A discount used to be something you could hold. Asa Candler, who gained sole ownership of Coca-Cola in 1891, promoted the drink by handing out thousands of coupons for a complimentary glass. Canadian Tire introduced its own paper coupons at its gas bars in 1958, moved them onto genuine bank-note paper in 1961 and still prints them with anti-counterfeiting technology. The company says it has produced more than a billion of those notes.
Paper carried its rules on its face, and a cashier enforced them. A promo code carries none. It is a short string typed into a checkout box, and every rule about it (who may use it, how often, on which order and until when) lives in the merchant’s software. That shift made discounts cheap to issue and easy to measure, and it made them just as easy to copy, guess and abuse. In 2026 the string can also reach a merchant from an AI agent shopping on someone’s behalf, through an API call instead of a text box.
A code is only a pointer
Stripe’s billing documentation keeps two things apart. A coupon is the object that holds the discount logic. A promotion code is the customer-facing string that maps to it, and many strings can point at one coupon: Stripe’s own example has FALLPROMO and SPRINGPROMO both leading to the same 25 per cent off. Stripe also refuses to let two active codes that any customer can redeem share the same text.
Splitting the two gives a store control without touching the price. Marketing can mint a new string for each newsletter or creator campaign, then switch one off while the others keep working. In Stripe’s model, restrictions are checked at redemption time, and deleting a coupon stops new redemptions without clawing back discounts already granted. The string is disposable. The rule behind it is the asset.
One string for everyone, or one for each customer
A shared code is a single entry with a counter beside it. Everyone types the same word, the store caps total uses and perhaps allows one per person, and the code travels as far as the campaign that carries it. That reach is the point and the weakness: once a shared code leaves its newsletter, the store can no longer tell who was meant to have it.
A unique code makes the opposite trade. The store generates thousands of strings, each tied to one use or one customer, and must deliver them all. Shopify sets a cumulative limit of 20,000,000 unique discount codes per store, and the WooCommerce team built its random code generator to leave out characters that are ambiguous or hard to read.
Douglas Crockford’s Base 32 notation, built for strings that people and computers exchange, does the same. It drops I and L, which read as 1, O, which reads as 0, and U, to avoid accidental obscenities, leaving 32 symbols that each carry five bits. Eight of those symbols give 2 to the 40th power, about 1.1 trillion possible codes. With 10,000 codes live, a random guess hits one roughly once in 110 million tries. A shared vanity word has no protection of that kind, so its safety rests on the caps and rules attached to it.
What the server checks after you press Apply
Typing a code starts a short chain of tests. The platform normalizes the string, usually ignoring case (WooCommerce’s documentation says SAVE10 and save10 both work), finds the matching record and tests it against a date window, usage caps, the shopper’s eligibility and the cart itself. The three platforms below expose similar switches.
|
Platform |
Where the shopper uses the code |
End date |
Cap on total uses |
Per-customer control |
Order floor |
|
Stripe |
Typed at checkout, or in the customer portal when enabled |
Optional date and time, never later than the coupon’s |
Maximum number of redemptions |
One named customer, or first-time buyers only |
Minimum order value |
|
Shopify |
Typed at checkout, or applied from a shareable link or QR code |
Optional end date and time in the store’s time zone |
Total number of uses |
One use per customer, tracked by email or phone |
Minimum purchase amount or item count |
|
WooCommerce |
Typed on the cart or checkout page |
Optional expiry date |
Usage limit per coupon |
Usage limit per user, plus allowed billing emails |
Minimum spend, counted as subtotal plus tax |
Eligibility rules can be stricter than they look. Stripe’s first-time-order setting turns away any customer who already has transaction history with that business, even one who started a payment that never completed or began a trial and cancelled it. Shopify enforces one use per customer by tracking an email address or phone number, so that limit is only as strong as the identifiers behind it. WooCommerce shows the shopper an error explaining why a coupon can’t be applied, for instance because it has expired.
The last step is the delicate one: recording the use. Shopify holds a code against its usage limit from the moment an order is submitted until the payment completes or fails, and a declined payment releases the hold. Getting that step wrong has a name in security research.
PortSwigger’s guide to race conditions uses a one-time promo code as its example. The server checks that the code is unused, applies the discount and only then records the use, so requests that land in the gap, often just milliseconds wide, can each claim the discount. PortSwigger’s single-packet technique, first shown at Black Hat USA 2023, uses one TCP packet to complete 20 to 30 requests at once, so all of them land inside that gap.
Codes that travel get harvested and guessed
Browser extensions hunt for codes and apply them at checkout, and the business behind them is large: when PayPal completed its purchase of Honey in January 2020, for about 4 billion US dollars in cash, the company behind the extension counted roughly 17 million monthly active users.
