Menus
How to Make a Roblox Code Redeem GUI
A code redeem panel lets players type a promo or creator code and receive a reward. The interface is simple — a TextBox plus a redeem button — but the security is one-directional: the client only sends the code, and the server decides whether it is valid and grants the reward. This guide builds both sides in Luau.
Open the Code Redeem template →1. TextBox input and a redeem button
A TextBox collects the code, a TextButton fires the request. On click, read the box's text and send it to the server through a RemoteEvent.
local box = Instance.new("TextBox")
box.Size = UDim2.fromScale(1, 0.12)
box.PlaceholderText = "Enter code"
box.Parent = panel
local redeem = Instance.new("TextButton")
redeem.Size = UDim2.fromScale(1, 0.12)
redeem.Text = "REDEEM"
redeem.Parent = panel
local redeemEvent = game:GetService("ReplicatedStorage")
:WaitForChild("Remotes"):WaitForChild("RedeemCode")
redeem.Activated:Connect(function()
redeemEvent:FireServer(box.Text)
end)2. Validate codes on the server
Keep the list of valid codes and their rewards in a server Script. Normalize the incoming code (uppercase, no spaces), look it up, and ignore anything unknown. The client never sees the list.
local codes = {
LAUNCHDAY = { coins = 500 },
WELCOME = { item = "starter_crate" },
}
redeemEvent.OnServerEvent:Connect(function(player, raw)
local code = string.upper(tostring(raw):gsub("%s+", ""))
local reward = codes[code]
if not reward then return end -- invalid code: do nothing
grantReward(player, reward)
end)3. Send feedback to the player
After granting, fire a RemoteEvent (or return from a RemoteFunction) back to the client so the UI can show 'Reward claimed' or 'Invalid code'. Keep the reward logic on the server and the message on the client.
FAQ
Why must the server validate the code?
Clients can be modified by exploiters. If the client decided the reward, anyone could grant themselves anything. The server is the only source of truth for valid codes and granted rewards.
How do I expire or single-use codes?
Track redemption per player in a DataStore (or remove the code from the table after a global expiry). Check it server-side before granting.