgid "Latest"
 msgstr "Neueste"

-#: src/Frontend/AccountController.php:324
+#: src/Frontend/AccountController.php:327
 #, php-format
 msgid "Older versions (%d)"
 msgstr "Ältere Versionen (%d)"

-#: src/Frontend/AccountController.php:424
-#: src/Frontend/AccountController.php:491
+#: src/Frontend/AccountController.php:427
+#: src/Frontend/AccountController.php:494
 msgid "License transferred successfully!"
 msgstr "Lizenz erfolgreich übertragen!"

-#: src/Frontend/AccountController.php:425
+#: src/Frontend/AccountController.php:428
 msgid "Transfer failed. Please try again."
 msgstr "Übertragung fehlgeschlagen. Bitte versuchen Sie es erneut."

-#: src/Frontend/AccountController.php:426
+#: src/Frontend/AccountController.php:429
 msgid ""
 "Are you sure you want to transfer this license to a new domain? This action "
 "cannot be undone."
@@ -1598,31 +1651,31 @@ msgstr ""
 "Sind Sie sicher, dass Sie diese Lizenz auf eine neue Domain übertragen "
 "möchten? Diese Aktion kann nicht rückgängig gemacht werden."

-#: src/Frontend/AccountController.php:445
+#: src/Frontend/AccountController.php:448
 msgid "Please log in to transfer a license."
 msgstr "Bitte melden Sie sich an, um eine Lizenz zu übertragen."

-#: src/Frontend/AccountController.php:451
+#: src/Frontend/AccountController.php:454
 msgid "Invalid license."
 msgstr "Ungültige Lizenz."

-#: src/Frontend/AccountController.php:469
+#: src/Frontend/AccountController.php:472
 msgid "You do not have permission to transfer this license."
 msgstr "Sie haben keine Berechtigung, diese Lizenz zu übertragen."

-#: src/Frontend/AccountController.php:474
+#: src/Frontend/AccountController.php:477
 msgid "Revoked licenses cannot be transferred."
 msgstr "Widerrufene Lizenzen können nicht übertragen werden."

-#: src/Frontend/AccountController.php:478
+#: src/Frontend/AccountController.php:481
 msgid "Expired licenses cannot be transferred."
 msgstr "Abgelaufene Lizenzen können nicht übertragen werden."

-#: src/Frontend/AccountController.php:483
+#: src/Frontend/AccountController.php:486
 msgid "The new domain is the same as the current domain."
 msgstr "Die neue Domain ist dieselbe wie die aktuelle Domain."

-#: src/Frontend/AccountController.php:495
+#: src/Frontend/AccountController.php:498
 msgid "Failed to transfer license. Please try again."
 msgstr "Lizenzübertragung fehlgeschlagen. Bitte versuchen Sie es erneut."

@@ -1837,18 +1890,18 @@ msgstr ""
 msgid "YOUR LICENSE KEYS"
 msgstr "IHRE LIZENZSCHLÜSSEL"

-#: src/Plugin.php:318
+#: src/Plugin.php:336
 msgid "WC Licensed Product"
 msgstr "WC Licensed Product"

-#: src/Plugin.php:319
+#: src/Plugin.php:337
 msgid ""
 "Plugin license is not configured or invalid. Frontend features are disabled."
 msgstr ""
 "Plugin-Lizenz ist nicht konfiguriert oder ungültig. Frontend-Funktionen sind "
 "deaktiviert."

-#: src/Plugin.php:320
+#: src/Plugin.php:338
 msgid "Configure License"
 msgstr "Lizenz konfigurieren"

@@ -1863,6 +1916,14 @@ msgstr ""
 "WC Licensed Product benötigt WooCommerce als installierte und aktivierte "
 "Erweiterung."

+#~ msgid "API Verification Secret"
+#~ msgstr "API-Verifizierungs-Secret"
+
+#~ msgid "Use this secret to verify signed API responses. Keep it secure."
+#~ msgstr ""
+#~ "Verwenden Sie dieses Secret, um signierte API-Antworten zu verifizieren. "
+#~ "Bewahren Sie es sicher auf."
+
 #~ msgid "Domain for License Activation"
 #~ msgstr "Domain für Lizenz-Aktivierung"

--- a/languages/wc-licensed-product.pot
+++ b/languages/wc-licensed-product.pot
@@ -1,14 +1,14 @@
 # SOME DESCRIPTIVE TITLE.
 # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PACKAGE package.
+# This file is distributed under the same license as the wc-licensed-product package.
 # FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
 #
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: PACKAGE VERSION\n"
+"Project-Id-Version: wc-licensed-product 0.5.5\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-25 18:32+0100\n"
+"POT-Creation-Date: 2026-01-26 17:06+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -243,7 +243,7 @@ msgstr ""
 #: src/Admin/AdminController.php:90 src/Admin/AdminController.php:1200
 #: src/Admin/OrderLicenseController.php:149
 #: src/Admin/OrderLicenseController.php:281
-#: src/Frontend/AccountController.php:90
+#: src/Frontend/AccountController.php:91
 msgid "Licenses"
 msgstr ""

@@ -288,7 +288,7 @@ msgstr ""
 #: src/Admin/AdminController.php:149 src/Admin/AdminController.php:1341
 #: src/Admin/AdminController.php:1361 src/Admin/AdminController.php:1382
 #: src/Admin/AdminController.php:1537 src/Admin/OrderLicenseController.php:244
-#: src/Frontend/AccountController.php:384
+#: src/Frontend/AccountController.php:387
 msgid "Cancel"
 msgstr ""

@@ -303,17 +303,19 @@ msgstr ""
 #: src/Admin/AdminController.php:1373 src/Admin/AdminController.php:1613
 #: src/Admin/DashboardWidgetController.php:136
 #: src/Admin/OrderLicenseController.php:260
-#: src/Admin/SettingsController.php:192 src/Product/LicensedProductType.php:110
-#: src/Product/LicensedProductType.php:158
-#: src/Frontend/AccountController.php:283
+#: src/Admin/SettingsController.php:192 src/Product/LicensedProductType.php:136
+#: src/Product/LicensedProductType.php:184
+#: src/Product/LicensedProductType.php:379
+#: src/Product/LicensedProductVariation.php:139
+#: src/Frontend/AccountController.php:286
 msgid "Lifetime"
 msgstr ""

-#: src/Admin/AdminController.php:152 src/Frontend/AccountController.php:422
+#: src/Admin/AdminController.php:152 src/Frontend/AccountController.php:425
 msgid "Copied!"
 msgstr ""

-#: src/Admin/AdminController.php:153 src/Frontend/AccountController.php:423
+#: src/Admin/AdminController.php:153 src/Frontend/AccountController.php:426
 msgid "Copy failed"
 msgstr ""

@@ -401,7 +403,7 @@ msgstr ""
 #: src/Admin/AdminController.php:531 src/Admin/AdminController.php:549
 #: src/Admin/AdminController.php:577 src/Admin/AdminController.php:621
 #: src/Admin/AdminController.php:811 src/Admin/SettingsController.php:469
-#: src/Frontend/AccountController.php:439
+#: src/Frontend/AccountController.php:442
 msgid "Security check failed."
 msgstr ""

@@ -668,8 +670,8 @@ msgstr ""

 #: src/Admin/AdminController.php:1294 src/Admin/AdminController.php:1445
 #: src/Admin/AdminController.php:1495 src/Admin/OrderLicenseController.php:205
-#: src/Checkout/CheckoutBlocksIntegration.php:129
-#: src/Checkout/CheckoutController.php:122
+#: src/Checkout/CheckoutBlocksIntegration.php:130
+#: src/Checkout/CheckoutController.php:161
 #: src/Email/LicenseEmailController.php:288
 msgid "Domain"
 msgstr ""
@@ -689,7 +691,7 @@ msgstr ""
 msgid "No licenses found."
 msgstr ""

-#: src/Admin/AdminController.php:1314 src/Frontend/AccountController.php:260
+#: src/Admin/AdminController.php:1314 src/Frontend/AccountController.php:263
 msgid "Copy to clipboard"
 msgstr ""

@@ -709,7 +711,7 @@ msgstr ""
 msgid "Test"
 msgstr ""

-#: src/Admin/AdminController.php:1400 src/Frontend/AccountController.php:267
+#: src/Admin/AdminController.php:1400 src/Frontend/AccountController.php:270
 msgid "Transfer to new domain"
 msgstr ""

@@ -737,27 +739,27 @@ msgstr ""
 msgid "Testing license..."
 msgstr ""

-#: src/Admin/AdminController.php:1508 src/Frontend/AccountController.php:362
+#: src/Admin/AdminController.php:1508 src/Frontend/AccountController.php:365
 msgid "Close"
 msgstr ""

-#: src/Admin/AdminController.php:1517 src/Frontend/AccountController.php:363
+#: src/Admin/AdminController.php:1517 src/Frontend/AccountController.php:366
 msgid "Transfer License to New Domain"
 msgstr ""

-#: src/Admin/AdminController.php:1524 src/Frontend/AccountController.php:368
+#: src/Admin/AdminController.php:1524 src/Frontend/AccountController.php:371
 msgid "Current Domain"
 msgstr ""

-#: src/Admin/AdminController.php:1528 src/Frontend/AccountController.php:373
+#: src/Admin/AdminController.php:1528 src/Frontend/AccountController.php:376
 msgid "New Domain"
 msgstr ""

-#: src/Admin/AdminController.php:1531 src/Frontend/AccountController.php:377
+#: src/Admin/AdminController.php:1531 src/Frontend/AccountController.php:380
 msgid "Enter the new domain without http:// or www."
 msgstr ""

-#: src/Admin/AdminController.php:1536 src/Frontend/AccountController.php:382
+#: src/Admin/AdminController.php:1536 src/Frontend/AccountController.php:385
 msgid "Transfer License"
 msgstr ""

@@ -940,11 +942,11 @@ msgid "Domains specified during checkout (multi-domain order)."
 msgstr ""

 #: src/Admin/OrderLicenseController.php:119
-#: src/Checkout/CheckoutController.php:436
-#: src/Checkout/CheckoutController.php:486
-#: src/Checkout/CheckoutController.php:496 src/License/LicenseManager.php:806
+#: src/Checkout/CheckoutController.php:530
+#: src/Checkout/CheckoutController.php:591
+#: src/Checkout/CheckoutController.php:613 src/License/LicenseManager.php:878
 #: src/Product/VersionManager.php:349 src/Product/VersionManager.php:361
-#: src/Frontend/AccountController.php:146
+#: src/Frontend/AccountController.php:148
 #: src/Email/LicenseExpirationEmail.php:107
 #: src/Email/LicenseExpiredEmail.php:99
 msgid "Unknown Product"
@@ -957,10 +959,10 @@ msgid ""
 msgstr ""

