Store the code online in a database (ideally hashed).
User sends a request to the database (AJAX) and if the code is found in the database and unused the user gets the reward and the code is marked as used. If the code is marked as used or not found, show an error.
That‘s the basic idea.