How we test promo codes with a checkout bot that is not allowed to pay

Coupon pages often fail to reveal whether their codes have been tested. Kuponaut, a website dedicated to discount codes for AI and SaaS tools, provides a label indicating the method used to verify each code. More than a hundred codes have passed this test, with the date of the test listed for each. Automating this process manually is unsustainable, so in November 2026, they introduced a test bot to share some of the workload.

This report focuses on the rules governing the bot's actions and the lessons learned from its mistakes, without delving into the specifics of the code itself.

The bot's task is straightforward: mimic a human's actions on a brand's pricing page. It selects a paid plan the code is intended for, navigates to the checkout page (such as Paddle, Stripe, FastSpring, or Chargebee), enters the code into the coupon field, and saves screenshots of the totals before and after the code is applied.

However, the bot is also programmed with strict limitations on what it can and cannot do. It must never enter card details, email addresses, or passwords, never press payment or subscription buttons, and must stop immediately if it encounters a CAPTCHA. Additionally, the bot avoids checkouts that introduce a one-click wallet step before the coupon field.

Brands that require an account usage necessitate the bot using an already-opened session in a separate browser profile, and it immediately stops if that account has a saved payment method associated. If a step is not on the approved list, the bot halts and reports the point of failure. A failed test provides valuable insight, signaling which checkout requires human intervention.

Initially, the bot reported several of Kuponaut's own codes as rejected. Upon manual testing, these codes were found to be valid. The issue stemmed from the bot testing from an account that had previously interacted with the site, resulting in a pre-existing session. Codes issued for new customers only were being blocked due to this session. Therefore, "rejected" is no longer an automatic outcome; instead, such codes are flagged for manual re-testing by a human.

Another mistake involved the bot's country-based testing. Conducted from Turkey, the bot sometimes encountered local price lists in Turkish lira, causing certain partner codes to be denied even though they were valid for the dollar version of the store. Now, each test result includes the country, currency, and specific plan alongside the test date. Kuponaut ensures that every code page specifies the exact day, plan, and country the test applies to, urging readers to verify the final total on their own order.

Furthermore, the bot's screenshots were initially too broad, capturing full-page content that was hard to interpret and included irrelevant information. The bot now focuses on capturing only the order summary, displaying the plan, the applied code, and the totals before and after, with no extraneous details.

The bot was also programmed not to automate the discovery of codes from search result pages, as scraping search results is not permitted by search engine terms. Additionally, the bot does not publish results automatically; a human reviews and decides what content to include on the site. Failed tests restart the re-testing process rather than causing automatic removal of codes. Similarly, any API outages or flaky checkouts should not result in the sudden disappearance of codes from the site.

Through the bot's first run on November 6, 2026, Kuponaut accepted codes from three brands and flagged several others for further manual verification. These accepted codes have since been documented with dated screenshots behind them, and every rejection comes with a clear explanation and subsequent actions. This approach ensures that every verified code on the site is supported by concrete evidence, and any unsuccessful tests are systematically addressed.

For those looking to implement a similar system, the key lesson is to begin with a list of actions the bot should never perform. While automating the application of codes is relatively simple, determining when the bot must halt and require human intervention is the true challenge. The comprehensive set of labels and the dated list of all codes applied at checkout can be found in the original report.