 #: src/Admin/OrderLicenseController.php:137
-#: src/Checkout/CheckoutBlocksIntegration.php:83
-#: src/Checkout/CheckoutBlocksIntegration.php:119
-#: src/Checkout/CheckoutController.php:130
-#: src/Checkout/CheckoutController.php:186
+#: src/Checkout/CheckoutBlocksIntegration.php:84
+#: src/Checkout/CheckoutBlocksIntegration.php:120
+#: src/Checkout/CheckoutController.php:169
+#: src/Checkout/CheckoutController.php:235
 msgid "example.com"
 msgstr ""

@@ -1019,9 +1021,9 @@ msgid "Error. Please try again."
 msgstr ""

 #: src/Admin/OrderLicenseController.php:373
-#: src/Checkout/CheckoutBlocksIntegration.php:126
-#: src/Frontend/AccountController.php:427
-#: src/Frontend/AccountController.php:459
+#: src/Checkout/CheckoutBlocksIntegration.php:127
+#: src/Frontend/AccountController.php:430
+#: src/Frontend/AccountController.php:462
 msgid "Please enter a valid domain."
 msgstr ""

@@ -1045,7 +1047,7 @@ msgstr ""

 #: src/Admin/OrderLicenseController.php:449
 #: src/Frontend/DownloadController.php:117
-#: src/Frontend/AccountController.php:465
+#: src/Frontend/AccountController.php:468
 msgid "License not found."
 msgstr ""

@@ -1236,118 +1238,124 @@ msgstr ""
 msgid "License validation failed."
 msgstr ""

-#: src/Api/RestApiController.php:84
+#: src/Api/RestApiController.php:106
 msgid "Too many requests. Please try again later."
 msgstr ""

-#: src/Api/RestApiController.php:345 src/Api/RestApiController.php:378
-#: src/License/LicenseManager.php:403
+#: src/Api/RestApiController.php:400 src/Api/RestApiController.php:433
+#: src/License/LicenseManager.php:475
 msgid "License key not found."
 msgstr ""

-#: src/Api/RestApiController.php:386
+#: src/Api/RestApiController.php:441
 msgid "This license is not valid."
 msgstr ""

-#: src/Api/RestApiController.php:396
+#: src/Api/RestApiController.php:451
 msgid "License is already activated for this domain."
 msgstr ""

-#: src/Api/RestApiController.php:405
+#: src/Api/RestApiController.php:460
 msgid "Maximum number of activations reached."
 msgstr ""

-#: src/Api/RestApiController.php:416
+#: src/Api/RestApiController.php:471
 msgid "Failed to activate license."
 msgstr ""

-#: src/Api/RestApiController.php:422
+#: src/Api/RestApiController.php:477
 msgid "License activated successfully."
 msgstr ""

-#: src/Checkout/CheckoutBlocksIntegration.php:78
-#: src/Checkout/CheckoutBlocksIntegration.php:125
-#: src/Checkout/CheckoutController.php:119
+#: src/Checkout/CheckoutBlocksIntegration.php:79
+#: src/Checkout/CheckoutBlocksIntegration.php:126
+#: src/Checkout/CheckoutController.php:158
 msgid "License Domain"
 msgstr ""

-#: src/Checkout/CheckoutBlocksIntegration.php:85
+#: src/Checkout/CheckoutBlocksIntegration.php:86
 msgid "Enter a valid domain (without http:// or www)"
 msgstr ""

-#: src/Checkout/CheckoutBlocksIntegration.php:121
-#: src/Checkout/CheckoutController.php:150
+#: src/Checkout/CheckoutBlocksIntegration.php:122
+#: src/Checkout/CheckoutController.php:189
 msgid "Enter a unique domain for each license (without http:// or www)."
 msgstr ""

-#: src/Checkout/CheckoutBlocksIntegration.php:122
-#: src/Checkout/CheckoutController.php:134
+#: src/Checkout/CheckoutBlocksIntegration.php:123
+#: src/Checkout/CheckoutController.php:173
 msgid ""
 "Enter the domain where you will use the license (without http:// or www)."
 msgstr ""

-#: src/Checkout/CheckoutBlocksIntegration.php:124
-#: src/Checkout/CheckoutController.php:148
+#: src/Checkout/CheckoutBlocksIntegration.php:125
+#: src/Checkout/CheckoutController.php:187
 msgid "License Domains"
 msgstr ""

-#: src/Checkout/CheckoutBlocksIntegration.php:127
+#: src/Checkout/CheckoutBlocksIntegration.php:128
 msgid "Each license requires a unique domain."
 msgstr ""

-#: src/Checkout/CheckoutBlocksIntegration.php:128
-#: src/Checkout/CheckoutController.php:175
+#: src/Checkout/CheckoutBlocksIntegration.php:129
+#: src/Checkout/CheckoutController.php:224
 #, php-format
 msgid "License %d:"
 msgstr ""

-#: src/Checkout/CheckoutController.php:123
-#: src/Checkout/CheckoutController.php:179
+#: src/Checkout/CheckoutController.php:162
+#: src/Checkout/CheckoutController.php:228
 msgid "required"
 msgstr ""

-#: src/Checkout/CheckoutController.php:258
+#: src/Checkout/CheckoutController.php:323
 msgid "Please enter a domain for your license."
 msgstr ""

-#: src/Checkout/CheckoutController.php:264
+#: src/Checkout/CheckoutController.php:329
 msgid "Please enter a valid domain for your license."
 msgstr ""

-#: src/Checkout/CheckoutController.php:287
+#: src/Checkout/CheckoutController.php:356
 #, php-format
 msgid "Please enter a domain for %1$s (License %2$d)."
 msgstr ""

-#: src/Checkout/CheckoutController.php:302
+#: src/Checkout/CheckoutController.php:371
 #, php-format
 msgid "Please enter a valid domain for %1$s (License %2$d)."
 msgstr ""

-#: src/Checkout/CheckoutController.php:316
+#: src/Checkout/CheckoutController.php:385
 #, php-format
 msgid ""
 "The domain \"%1$s\" is used multiple times for %2$s. Each license requires a "
 "unique domain."
 msgstr ""

-#: src/Checkout/CheckoutController.php:419
-#: src/Checkout/CheckoutController.php:466
-#: src/Checkout/CheckoutController.php:470
+#: src/Checkout/CheckoutController.php:500
+#: src/Checkout/CheckoutController.php:561
+#: src/Checkout/CheckoutController.php:565
 msgid "License Domain:"
 msgstr ""

-#: src/Checkout/CheckoutController.php:432
-#: src/Checkout/CheckoutController.php:483
-#: src/Checkout/CheckoutController.php:492
+#: src/Checkout/CheckoutController.php:513
+#: src/Checkout/CheckoutController.php:578
+#: src/Checkout/CheckoutController.php:599
 msgid "License Domains:"
 msgstr ""

+#: src/Checkout/CheckoutController.php:522
+#: src/Checkout/CheckoutController.php:585
+#: src/Checkout/CheckoutController.php:607
+msgid "Unknown Variation"
+msgstr ""
+
 #: src/Checkout/StoreApiExtension.php:93
 msgid "Domains for license activation by product"
 msgstr ""

-#: src/Checkout/StoreApiExtension.php:117
+#: src/Checkout/StoreApiExtension.php:120
 msgid "Domain for license activation"
 msgstr ""

@@ -1359,85 +1367,22 @@ msgstr ""
 msgid "Could not connect to license server."
 msgstr ""

-#: src/License/LicenseManager.php:412
+#: src/License/LicenseManager.php:484
 msgid "This license has been revoked."
 msgstr ""

-#: src/License/LicenseManager.php:422
+#: src/License/LicenseManager.php:494
 msgid "This license has expired."
 msgstr ""

-#: src/License/LicenseManager.php:430
+#: src/License/LicenseManager.php:502
 msgid "This license is inactive."
 msgstr ""

-#: src/License/LicenseManager.php:440
+#: src/License/LicenseManager.php:512
 msgid "This license is not valid for this domain."
 msgstr ""

-#: src/Product/LicensedProductType.php:61
-msgid "Licensed Product"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:82
-msgid "License Settings"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:109
-#, php-format
-msgid "%d days"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:119
-#, php-format
-msgid "Leave fields empty to use default settings from %s."
-msgstr ""
-
-#: src/Product/LicensedProductType.php:121
-msgid "WooCommerce > Settings > Licensed Products"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:128
-msgid "Max Activations"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:131
-#, php-format
-msgid "Maximum number of domain activations per license. Default: %d"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:146
-msgid "License Validity (Days)"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:149
-#, php-format
-msgid "Number of days the license is valid. Leave empty for default (%s)."
-msgstr ""
-
-#: src/Product/LicensedProductType.php:164
-msgid "Bind to Major Version"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:167
-#, php-format
-msgid ""
-"If enabled, licenses are bound to the major version at purchase time. "
-"Default: %s"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:168
-msgid "Yes"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:168
-msgid "No"
-msgstr ""
-
-#: src/Product/LicensedProductType.php:288
-msgid "Version:"
-msgstr ""
-
 #: src/Product/VersionManager.php:166
 msgid "Attachment file not found."
 msgstr ""
@@ -1447,6 +1392,114 @@ msgstr ""
 msgid "File checksum does not match. Expected: %1$s, Got: %2$s"
 msgstr ""