Google now polices how such tools earn money. Since June 10, 2025, its Chrome Web Store has required a user action before an extension applies any affiliate link, code or cookie, and it bars a coupon finder from inserting an affiliate link when it finds no coupon or discount.
Guessing is the other threat. OWASP’s catalogue of automated attacks on web applications gives it an entry, OAT-002 Token Cracking, defined as the mass enumeration of coupon numbers, voucher codes and discount tokens. A predictable code also invites the shortcut behind password spraying: try a few common choices across many targets, because plenty of people still pick easy ones.
Stripe’s documentation gives merchants two blunt options for codes they don’t want shared: put limits on the promotion code, or skip it and apply the discount directly, which leaves nothing to pass around or guess.
Casino bonus codes run on the same machinery
Online casino welcome offers test the mechanics above harder than any store checkout, because they use nearly all of them at once and attach real money to every check. Plenty of packages hang on one shared string that every new player enters, the broadcast trade from the shared-code section.
Some multi-deposit packages go the other way, needing a different code for each deposit and dropping the bonus on any deposit made without it, so the validation chain becomes a sequence that has to be followed in order. The per-customer limit is stricter than a store’s too: it rests on the account’s verified identity rather than an email address. The code usually goes into a field in the cashier, at the moment of the deposit it belongs to.
British Columbia’s provincial site shows how strict the ordering can be. PlayNow’s current casino welcome offer starts at sign-up: a new player selects it while registering, then makes a first deposit and meets a spend requirement before the bonus token arrives. A player who already has an account but has never deposited must enter the offer’s code under My Promotions instead, and because the steps count only in order, it has to go in before that first deposit. The code lapses when the promotion period ends next March, and the token waits while an account’s validation is pending.
Ontario and Alberta also decide where a code may appear at all. Ontario’s regulator treats the display of promotional codes as indirect advertising of inducements, so operators in its regulated market can show them only on their own sites and apps or send them to players who opted in. Alberta’s standards, issued before that province’s regulated market opened on July 13, 2026, confine bonus advertising to the same two channels.
Because every check described earlier runs on the operator’s side at the moment of redemption, no explainer can settle which codes work this week. A casino can change or pull an offer without notice, codes expire, and some deadlines run as short as 24 hours. The only proof that a code still works is the one the platforms use themselves: a successful redemption. A list of codes is only as useful as that test.
In provinces where it can show them, BonusFinder Canada’s codes page covers casino no deposit bonus codes alongside deposit codes, with each code in a yellow box under its offer and, for some multi-deposit packages, the code for each deposit. Its team says it redeems codes before listing them and rechecks them on a rolling basis, updating or removing any that stop working, expire or get swapped out. The site says it shows visitors from Ontario licensed casinos only, because local regulations leave it unable to promote casino bonuses there.
A code alters the offer, never the odds, and bonus money usually has to be wagered before its winnings can be withdrawn. Only adults may play: at least 19 in British Columbia and Ontario, at least 18 in Alberta. If a code starts to feel like a reason to keep depositing, stop. Each province named here has a line open around the clock: 1-888-795-6111 connects British Columbians with the Gambling Support BC Line, 1-866-531-2600 connects Ontarians with ConnexOntario, and 1-866-332-2322 connects Albertans with Alberta’s 24/7 Addiction Helpline, where problem gambling is part of the brief.
Discounts nobody has to type
Shopify, for one, lets a store discount without anyone typing a code. Its automatic discounts apply themselves in the cart and at checkout once a shopper meets the conditions, with up to 25 active per store. Its shareable links and QR codes carry the code inside the URL and attach the discount to the shopper’s next checkout cart, so the string still exists but nobody types it.
Loyalty programs go a step further and hang the discount on an identity. Canadian Tire’s paper coupons from 1958 now have a digital counterpart: Triangle Rewards members scan a card at checkout, and the company said in January 2026 that nearly 12 million members collect and redeem Canadian Tire Money across most of its banners. The account, not a string, carries the rules.
The Agentic Commerce Protocol, an open standard that OpenAI and Stripe released in September 2025 so that AI agents can complete purchases for people, added a discount extension in its January 30, 2026 release, the first extension built on the protocol. An agent submits codes, and the merchant returns any it refuses with a reason from a fixed list, from an expired or invalid code to a usage limit already reached. In the project’s sample, one of two codes goes through and the other is rejected as expired.
The discount extension’s specification leaves coupon validation rules out of scope, so each merchant keeps its own. What an agent gets back is the verdict a shopper reads in a checkout error, in a form software can act on. If agents take on more of the shopping, those refusals may matter more than the codes.