+#: src/Product/LicensedProductType.php:72
+msgid "Licensed Product"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:73
+msgid "Licensed Variable Product"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:108
+msgid "License Settings"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:135
+#: src/Product/LicensedProductType.php:378
+#, php-format
+msgid "%d days"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:145
+#, php-format
+msgid "Leave fields empty to use default settings from %s."
+msgstr ""
+
+#: src/Product/LicensedProductType.php:147
+msgid "WooCommerce > Settings > Licensed Products"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:154
+#: src/Product/LicensedProductType.php:396
+msgid "Max Activations"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:157
+#, php-format
+msgid "Maximum number of domain activations per license. Default: %d"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:172
+msgid "License Validity (Days)"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:175
+#, php-format
+msgid "Number of days the license is valid. Leave empty for default (%s)."
+msgstr ""
+
+#: src/Product/LicensedProductType.php:190
+msgid "Bind to Major Version"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:193
+#, php-format
+msgid ""
+"If enabled, licenses are bound to the major version at purchase time. "
+"Default: %s"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:194
+msgid "Yes"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:194
+msgid "No"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:321
+msgid "Version:"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:349
+msgid "Licensed products are always virtual"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:351
+msgid "Virtual"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:384
+msgid "License Duration (Days)"
+msgstr ""
+
+#: src/Product/LicensedProductType.php:393
+msgid "Leave empty for parent default. 0 = Lifetime."
+msgstr ""
+
+#: src/Product/LicensedProductType.php:405
+msgid "Leave empty for parent default."
+msgstr ""
+
+#: src/Product/LicensedProductVariation.php:143
+msgid "Monthly"
+msgstr ""
+
+#: src/Product/LicensedProductVariation.php:147
+msgid "Quarterly"
+msgstr ""
+
+#: src/Product/LicensedProductVariation.php:151
+msgid "Yearly"
+msgstr ""
+
+#: src/Product/LicensedProductVariation.php:156
+#, php-format
+msgid "%d day"
+msgid_plural "%d days"
+msgstr[0] ""
+msgstr[1] ""
+
 #: src/Frontend/DownloadController.php:77
 #: src/Frontend/DownloadController.php:101
 msgid "Invalid download link."
@@ -1498,78 +1551,78 @@ msgstr ""
 msgid "Download file not found."
 msgstr ""

-#: src/Frontend/AccountController.php:104
+#: src/Frontend/AccountController.php:105
 msgid "Please log in to view your licenses."
 msgstr ""

-#: src/Frontend/AccountController.php:220
+#: src/Frontend/AccountController.php:223
 msgid "You have no licenses yet."
 msgstr ""

-#: src/Frontend/AccountController.php:242
+#: src/Frontend/AccountController.php:245
 #, php-format
 msgid "Order #%s"
 msgstr ""

-#: src/Frontend/AccountController.php:293
+#: src/Frontend/AccountController.php:296
 msgid "Available Downloads"
 msgstr ""

-#: src/Frontend/AccountController.php:302
-#: src/Frontend/AccountController.php:335
+#: src/Frontend/AccountController.php:305
+#: src/Frontend/AccountController.php:338
 #, php-format
 msgid "Version %s"
 msgstr ""

-#: src/Frontend/AccountController.php:304
+#: src/Frontend/AccountController.php:307
 msgid "Latest"
 msgstr ""

-#: src/Frontend/AccountController.php:324
+#: src/Frontend/AccountController.php:327
 #, php-format
 msgid "Older versions (%d)"
 msgstr ""

-#: src/Frontend/AccountController.php:424
-#: src/Frontend/AccountController.php:491
+#: src/Frontend/AccountController.php:427
+#: src/Frontend/AccountController.php:494
 msgid "License transferred successfully!"
 msgstr ""

-#: src/Frontend/AccountController.php:425
+#: src/Frontend/AccountController.php:428
 msgid "Transfer failed. Please try again."
 msgstr ""

-#: src/Frontend/AccountController.php:426
+#: src/Frontend/AccountController.php:429
 msgid ""
 "Are you sure you want to transfer this license to a new domain? This action "
 "cannot be undone."
 msgstr ""

-#: src/Frontend/AccountController.php:445
+#: src/Frontend/AccountController.php:448
 msgid "Please log in to transfer a license."
 msgstr ""

-#: src/Frontend/AccountController.php:451
+#: src/Frontend/AccountController.php:454
 msgid "Invalid license."
 msgstr ""

-#: src/Frontend/AccountController.php:469
+#: src/Frontend/AccountController.php:472
 msgid "You do not have permission to transfer this license."
 msgstr ""

-#: src/Frontend/AccountController.php:474
+#: src/Frontend/AccountController.php:477
 msgid "Revoked licenses cannot be transferred."
 msgstr ""

-#: src/Frontend/AccountController.php:478
+#: src/Frontend/AccountController.php:481
 msgid "Expired licenses cannot be transferred."
 msgstr ""

-#: src/Frontend/AccountController.php:483
+#: src/Frontend/AccountController.php:486
 msgid "The new domain is the same as the current domain."
 msgstr ""

-#: src/Frontend/AccountController.php:495
+#: src/Frontend/AccountController.php:498
 msgid "Failed to transfer license. Please try again."
 msgstr ""

@@ -1772,16 +1825,16 @@ msgstr ""
 msgid "YOUR LICENSE KEYS"
 msgstr ""

-#: src/Plugin.php:318
+#: src/Plugin.php:336
 msgid "WC Licensed Product"
 msgstr ""

-#: src/Plugin.php:319
+#: src/Plugin.php:337
 msgid ""
 "Plugin license is not configured or invalid. Frontend features are disabled."
 msgstr ""

-#: src/Plugin.php:320
+#: src/Plugin.php:338
 msgid "Configure License"
 msgstr ""

--- a/releases/wc-licensed-product-0.5.3.zip
+++ b/releases/wc-licensed-product-0.5.3.zip
--- a/releases/wc-licensed-product-0.5.3.zip.sha256
+++ b/releases/wc-licensed-product-0.5.3.zip.sha256
@@ -0,0 +1 @@
+bbd0fa8888c6990a4ba00ccfb8b2189ee6ac529a34cc11a5d8d8d28518b1f6dd  wc-licensed-product-0.5.3.zip
--- a/src/Api/ResponseSigner.php
+++ b/src/Api/ResponseSigner.php
@@ -147,9 +147,59 @@ final class ResponseSigner
     */
    private function deriveKey(string $licenseKey): string
    {
-        // HKDF-like key derivation
-        $prk = hash_hmac('sha256', $licenseKey, $this->serverSecret, true);
+        return self::deriveCustomerSecret($licenseKey, $this->serverSecret);
+    }

-        return hash_hmac('sha256', $prk . "\x01", $this->serverSecret);
+    /**
+     * Derive a customer-specific secret from a license key
+     *
+     * This secret is unique per license and can be shared with the customer
+     * to verify signed API responses. Each customer gets their own secret
+     * derived from their license key.
+     *
+     * Uses RFC 5869 HKDF via PHP's native hash_hkdf() function.
+     * Parameters match the client library (SecureLicenseClient):
+     * - IKM (input keying material): server_secret
+     * - Length: 32 bytes (256 bits for SHA-256)
+     * - Info: license_key (context-specific info)
+     *
+     * @param string $licenseKey   The customer's license key
+     * @param string $serverSecret The server's master secret
+     * @return string The derived secret (64 hex characters)
+     */
+    public static function deriveCustomerSecret(string $licenseKey, string $serverSecret): string
+    {
+        // RFC 5869 HKDF using PHP's native implementation
+        // Must match client's ResponseSignature::deriveKey() exactly
+        $binaryKey = hash_hkdf('sha256', $serverSecret, 32, $licenseKey);
+
+        return bin2hex($binaryKey);
+    }
+
+    /**
+     * Get the customer secret for a license key using the configured server secret
+     *
+     * @param string $licenseKey The customer's license key
+     * @return string|null The derived secret, or null if server secret is not configured
+     */
+    public static function getCustomerSecretForLicense(string $licenseKey): ?string
+    {
+        $serverSecret = defined('WC_LICENSE_SERVER_SECRET') ? WC_LICENSE_SERVER_SECRET : '';
+
+        if (empty($serverSecret)) {
+            return null;
+        }
+
+        return self::deriveCustomerSecret($licenseKey, $serverSecret);
+    }
+
+    /**
+     * Check if response signing is enabled
+     *
+     * @return bool True if server secret is configured
+     */
+    public static function isSigningEnabled(): bool
+    {
+        return defined('WC_LICENSE_SERVER_SECRET') && !empty(WC_LICENSE_SERVER_SECRET);
    }
 }
--- a/src/Api/RestApiController.php
+++ b/src/Api/RestApiController.php
@@ -22,14 +22,34 @@ final class RestApiController
    private const NAMESPACE = 'wc-licensed-product/v1';

    /**
-     * Rate limit: requests per minute per IP
+     * Default rate limit: requests per window per IP
     */
-    private const RATE_LIMIT_REQUESTS = 30;
+    private const DEFAULT_RATE_LIMIT = 30;

    /**
-     * Rate limit window in seconds
+     * Default rate limit window in seconds
     */
-    private const RATE_LIMIT_WINDOW = 60;
+    private const DEFAULT_RATE_WINDOW = 60;
+
+    /**
+     * Get the configured rate limit (requests per window)
+     */
+    private function getRateLimit(): int
+    {
+        return defined('WC_LICENSE_RATE_LIMIT')
+            ? (int) WC_LICENSE_RATE_LIMIT
+            : self::DEFAULT_RATE_LIMIT;
+    }
+
+    /**
+     * Get the configured rate limit window in seconds
+     */
+    private function getRateWindow(): int
+    {
+        return defined('WC_LICENSE_RATE_WINDOW')
+            ? (int) WC_LICENSE_RATE_WINDOW
+            : self::DEFAULT_RATE_WINDOW;
+    }

    private LicenseManager $licenseManager;

@@ -56,12 +76,14 @@ final class RestApiController
    {
        $ip = $this->getClientIp();
        $transientKey = 'wclp_rate_' . md5($ip);
+        $rateLimit = $this->getRateLimit();
+        $rateWindow = $this->getRateWindow();

        $data = get_transient($transientKey);

        if ($data === false) {
            // First request, start counting
-            set_transient($transientKey, ['count' => 1, 'start' => time()], self::RATE_LIMIT_WINDOW);
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
            return null;
        }

@@ -69,15 +91,15 @@ final class RestApiController
        $start = (int) ($data['start'] ?? time());

        // Check if window has expired
-        if (time() - $start >= self::RATE_LIMIT_WINDOW) {
+        if (time() - $start >= $rateWindow) {
            // Reset counter
-            set_transient($transientKey, ['count' => 1, 'start' => time()], self::RATE_LIMIT_WINDOW);
+            set_transient($transientKey, ['count' => 1, 'start' => time()], $rateWindow);
            return null;
        }

        // Check if limit exceeded
-        if ($count >= self::RATE_LIMIT_REQUESTS) {
-            $retryAfter = self::RATE_LIMIT_WINDOW - (time() - $start);
+        if ($count >= $rateLimit) {
+            $retryAfter = $rateWindow - (time() - $start);
            $response = new WP_REST_Response([
                'success' => false,
                'error' => 'rate_limit_exceeded',
@@ -89,7 +111,7 @@ final class RestApiController
        }

        // Increment counter
-        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], self::RATE_LIMIT_WINDOW);
+        set_transient($transientKey, ['count' => $count + 1, 'start' => $start], $rateWindow);
        return null;
    }

@@ -257,7 +279,8 @@ final class RestApiController
                    'type' => 'string',
                    'sanitize_callback' => 'sanitize_text_field',
                    'validate_callback' => function ($value): bool {
-                        return !empty($value) && strlen($value) <= 64;
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
                    },
                ],
                'domain' => [
@@ -281,6 +304,10 @@ final class RestApiController
                    'required' => true,
                    'type' => 'string',
                    'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
+                    },
                ],
            ],
        ]);
@@ -295,11 +322,18 @@ final class RestApiController
                    'required' => true,
                    'type' => 'string',
                    'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        $len = strlen($value);
+                        return !empty($value) && $len >= 8 && $len <= 64;
+                    },
                ],
                'domain' => [
                    'required' => true,
                    'type' => 'string',
                    'sanitize_callback' => 'sanitize_text_field',
+                    'validate_callback' => function ($value): bool {
+                        return !empty($value) && strlen($value) <= 255;
+                    },
                ],
            ],
        ]);
@@ -320,11 +354,32 @@ final class RestApiController

        $result = $this->licenseManager->validateLicense($licenseKey, $domain);

-        $statusCode = $result['valid'] ? 200 : 403;
+        $statusCode = $this->getStatusCodeForResult($result);

        return new WP_REST_Response($result, $statusCode);
    }

+    /**
+     * Get HTTP status code based on validation result
+     *
+     * @param array $result The validation result
+     * @return int HTTP status code
+     */
+    private function getStatusCodeForResult(array $result): int
+    {
+        if ($result['valid']) {
+            return 200;
+        }
+
+        $error = $result['error'] ?? '';
+
+        return match ($error) {
+            'license_not_found' => 404,
+            'activation_failed' => 500,
+            default => 403,
+        };
+    }
+
    /**
     * Check license status endpoint
     */
--- a/src/Checkout/CheckoutBlocksIntegration.php
+++ b/src/Checkout/CheckoutBlocksIntegration.php
@@ -11,6 +11,7 @@ namespace Jeremias\WcLicensedProduct\Checkout;

 use Automattic\WooCommerce\Blocks\Integrations\IntegrationInterface;
 use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;

 /**
 * Integration with WooCommerce Checkout Blocks
@@ -141,7 +142,7 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
    /**
     * Get licensed products from cart with quantities
     *
-     * @return array<int, array{product_id: int, name: string, quantity: int}>
+     * @return array<string, array{product_id: int, variation_id: int, name: string, quantity: int, duration_label: string}>
     */
    private function getLicensedProductsFromCart(): array
    {
@@ -152,13 +153,49 @@ final class CheckoutBlocksIntegration implements IntegrationInterface
        $licensedProducts = [];
        foreach (WC()->cart->get_cart() as $cartItem) {
            $product = $cartItem['data'];
-            if ($product && $product->is_type('licensed')) {
+            if (!$product) {
+                continue;
+            }
+
+            // Check for simple licensed products
+            if ($product->is_type('licensed')) {
                $productId = $product->get_id();
                $licensedProducts[] = [
                    'product_id' => $productId,
+                    'variation_id' => 0,
                    'name' => $product->get_name(),
                    'quantity' => (int) $cartItem['quantity'],
+                    'duration_label' => '',
                ];
+                continue;
+            }
+
+            // Check for variations of licensed-variable products
+            if ($product->is_type('variation')) {
+                $parentId = $product->get_parent_id();
+                $parent = wc_get_product($parentId);
+
+                if ($parent && $parent->is_type('licensed-variable')) {
+                    $variationId = $product->get_id();
+
+                    // Get duration label if it's a LicensedProductVariation
+                    $durationLabel = '';
+                    if ($product instanceof LicensedProductVariation) {
+                        $durationLabel = $product->get_license_duration_label();
+                    } else {
+                        // Try to instantiate as LicensedProductVariation
+                        $variation = new LicensedProductVariation($variationId);
+                        $durationLabel = $variation->get_license_duration_label();
+                    }
+
+                    $licensedProducts[] = [
+                        'product_id' => $parentId,
+                        'variation_id' => $variationId,
+                        'name' => $product->get_name(),
+                        'quantity' => (int) $cartItem['quantity'],
+                        'duration_label' => $durationLabel,
+                    ];
+                }
            }
        }

--- a/src/Checkout/CheckoutController.php
+++ b/src/Checkout/CheckoutController.php
@@ -11,6 +11,7 @@ namespace Jeremias\WcLicensedProduct\Checkout;

 use Jeremias\WcLicensedProduct\License\LicenseManager;
 use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;

 /**
 * Handles checkout modifications for licensed products
@@ -57,7 +58,7 @@ final class CheckoutController
    /**
     * Get licensed products from cart with quantities
     *
-     * @return array<int, array{product_id: int, name: string, quantity: int}>
+     * @return array<string, array{product_id: int, variation_id: int, name: string, quantity: int, duration_label: string}>
     */
    private function getLicensedProductsFromCart(): array
    {
@@ -68,13 +69,51 @@ final class CheckoutController
        $licensedProducts = [];
        foreach (WC()->cart->get_cart() as $cartItem) {
            $product = $cartItem['data'];
-            if ($product && $product->is_type('licensed')) {
+            if (!$product) {
+                continue;
+            }
+
+            // Check for simple licensed products
+            if ($product->is_type('licensed')) {
                $productId = $product->get_id();
                $licensedProducts[$productId] = [
                    'product_id' => $productId,
+                    'variation_id' => 0,
                    'name' => $product->get_name(),
                    'quantity' => (int) $cartItem['quantity'],
+                    'duration_label' => '',
                ];
+                continue;
+            }
+
+            // Check for variations of licensed-variable products
+            if ($product->is_type('variation')) {
+                $parentId = $product->get_parent_id();
+                $parent = wc_get_product($parentId);
+
+                if ($parent && $parent->is_type('licensed-variable')) {
+                    $variationId = $product->get_id();
+                    // Use combination key to allow same product with different variations
+                    $key = "{$parentId}_{$variationId}";
+
+                    // Get duration label if it's a LicensedProductVariation
+                    $durationLabel = '';
+                    if ($product instanceof LicensedProductVariation) {
+                        $durationLabel = $product->get_license_duration_label();
+                    } else {
+                        // Try to instantiate as LicensedProductVariation
+                        $variation = new LicensedProductVariation($variationId);
+                        $durationLabel = $variation->get_license_duration_label();
+                    }
+
+                    $licensedProducts[$key] = [
+                        'product_id' => $parentId,
+                        'variation_id' => $variationId,
+                        'name' => $product->get_name(),
+                        'quantity' => (int) $cartItem['quantity'],
+                        'duration_label' => $durationLabel,
+                    ];
+                }
            }
        }

@@ -150,22 +189,32 @@ final class CheckoutController
                <?php esc_html_e('Enter a unique domain for each license (without http:// or www).', 'wc-licensed-product'); ?>
            </p>

-            <?php foreach ($licensedProducts as $productId => $productData): ?>
-                <div class="wclp-product-domains" data-product-id="<?php echo esc_attr($productId); ?>">
+            <?php foreach ($licensedProducts as $key => $productData): ?>
+                <?php
+                $productId = $productData['product_id'];
+                $variationId = $productData['variation_id'] ?? 0;
+                $durationLabel = $productData['duration_label'] ?? '';
+                // Use key for field names to handle variations
+                $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : $productId;
+                ?>
+                <div class="wclp-product-domains" data-product-id="<?php echo esc_attr($productId); ?>" data-variation-id="<?php echo esc_attr($variationId); ?>">
                    <h4>
                        <?php
                        echo esc_html($productData['name']);
+                        if (!empty($durationLabel)) {
+                            echo ' <span class="wclp-duration-badge">(' . esc_html($durationLabel) . ')</span>';
+                        }
                        if ($productData['quantity'] > 1) {
-                            printf(' (×%d)', $productData['quantity']);
+                            printf(' ×%d', $productData['quantity']);
                        }
                        ?>
                    </h4>

                    <?php for ($i = 0; $i < $productData['quantity']; $i++): ?>
                        <?php
-                        $fieldName = sprintf('licensed_domains[%d][%d]', $productId, $i);
-                        $fieldId = sprintf('licensed_domain_%d_%d', $productId, $i);
-                        $savedValue = $this->getSavedDomainValue($productId, $i);
+                        $fieldName = sprintf('licensed_domains[%s][%d]', $fieldKey, $i);
+                        $fieldId = sprintf('licensed_domain_%s_%d', str_replace('_', '-', $fieldKey), $i);
+                        $savedValue = $this->getSavedDomainValue($productId, $i, $variationId);
                        ?>
                        <p class="form-row form-row-wide wclp-domain-row">
                            <label for="<?php echo esc_attr($fieldId); ?>">
@@ -186,6 +235,9 @@ final class CheckoutController
                                placeholder="<?php esc_attr_e('example.com', 'wc-licensed-product'); ?>"
                                value="<?php echo esc_attr($savedValue); ?>"
                            />
+                            <?php if ($variationId > 0): ?>
+                                <input type="hidden" name="licensed_variation_ids[<?php echo esc_attr($fieldKey); ?>]" value="<?php echo esc_attr($variationId); ?>" />
+                            <?php endif; ?>
                        </p>
                    <?php endfor; ?>
                </div>
@@ -197,6 +249,7 @@ final class CheckoutController
            .wclp-domain-description { margin-bottom: 15px; color: #666; }
            .wclp-product-domains { margin-bottom: 20px; padding: 15px; background: #f8f8f8; border-radius: 4px; }
            .wclp-product-domains h4 { margin: 0 0 10px 0; font-size: 1em; }
+            .wclp-duration-badge { color: #0073aa; font-weight: normal; }
            .wclp-domain-row { margin-bottom: 10px; }
            .wclp-domain-row:last-child { margin-bottom: 0; }
            .wclp-domain-row label { display: block; margin-bottom: 5px; }
@@ -207,9 +260,17 @@ final class CheckoutController
    /**
     * Get saved domain value from session/POST
     */
-    private function getSavedDomainValue(int $productId, int $index): string
+    private function getSavedDomainValue(int $productId, int $index, int $variationId = 0): string
    {
+        // Build the field key (with or without variation)
+        $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
        // Check POST data first (validation failure case)
+        if (isset($_POST['licensed_domains'][$fieldKey][$index])) {
+            return sanitize_text_field($_POST['licensed_domains'][$fieldKey][$index]);
+        }
+
+        // Also try numeric key for backward compatibility
        if (isset($_POST['licensed_domains'][$productId][$index])) {
            return sanitize_text_field($_POST['licensed_domains'][$productId][$index]);
        }
@@ -218,7 +279,11 @@ final class CheckoutController
        if (WC()->session) {
            $sessionDomains = WC()->session->get('licensed_product_domains', []);
            foreach ($sessionDomains as $item) {
-                if (isset($item['product_id']) && (int) $item['product_id'] === $productId) {
+                $itemProductId = (int) ($item['product_id'] ?? 0);
+                $itemVariationId = (int) ($item['variation_id'] ?? 0);
+
+                // Match by product and variation
+                if ($itemProductId === $productId && $itemVariationId === $variationId) {
                    if (isset($item['domains'][$index])) {
                        return $item['domains'][$index];
                    }
@@ -272,8 +337,12 @@ final class CheckoutController
    {
        $licensedDomains = $_POST['licensed_domains'] ?? [];

-        foreach ($licensedProducts as $productId => $productData) {
-            $productDomains = $licensedDomains[$productId] ?? [];
+        foreach ($licensedProducts as $key => $productData) {
+            $productId = $productData['product_id'];
+            $variationId = $productData['variation_id'] ?? 0;
+            $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
+            $productDomains = $licensedDomains[$fieldKey] ?? $licensedDomains[$productId] ?? [];
            $normalizedDomains = [];

            for ($i = 0; $i < $productData['quantity']; $i++) {
@@ -308,7 +377,7 @@ final class CheckoutController
                    continue;
                }

-                // Check for duplicate domains within same product
+                // Check for duplicate domains within same product/variation
                if (in_array($normalizedDomain, $normalizedDomains, true)) {
                    wc_add_notice(
                        sprintf(
@@ -369,10 +438,15 @@ final class CheckoutController
    private function saveMultiDomainFields(\WC_Order $order, array $licensedProducts): void
    {
        $licensedDomains = $_POST['licensed_domains'] ?? [];
+        $licensedVariationIds = $_POST['licensed_variation_ids'] ?? [];
        $domainData = [];

-        foreach ($licensedProducts as $productId => $productData) {
-            $productDomains = $licensedDomains[$productId] ?? [];
+        foreach ($licensedProducts as $key => $productData) {
+            $productId = $productData['product_id'];
+            $variationId = $productData['variation_id'] ?? 0;
+            $fieldKey = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+
+            $productDomains = $licensedDomains[$fieldKey] ?? $licensedDomains[$productId] ?? [];
            $normalizedDomains = [];

            for ($i = 0; $i < $productData['quantity']; $i++) {
@@ -383,10 +457,17 @@ final class CheckoutController
            }

            if (!empty($normalizedDomains)) {
-                $domainData[] = [
+                $entry = [
                    'product_id' => $productId,
                    'domains' => $normalizedDomains,
                ];
+
+                // Include variation_id if present
+                if ($variationId > 0) {
+                    $entry['variation_id'] = $variationId;
+                }
+
+                $domainData[] = $entry;
            }
        }

@@ -432,8 +513,22 @@ final class CheckoutController
            <strong><?php esc_html_e('License Domains:', 'wc-licensed-product'); ?></strong>
            <?php foreach ($domainData as $item): ?>
                <?php
-                $product = wc_get_product($item['product_id']);
-                $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                $productId = $item['product_id'];
+                $variationId = $item['variation_id'] ?? 0;
+
+                // Get product name
+                if ($variationId > 0) {
+                    $variation = wc_get_product($variationId);
+                    $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+
+                    // Add duration label if available
+                    if ($variation instanceof LicensedProductVariation) {
+                        $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                    }
+                } else {
+                    $product = wc_get_product($productId);
+                    $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                }
                ?>
                <p style="margin: 5px 0 5px 15px;">
                    <em><?php echo esc_html($productName); ?>:</em><br>
@@ -482,8 +577,20 @@ final class CheckoutController
        if ($plainText) {
            echo "\n" . esc_html__('License Domains:', 'wc-licensed-product') . "\n";
            foreach ($domainData as $item) {
-                $product = wc_get_product($item['product_id']);
-                $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                $productId = $item['product_id'];
+                $variationId = $item['variation_id'] ?? 0;
+
+                if ($variationId > 0) {
+                    $variation = wc_get_product($variationId);
+                    $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+                    if ($variation instanceof LicensedProductVariation) {
+                        $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                    }
+                } else {
+                    $product = wc_get_product($productId);
+                    $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                }
+
                echo '  ' . esc_html($productName) . ': ' . esc_html(implode(', ', $item['domains'])) . "\n";
            }
        } else {
@@ -492,8 +599,19 @@ final class CheckoutController
                <strong><?php esc_html_e('License Domains:', 'wc-licensed-product'); ?></strong>
                <?php foreach ($domainData as $item): ?>
                    <?php
-                    $product = wc_get_product($item['product_id']);
-                    $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                    $productId = $item['product_id'];
+                    $variationId = $item['variation_id'] ?? 0;
+
+                    if ($variationId > 0) {
+                        $variation = wc_get_product($variationId);
+                        $productName = $variation ? $variation->get_name() : __('Unknown Variation', 'wc-licensed-product');
+                        if ($variation instanceof LicensedProductVariation) {
+                            $productName .= ' (' . $variation->get_license_duration_label() . ')';
+                        }
+                    } else {
+                        $product = wc_get_product($productId);
+                        $productName = $product ? $product->get_name() : __('Unknown Product', 'wc-licensed-product');
+                    }
                    ?>
                    <p style="margin: 5px 0 5px 15px;">
                        <em><?php echo esc_html($productName); ?>:</em><br>
--- a/src/Checkout/StoreApiExtension.php
+++ b/src/Checkout/StoreApiExtension.php
@@ -100,6 +100,9 @@ final class StoreApiExtension
                            'product_id' => [
                                'type' => 'integer',
                            ],
+                            'variation_id' => [
+                                'type' => 'integer',
+                            ],
                            'domains' => [
                                'type' => 'array',
                                'items' => [
@@ -162,6 +165,7 @@ final class StoreApiExtension
            }

            $productId = (int) $item['product_id'];
+            $variationId = isset($item['variation_id']) ? (int) $item['variation_id'] : 0;
            $domains = [];

            foreach ($item['domains'] as $domain) {
@@ -172,10 +176,17 @@ final class StoreApiExtension
            }

            if (!empty($domains)) {
-                $normalized[] = [
+                $entry = [
                    'product_id' => $productId,
                    'domains' => $domains,
                ];
+
+                // Include variation_id if present
+                if ($variationId > 0) {
+                    $entry['variation_id'] = $variationId;
+                }
+
+                $normalized[] = $entry;
            }
        }

@@ -267,10 +278,23 @@ final class StoreApiExtension
        // Check for licensed_domains in classic format (from DOM injection)
        if (empty($domainData) && isset($requestData['licensed_domains']) && is_array($requestData['licensed_domains'])) {
            $domainData = [];
-            foreach ($requestData['licensed_domains'] as $productId => $domains) {
+            $variationIds = $requestData['licensed_variation_ids'] ?? [];
+
+            foreach ($requestData['licensed_domains'] as $key => $domains) {
                if (!is_array($domains)) {
                    continue;
                }
+
+                // Parse key - could be "productId" or "productId_variationId"
+                $parts = explode('_', (string) $key);
+                $productId = (int) $parts[0];
+                $variationId = isset($parts[1]) ? (int) $parts[1] : 0;
+
+                // Also check for hidden variation ID field
+                if ($variationId === 0 && isset($variationIds[$key])) {
+                    $variationId = (int) $variationIds[$key];
+                }
+
                $normalizedDomains = [];
                foreach ($domains as $domain) {
                    $sanitized = sanitize_text_field($domain);
@@ -279,10 +303,16 @@ final class StoreApiExtension
                    }
                }
                if (!empty($normalizedDomains)) {
-                    $domainData[] = [
-                        'product_id' => (int) $productId,
+                    $entry = [
+                        'product_id' => $productId,
                        'domains' => $normalizedDomains,
                    ];
+
+                    if ($variationId > 0) {
+                        $entry['variation_id'] = $variationId;
+                    }
+
+                    $domainData[] = $entry;
                }
            }
        }
--- a/src/Frontend/AccountController.php
+++ b/src/Frontend/AccountController.php
@@ -9,6 +9,7 @@ declare(strict_types=1);

 namespace Jeremias\WcLicensedProduct\Frontend;

+use Jeremias\WcLicensedProduct\Api\ResponseSigner;
 use Jeremias\WcLicensedProduct\License\LicenseManager;
 use Jeremias\WcLicensedProduct\Product\VersionManager;
 use Twig\Environment;
@@ -114,6 +115,7 @@ final class AccountController
            echo $this->twig->render('frontend/licenses.html.twig', [
                'packages' => $packages,
                'has_packages' => !empty($packages),
+                'signing_enabled' => ResponseSigner::isSigningEnabled(),
            ]);
        } catch (\Exception $e) {
            // Fallback to PHP template if Twig fails
@@ -161,6 +163,7 @@ final class AccountController
                'status' => $license->getStatus(),
                'expires_at' => $license->getExpiresAt(),
                'is_transferable' => in_array($license->getStatus(), ['active', 'inactive'], true),
+                'customer_secret' => ResponseSigner::getCustomerSecretForLicense($license->getLicenseKey()),
            ];

            // Track if package has at least one active license
--- a/src/License/LicenseManager.php
+++ b/src/License/LicenseManager.php
@@ -11,12 +11,43 @@ namespace Jeremias\WcLicensedProduct\License;

 use Jeremias\WcLicensedProduct\Installer;
 use Jeremias\WcLicensedProduct\Product\LicensedProduct;
+use Jeremias\WcLicensedProduct\Product\LicensedProductVariation;
+use Jeremias\WcLicensedProduct\Product\LicensedVariableProduct;

 /**
 * Manages license operations (CRUD, validation, generation)
 */
 class LicenseManager
 {
+    /**
+     * Check if a product is any type of licensed product
+     *
+     * @param \WC_Product $product Product to check
+     * @return bool True if product is licensed (simple or variable or variation)
+     */
+    public function isLicensedProduct(\WC_Product $product): bool
+    {
+        // Simple licensed product
+        if ($product->is_type('licensed')) {
+            return true;
+        }
+
+        // Variable licensed product
+        if ($product->is_type('licensed-variable')) {
+            return true;
+        }
+
+        // Variation of a licensed-variable product
+        if ($product->is_type('variation') && $product->get_parent_id()) {
+            $parent = wc_get_product($product->get_parent_id());
+            if ($parent && $parent->is_type('licensed-variable')) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
    /**
     * Generate a unique license key
     */
@@ -40,32 +71,63 @@ class LicenseManager

    /**
     * Generate a license for a completed order
+     *
+     * @param int $orderId Order ID
+     * @param int $productId Product ID (parent product for variations)
+     * @param int $customerId Customer ID
+     * @param string $domain Domain to bind the license to
+     * @param int|null $variationId Optional variation ID for variable licensed products
+     * @return License|null Generated license or null on failure
     */
    public function generateLicense(
        int $orderId,
        int $productId,
        int $customerId,
-        string $domain
+        string $domain,
+        ?int $variationId = null
    ): ?License {
        global $wpdb;

        // Normalize domain first for duplicate detection
        $normalizedDomain = $this->normalizeDomain($domain);

-        // Check if license already exists for this order, product, and domain
-        $existing = $this->getLicenseByOrderProductAndDomain($orderId, $productId, $normalizedDomain);
+        // Check if license already exists for this order, product, domain, and variation
+        $existing = $this->getLicenseByOrderProductDomainAndVariation($orderId, $productId, $normalizedDomain, $variationId);
        if ($existing) {
            return $existing;
        }

-        $product = wc_get_product($productId);
-        if (!$product || !$product->is_type('licensed')) {
-            return null;
+        // Load the product that has the license settings
+        // For variations, load the variation; otherwise load the parent product
+        if ($variationId) {
+            $settingsProduct = wc_get_product($variationId);
+            $parentProduct = wc_get_product($productId);
+
+            // Verify parent is licensed-variable
+            if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+                return null;
+            }
+
+            // Ensure we have the proper variation class
+            if ($settingsProduct && !$settingsProduct instanceof LicensedProductVariation) {
+                $settingsProduct = new LicensedProductVariation($variationId);
+            }
+        } else {
+            $settingsProduct = wc_get_product($productId);
+
+            // Check if this is a licensed product (simple)
+            if (!$settingsProduct || !$settingsProduct->is_type('licensed')) {
+                return null;
+            }
+
+            // Ensure we have the LicensedProduct instance for type hints
+            if (!$settingsProduct instanceof LicensedProduct) {
+                $settingsProduct = new LicensedProduct($productId);
+            }
        }

-        // Ensure we have the LicensedProduct instance for type hints
-        if (!$product instanceof LicensedProduct) {
-            $product = new LicensedProduct($productId);
+        if (!$settingsProduct) {
+            return null;
        }

        // Generate unique license key
@@ -74,16 +136,16 @@ class LicenseManager
            $licenseKey = $this->generateLicenseKey();
        }

-        // Calculate expiration date
+        // Calculate expiration date from the settings product (variation or parent)
        $expiresAt = null;
-        $validityDays = $product->get_validity_days();
+        $validityDays = $settingsProduct->get_validity_days();
        if ($validityDays !== null && $validityDays > 0) {
            $expiresAt = (new \DateTimeImmutable())->modify("+{$validityDays} days")->format('Y-m-d H:i:s');
        }

-        // Determine version ID if bound to version
+        // Determine version ID if bound to version (always use parent product ID for versions)
        $versionId = null;
-        if ($product->is_bound_to_version()) {
+        if ($settingsProduct->is_bound_to_version()) {
            $versionId = $this->getCurrentVersionId($productId);
        }

@@ -99,7 +161,7 @@ class LicenseManager
                'version_id' => $versionId,
                'status' => License::STATUS_ACTIVE,
                'activations_count' => 1,
-                'max_activations' => $product->get_max_activations(),
+                'max_activations' => $settingsProduct->get_max_activations(),
                'expires_at' => $expiresAt,
            ],
            ['%s', '%d', '%d', '%d', '%s', '%d', '%s', '%d', '%d', '%s']
@@ -112,6 +174,16 @@ class LicenseManager
        return $this->getLicenseById((int) $wpdb->insert_id);
    }

+    /**
+     * Get license by order, product, domain, and optional variation
+     */
+    public function getLicenseByOrderProductDomainAndVariation(int $orderId, int $productId, string $domain, ?int $variationId = null): ?License
+    {
+        // For now, just use the existing method since we don't store variation_id in licenses table yet
+        // In the future, we could add a variation_id column to the licenses table
+        return $this->getLicenseByOrderProductAndDomain($orderId, $productId, $domain);
+    }
+
    /**
     * Get license by ID
     */
--- a/src/Plugin.php
+++ b/src/Plugin.php
@@ -227,23 +227,35 @@ final class Plugin
        $orderId = $order->get_id();
        $customerId = $order->get_customer_id();

-        // Index domains by product ID for quick lookup
+        // Index domains by product ID (and variation ID for variable products)
        $domainsByProduct = [];
        foreach ($domainData as $item) {
            if (isset($item['product_id']) && isset($item['domains']) && is_array($item['domains'])) {
-                $domainsByProduct[(int) $item['product_id']] = $item['domains'];
+                $productId = (int) $item['product_id'];
+                $variationId = isset($item['variation_id']) ? (int) $item['variation_id'] : 0;
+                $key = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+                $domainsByProduct[$key] = [
+                    'domains' => $item['domains'],
+                    'variation_id' => $variationId,
+                ];
            }
        }

        // Generate licenses for each licensed product
        foreach ($order->get_items() as $item) {
            $product = $item->get_product();
-            if (!$product || !$product->is_type('licensed')) {
+            if (!$product || !$this->licenseManager->isLicensedProduct($product)) {
                continue;
            }

-            $productId = $product->get_id();
-            $domains = $domainsByProduct[$productId] ?? [];
+            // Get the parent product ID (for variations, this is the main product)
+            $productId = $product->is_type('variation') ? $product->get_parent_id() : $product->get_id();
+            $variationId = $item->get_variation_id();
+
+            // Look up domains - first try with variation, then without
+            $key = $variationId > 0 ? "{$productId}_{$variationId}" : (string) $productId;
+            $domainInfo = $domainsByProduct[$key] ?? $domainsByProduct[(string) $productId] ?? null;
+            $domains = $domainInfo['domains'] ?? [];

            // Generate a license for each domain
            foreach ($domains as $domain) {
@@ -252,7 +264,8 @@ final class Plugin
                        $orderId,
                        $productId,
                        $customerId,
-                        $domain
+                        $domain,
+                        $variationId > 0 ? $variationId : null
                    );
                }
            }
@@ -271,12 +284,17 @@ final class Plugin

        foreach ($order->get_items() as $item) {
            $product = $item->get_product();
-            if ($product && $product->is_type('licensed')) {
+            if ($product && $this->licenseManager->isLicensedProduct($product)) {
+                // Get the parent product ID (for variations, this is the main product)
+                $productId = $product->is_type('variation') ? $product->get_parent_id() : $product->get_id();
+                $variationId = $item->get_variation_id();
+
                $this->licenseManager->generateLicense(
                    $order->get_id(),
-                    $product->get_id(),
+                    $productId,
                    $order->get_customer_id(),
-                    $domain
+                    $domain,
+                    $variationId > 0 ? $variationId : null
                );
            }
        }
--- a/src/Product/LicensedProductType.php
+++ b/src/Product/LicensedProductType.php
@@ -12,7 +12,8 @@ namespace Jeremias\WcLicensedProduct\Product;
 use Jeremias\WcLicensedProduct\Admin\SettingsController;

 /**
- * Registers and handles the Licensed product type for WooCommerce
+ * Registers and handles the Licensed product types for WooCommerce
+ * Supports both simple licensed products and variable licensed products
 */
 final class LicensedProductType
 {
@@ -29,7 +30,7 @@ final class LicensedProductType
     */
    private function registerHooks(): void
    {
-        // Register product type
+        // Register product types
        add_filter('product_type_selector', [$this, 'addProductType']);
        add_filter('woocommerce_product_class', [$this, 'getProductClass'], 10, 2);

@@ -39,9 +40,11 @@ final class LicensedProductType

        // Save product meta
        add_action('woocommerce_process_product_meta_licensed', [$this, 'saveProductMeta']);
+        add_action('woocommerce_process_product_meta_licensed-variable', [$this, 'saveProductMeta']);

        // Show price and add to cart for licensed products
        add_action('woocommerce_licensed_add_to_cart', [$this, 'addToCartTemplate']);
+        add_action('woocommerce_licensed-variable_add_to_cart', [$this, 'variableAddToCartTemplate']);

        // Make product virtual by default
        add_filter('woocommerce_product_is_virtual', [$this, 'isVirtual'], 10, 2);
@@ -51,25 +54,48 @@ final class LicensedProductType

        // Enqueue frontend CSS for licensed products on single product pages
        add_action('wp_enqueue_scripts', [$this, 'enqueueFrontendStyles']);
+
+        // Variable product support - variation settings
+        add_action('woocommerce_variation_options', [$this, 'addVariationOptions'], 10, 3);
+        add_action('woocommerce_product_after_variable_attributes', [$this, 'addVariationFields'], 10, 3);
+        add_action('woocommerce_save_product_variation', [$this, 'saveVariationFields'], 10, 2);
+
+        // Admin scripts for licensed-variable type
+        add_action('admin_footer', [$this, 'addVariableProductScripts']);
    }

    /**
-     * Add product type to selector
+     * Add product types to selector
     */
    public function addProductType(array $types): array
    {
        $types['licensed'] = __('Licensed Product', 'wc-licensed-product');
+        $types['licensed-variable'] = __('Licensed Variable Product', 'wc-licensed-product');
        return $types;
    }

    /**
-     * Get product class for licensed type
+     * Get product class for licensed types
     */
    public function getProductClass(string $className, string $productType): string
    {
        if ($productType === 'licensed') {
            return LicensedProduct::class;
        }
+        if ($productType === 'licensed-variable') {
+            return LicensedVariableProduct::class;
+        }
+        // Handle variations of licensed-variable products
+        if ($productType === 'variation') {
+            // Check if parent is licensed-variable
+            global $post;
+            if ($post && $post->post_parent) {
+                $parentType = \WC_Product_Factory::get_product_type($post->post_parent);
+                if ($parentType === 'licensed-variable') {
+                    return LicensedProductVariation::class;
+                }
+            }
+        }
        return $className;
    }

@@ -81,7 +107,7 @@ final class LicensedProductType
        $tabs['licensed_product'] = [
            'label' => __('License Settings', 'wc-licensed-product'),
            'target' => 'licensed_product_data',
-            'class' => ['show_if_licensed'],
+            'class' => ['show_if_licensed', 'show_if_licensed-variable'],
            'priority' => 21,
        ];
        return $tabs;
@@ -236,9 +262,16 @@ final class LicensedProductType
     */
    public function isVirtual(bool $isVirtual, \WC_Product $product): bool
    {
-        if ($product->is_type('licensed')) {
+        if ($product->is_type('licensed') || $product->is_type('licensed-variable')) {
            return true;
        }
+        // Also handle variations of licensed-variable products
+        if ($product->is_type('variation') && $product->get_parent_id()) {
+            $parent = wc_get_product($product->get_parent_id());
+            if ($parent && $parent->is_type('licensed-variable')) {
+                return true;
+            }
+        }
        return $isVirtual;
    }

@@ -253,7 +286,7 @@ final class LicensedProductType

        global $product;

-        if (!$product || !$product->is_type('licensed')) {
+        if (!$product || (!$product->is_type('licensed') && !$product->is_type('licensed-variable'))) {
            return;
        }

@@ -272,11 +305,11 @@ final class LicensedProductType
    {
        global $product;

-        if (!$product || !$product->is_type('licensed')) {
+        if (!$product || (!$product->is_type('licensed') && !$product->is_type('licensed-variable'))) {
            return;
        }

-        /** @var LicensedProduct $product */
+        /** @var LicensedProduct|LicensedVariableProduct $product */
        $version = $product->get_current_version();

        if (empty($version)) {
@@ -289,4 +322,200 @@ final class LicensedProductType
            esc_html($version)
        );
    }
+
+    /**
+     * Add to cart template for variable licensed products
+     */
+    public function variableAddToCartTemplate(): void
+    {
+        wc_get_template('single-product/add-to-cart/variable.php');
+    }
+
+    /**
+     * Add variation options (checkboxes next to variation header)
+     */
+    public function addVariationOptions(int $loop, array $variationData, \WP_Post $variation): void
+    {
+        // Check if parent is licensed-variable
+        $parentId = $variation->post_parent;
+        $parentProduct = wc_get_product($parentId);
+
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        $isVirtual = get_post_meta($variation->ID, '_virtual', true);
+        ?>
+        <label class="tips" data-tip="<?php esc_attr_e('Licensed products are always virtual', 'wc-licensed-product'); ?>">
+            <input type="checkbox" class="checkbox" disabled checked />
+            <?php esc_html_e('Virtual', 'wc-licensed-product'); ?>
+        </label>
+        <?php
+    }
+
+    /**
+     * Add variation fields for license settings
+     */
+    public function addVariationFields(int $loop, array $variationData, \WP_Post $variation): void
+    {
+        // Check if parent is licensed-variable
+        $parentId = $variation->post_parent;
+        $parentProduct = wc_get_product($parentId);
+
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        // Get variation values
+        $validityDays = get_post_meta($variation->ID, '_licensed_validity_days', true);
+        $maxActivations = get_post_meta($variation->ID, '_licensed_max_activations', true);
+
+        // Get parent defaults for placeholder
+        $parentValidityDays = $parentProduct->get_validity_days();
+        $parentMaxActivations = $parentProduct->get_max_activations();
+
+        $parentValidityDisplay = $parentValidityDays !== null
+            ? sprintf(__('%d days', 'wc-licensed-product'), $parentValidityDays)
+            : __('Lifetime', 'wc-licensed-product');
+
+        ?>
+        <div class="wclp-variation-license-settings">
+            <p class="form-row form-row-first">
+                <label><?php esc_html_e('License Duration (Days)', 'wc-licensed-product'); ?></label>
+                <input type="number"
+                       name="wclp_validity_days[<?php echo esc_attr($loop); ?>]"
+                       class="short"
+                       min="0"
+                       step="1"
+                       placeholder="<?php echo esc_attr($parentValidityDisplay); ?>"
+                       value="<?php echo esc_attr($validityDays); ?>"
+                />
+                <span class="description"><?php esc_html_e('Leave empty for parent default. 0 = Lifetime.', 'wc-licensed-product'); ?></span>
+            </p>
+            <p class="form-row form-row-last">
+                <label><?php esc_html_e('Max Activations', 'wc-licensed-product'); ?></label>
+                <input type="number"
+                       name="wclp_max_activations[<?php echo esc_attr($loop); ?>]"
+                       class="short"
+                       min="1"
+                       step="1"
+                       placeholder="<?php echo esc_attr($parentMaxActivations); ?>"
+                       value="<?php echo esc_attr($maxActivations); ?>"
+                />
+                <span class="description"><?php esc_html_e('Leave empty for parent default.', 'wc-licensed-product'); ?></span>
+            </p>
+        </div>
+        <style>
+            .wclp-variation-license-settings {
+                background: #f8f8f8;
+                border: 1px solid #e5e5e5;
+                padding: 10px;
+                margin: 10px 0;
+                border-radius: 4px;
+            }
+            .wclp-variation-license-settings .description {
+                display: block;
+                font-style: italic;
+                color: #666;
+                margin-top: 4px;
+            }
+        </style>
+        <?php
+    }
+
+    /**
+     * Save variation fields
+     */
+    public function saveVariationFields(int $variationId, int $loop): void
+    {
+        // Check if parent is licensed-variable
+        $variation = wc_get_product($variationId);
+        if (!$variation) {
+            return;
+        }
+
+        $parentProduct = wc_get_product($variation->get_parent_id());
+        if (!$parentProduct || !$parentProduct->is_type('licensed-variable')) {
+            return;
+        }
+
+        // Save validity days
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce is verified by WooCommerce
+        if (isset($_POST['wclp_validity_days'][$loop])) {
+            // phpcs:ignore WordPress.Security.NonceVerification.Missing
+            $validityDays = sanitize_text_field($_POST['wclp_validity_days'][$loop]);
+            if ($validityDays !== '') {
+                update_post_meta($variationId, '_licensed_validity_days', absint($validityDays));
+            } else {
+                delete_post_meta($variationId, '_licensed_validity_days');
+            }
+        }
+
+        // Save max activations
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing
+        if (isset($_POST['wclp_max_activations'][$loop])) {
+            // phpcs:ignore WordPress.Security.NonceVerification.Missing
+            $maxActivations = sanitize_text_field($_POST['wclp_max_activations'][$loop]);
+            if ($maxActivations !== '') {
+                update_post_meta($variationId, '_licensed_max_activations', absint($maxActivations));
+            } else {
+                delete_post_meta($variationId, '_licensed_max_activations');
+            }
+        }
+
+        // Set variation as virtual (licensed products are always virtual)
+        update_post_meta($variationId, '_virtual', 'yes');
+    }
+
+    /**
+     * Add JavaScript for licensed-variable product type in admin
+     */
+    public function addVariableProductScripts(): void
+    {
+        global $post, $pagenow;
+
+        if ($pagenow !== 'post.php' && $pagenow !== 'post-new.php') {
+            return;
+        }
+
+        if (!$post || get_post_type($post) !== 'product') {
+            return;
+        }
+
+        ?>
+        <script type="text/javascript">
+            jQuery(document).ready(function($) {
+                // Show/hide panels based on product type
+                function toggleLicensedVariableOptions() {
+                    var productType = $('#product-type').val();
+
+                    if (productType === 'licensed-variable') {
+                        // Show variable product options
+                        $('.show_if_variable').show();
+                        $('.hide_if_variable').hide();
+
+                        // Show licensed product options
+                        $('.show_if_licensed-variable').show();
+                        $('.show_if_licensed').show();
+
+                        // Show general and variations tabs
+                        $('.general_tab').show();
+                        $('.variations_tab').show();
+
+                        // Hide shipping tab (virtual products)
+                        $('.shipping_tab').hide();
+                    }
+                }
+
+                // Initial check
+                toggleLicensedVariableOptions();
+
+                // On product type change
+                $('#product-type').on('change', function() {
+                    toggleLicensedVariableOptions();
+                });
+            });
+        </script>
+        <?php
+    }
 }
--- a/src/Product/LicensedProductVariation.php
+++ b/src/Product/LicensedProductVariation.php
@@ -0,0 +1,196 @@
+<?php
+/**
+ * Licensed Product Variation Class
+ *
+ * @package Jeremias\WcLicensedProduct\Product
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Product;
+
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use WC_Product_Variation;
+
+/**
+ * Licensed Product Variation type extending WooCommerce Product Variation
+ *
+ * Each variation can have its own license duration settings.
+ */
+class LicensedProductVariation extends WC_Product_Variation
+{
+    /**
+     * Constructor
+     */
+    public function __construct($product = 0)
+    {
+        parent::__construct($product);
+    }
+
+    /**
+     * Licensed products are always virtual
+     */
+    public function is_virtual(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get max activations for this variation
+     * Falls back to parent product, then to default settings
+     */
+    public function get_max_activations(): int
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_max_activations', true);
+        if ($value !== '' && $value !== null) {
+            return max(1, (int) $value);
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_max_activations')) {
+            return $parent->get_max_activations();
+        }
+
+        return SettingsController::getDefaultMaxActivations();
+    }
+
+    /**
+     * Check if variation has custom max activations set
+     */
+    public function has_custom_max_activations(): bool
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get validity days for this variation
+     * This is the primary license setting that varies per variation
+     * Falls back to parent product, then to default settings
+     */
+    public function get_validity_days(): ?int
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_validity_days', true);
+        if ($value !== '' && $value !== null) {
+            $days = (int) $value;
+            // 0 means lifetime
+            return $days > 0 ? $days : null;
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_validity_days')) {
+            return $parent->get_validity_days();
+        }
+
+        return SettingsController::getDefaultValidityDays();
+    }
+
+    /**
+     * Check if variation has custom validity days set
+     */
+    public function has_custom_validity_days(): bool
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Check if license should be bound to major version
+     * Falls back to parent product, then to default settings
+     */
+    public function is_bound_to_version(): bool
+    {
+        // Check variation-specific setting first
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        if ($value !== '' && $value !== null) {
+            return $value === 'yes';
+        }
+
+        // Fall back to parent product
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'is_bound_to_version')) {
+            return $parent->is_bound_to_version();
+        }
+
+        return SettingsController::getDefaultBindToVersion();
+    }
+
+    /**
+     * Check if variation has custom bind to version setting
+     */
+    public function has_custom_bind_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get the license duration label for display
+     */
+    public function get_license_duration_label(): string
+    {
+        $days = $this->get_validity_days();
+
+        if ($days === null) {
+            return __('Lifetime', 'wc-licensed-product');
+        }
+
+        if ($days === 30) {
+            return __('Monthly', 'wc-licensed-product');
+        }
+
+        if ($days === 90) {
+            return __('Quarterly', 'wc-licensed-product');
+        }
+
+        if ($days === 365) {
+            return __('Yearly', 'wc-licensed-product');
+        }
+
+        return sprintf(
+            /* translators: %d: number of days */
+            _n('%d day', '%d days', $days, 'wc-licensed-product'),
+            $days
+        );
+    }
+
+    /**
+     * Get current software version from parent product
+     */
+    public function get_current_version(): string
+    {
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_current_version')) {
+            return $parent->get_current_version();
+        }
+
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_parent_id());
+
+        return $latestVersion ? $latestVersion->getVersion() : '';
+    }
+
+    /**
+     * Get major version number from parent product
+     */
+    public function get_major_version(): int
+    {
+        $parent = wc_get_product($this->get_parent_id());
+        if ($parent && method_exists($parent, 'get_major_version')) {
+            return $parent->get_major_version();
+        }
+
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_parent_id());
+
+        if ($latestVersion) {
+            return $latestVersion->getMajorVersion();
+        }
+
+        return 1;
+    }
+}
--- a/src/Product/LicensedVariableProduct.php
+++ b/src/Product/LicensedVariableProduct.php
@@ -0,0 +1,151 @@
+<?php
+/**
+ * Licensed Variable Product Class
+ *
+ * @package Jeremias\WcLicensedProduct\Product
+ */
+
+declare(strict_types=1);
+
+namespace Jeremias\WcLicensedProduct\Product;
+
+use Jeremias\WcLicensedProduct\Admin\SettingsController;
+use WC_Product_Variable;
+
+/**
+ * Licensed Variable Product type extending WooCommerce Variable Product
+ *
+ * This allows selling license subscriptions with different durations
+ * (e.g., monthly, yearly, lifetime) as product variations.
+ */
+class LicensedVariableProduct extends WC_Product_Variable
+{
+    /**
+     * Product type
+     */
+    protected $product_type = 'licensed-variable';
+
+    /**
+     * Constructor
+     */
+    public function __construct($product = 0)
+    {
+        parent::__construct($product);
+    }
+
+    /**
+     * Get product type
+     */
+    public function get_type(): string
+    {
+        return 'licensed-variable';
+    }
+
+    /**
+     * Licensed products are always virtual
+     */
+    public function is_virtual(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Licensed products are purchasable
+     */
+    public function is_purchasable(): bool
+    {
+        return $this->exists() && $this->get_price() !== '';
+    }
+
+    /**
+     * Get max activations for this product (parent default)
+     * Falls back to default settings if not set on product
+     */
+    public function get_max_activations(): int
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        if ($value !== '' && $value !== null) {
+            return max(1, (int) $value);
+        }
+        return SettingsController::getDefaultMaxActivations();
+    }
+
+    /**
+     * Check if product has custom max activations set
+     */
+    public function has_custom_max_activations(): bool
+    {
+        $value = $this->get_meta('_licensed_max_activations', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get validity days (parent default - variations override this)
+     * Falls back to default settings if not set on product
+     */
+    public function get_validity_days(): ?int
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        if ($value !== '' && $value !== null) {
+            return (int) $value > 0 ? (int) $value : null;
+        }
+        return SettingsController::getDefaultValidityDays();
+    }
+
+    /**
+     * Check if product has custom validity days set
+     */
+    public function has_custom_validity_days(): bool
+    {
+        $value = $this->get_meta('_licensed_validity_days', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Check if license should be bound to major version
+     * Falls back to default settings if not set on product
+     */
+    public function is_bound_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        if ($value !== '' && $value !== null) {
+            return $value === 'yes';
+        }
+        return SettingsController::getDefaultBindToVersion();
+    }
+
+    /**
+     * Check if product has custom bind to version setting
+     */
+    public function has_custom_bind_to_version(): bool
+    {
+        $value = $this->get_meta('_licensed_bind_to_version', true);
+        return $value !== '' && $value !== null;
+    }
+
+    /**
+     * Get current software version (derived from latest product version)
+     */
+    public function get_current_version(): string
+    {
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_id());
+
+        return $latestVersion ? $latestVersion->getVersion() : '';
+    }
+
+    /**
+     * Get major version number from version string
+     */
+    public function get_major_version(): int
+    {
+        $versionManager = new VersionManager();
+        $latestVersion = $versionManager->getLatestVersion($this->get_id());
+
+        if ($latestVersion) {
+            return $latestVersion->getMajorVersion();
+        }
+
+        return 1;
+    }
+}
--- a/templates/frontend/licenses.html.twig
+++ b/templates/frontend/licenses.html.twig
@@ -65,6 +65,26 @@
                                    {% endif %}
                                </span>
                            </div>
+                            {% if signing_enabled and license.customer_secret %}
+                                <div class="license-row-secret">
+                                    <button type="button" class="secret-toggle" aria-expanded="false">
+                                        <span class="dashicons dashicons-lock"></span>
+                                        {{ __('API Verification Secret') }}
+                                        <span class="dashicons dashicons-arrow-down-alt2 toggle-arrow"></span>
+                                    </button>
+                                    <div class="secret-content" style="display: none;">
+                                        <p class="secret-description">
+                                            {{ __('Use this secret to verify signed API responses. Keep it secure.') }}
+                                        </p>
+                                        <div class="secret-value-wrapper">
+                                            <code class="secret-value">{{ esc_html(license.customer_secret) }}</code>
+                                            <button type="button" class="copy-secret-btn" data-secret="{{ esc_attr(license.customer_secret) }}" title="{{ __('Copy to clipboard') }}">
+                                                <span class="dashicons dashicons-clipboard"></span>
+                                            </button>
+                                        </div>
+                                    </div>
+                                </div>
+                            {% endif %}
                        </div>
                    {% endfor %}
                </div>
--- a/wc-licensed-product.php
+++ b/wc-licensed-product.php
@@ -3,7 +3,7 @@
 * Plugin Name: WooCommerce Licensed Product
 * Plugin URI: https://src.bundespruefstelle.ch/magdev/wc-licensed-product
 * Description: WooCommerce plugin to sell software products using license keys with domain-based validation.
- * Version: 0.5.1
+ * Version: 0.5.5
 * Author: Marco Graetsch
 * Author URI: https://src.bundespruefstelle.ch/magdev
 * License: GPL-2.0-or-later
@@ -28,7 +28,7 @@ if (!defined('ABSPATH')) {
 }

 // Plugin constants
-define('WC_LICENSED_PRODUCT_VERSION', '0.5.1');
+define('WC_LICENSED_PRODUCT_VERSION', '0.5.5');
 define('WC_LICENSED_PRODUCT_PLUGIN_FILE', __FILE__);
 define('WC_LICENSED_PRODUCT_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WC_LICENSED_PRODUCT_PLUGIN_URL', plugin_dir_url(__FILE__));
Author	SHA1	Message	Date
magdev	086755cb11	Update translations for v0.5.5 Regenerated .pot template and recompiled German translations. All 391 strings translated. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 17:07:36 +01:00
magdev	0b58de193e	Fix critical signature compatibility with client library (v0.5.5) CRITICAL: Key derivation now uses native hash_hkdf() for RFC 5869 compliance. Previous custom implementation was incompatible with the magdev/wc-licensed-product-client library. Changes: - ResponseSigner::deriveCustomerSecret() now uses hash_hkdf() - Added missing domain validation to /activate endpoint - Customer secrets will change after upgrade (breaking change) The signature algorithm now matches the client's ResponseSignature::deriveKey(): - IKM: server_secret - Length: 32 bytes - Info: license_key Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 17:06:18 +01:00
magdev	ae49b262fa	Update wc-licensed-product-client dependency Updated magdev/wc-licensed-product-client from 64d215c to 5e4b5a9. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 17:02:03 +01:00
magdev	5d5bb7e595	Align REST API with client documentation (v0.5.4) Fixed HTTP status codes for API responses: - /validate now returns 404 for license_not_found (was 403) - Added status code mapping: 404 not found, 500 server errors, 403 others Added configurable rate limiting: - WC_LICENSE_RATE_LIMIT constant for requests per window - WC_LICENSE_RATE_WINDOW constant for window duration in seconds Fixed license_key validation: - Now enforces minimum 8 characters across all endpoints Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 17:00:52 +01:00
magdev	bee9854c18	Add release package v0.5.3 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 16:15:51 +01:00
magdev	c31df1e8c4	Add licensed variable product support for duration-based licenses (v0.5.3) Customers can now purchase licenses with different durations (monthly, yearly, lifetime) through WooCommerce product variations. Each variation can have its own license validity settings. New features: - LicensedVariableProduct class for variable licensed products - LicensedProductVariation class for individual variations - Per-variation license duration and max activations settings - Duration labels in checkout (Monthly, Quarterly, Yearly, etc.) - Full support for WooCommerce Blocks checkout with variations - Updated translations for German (de_CH) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 16:14:15 +01:00
magdev	8cac742f57	Update CLAUDE.md with v0.5.2 session history Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 15:36:35 +01:00
magdev	41e46fc7b8	Bump version to 0.5.2 and update changelog Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 15:31:53 +01:00
magdev	549a58dc5d	Add per-license customer secrets for API response verification - Add static methods to ResponseSigner for deriving customer-specific secrets - Display "API Verification Secret" in customer account licenses page - Add collapsible secret section with copy button - Update server-implementation.md with per-license secret documentation - Update translations with new strings Each customer now gets a unique verification secret derived from their license key, eliminating the need to share the master server secret. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 15:29:57 +01:00
magdev	7d02105284	Update CLAUDE.md with v0.5.1 session history Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 15:20:35 +01:00
				`@@ -0,0 +1 @@`
				`bbd0fa8888c6990a4ba00ccfb8b2189ee6ac529a34cc11a5d8d8d28518b1f6dd wc-licensed-product-0.5.3.zip`