payback-coupon-activator

A small self-hosted daemon that activates every pending coupon in your Payback account once a day, and notifies you when it needs attention.

Unofficial project, not affiliated with PAYBACK GmbH. It drives the payback.de website with a headless browser. Payback can change the site at any time and break this tool. Use it at your own risk and check Payback's terms of use.

Built with heavy use of agentic coding. Most of this code was written by an AI coding agent, then reviewed and tested against the live payback.de site (October 2026, ~360 coupons activated). The cookie file gives full access to your account, so read the code before you run it.

How it works

1. You log in on payback.de in your normal browser and export the cookies to data/cookies.json.
2. Every day at RUN_AT, the daemon does the following:
   • loads those cookies into headless Chromium
   • opens https://www.payback.de/coupons
   • clicks every button in the "not activated" section, one at a time
   • reloads the page to verify
3. Payback may renew the session during a run. If so, the refreshed cookies are written back to the file.
4. You get a notification (Pushover, Telegram, ntfy, ...) in these cases:
   • Session expired: log in again and re-export the cookies
   • Bot check shown: the run is skipped
   • Page layout changed: the selectors need an update
   • Coupons could not be activated: for example, coupons that need a code

The tool never types your password and never solves or bypasses CAPTCHAs or bot checks. When a person is needed, it stops and tells you.

Why not the private app API?

Older tools such as theodm/python-coupons used the app API at services-ext.payback.de. As of October 2026, its login endpoint (/json/secureauthenticate) sits behind an Imperva bot challenge that plain HTTP clients can't pass. That API also needs app credentials that are extracted from the Payback app.

Setup (Docker Compose)

git clone https://github.com/mygrexit/payback-coupon-activator.git
cd payback-coupon-activator
cp .env.example .env
nano .env                     # notification URL, run time, PUID/PGID
mkdir -p data
# export cookies (see below) to data/cookies.json
chmod 600 data/cookies.json
docker compose up -d --build

The image is built for amd64 and arm64 (e.g. Raspberry Pi). It includes Chromium, so expect roughly 300–400 MB. The Docker setup has not been tested on real hardware yet. If something breaks, please open an issue.

Exporting the cookies

1. In your desktop browser, log in at https://www.payback.de and open the Coupons page once.
2. Install the Cookie-Editor extension (Chrome/Firefox). With payback.de open, click Export → JSON.
   • A Netscape cookies.txt file also works, for example from "Get cookies.txt LOCALLY".
3. Save the export as data/cookies.json on the server. Paste the clipboard into a text editor. Don't open a .json file in Firefox and copy from its JSON viewer: that copies a formatted view, not JSON.
4. Optional: set BROWSER_USER_AGENT in .env to your browser's User-Agent. Some sessions only work from the browser they were created in. In Firefox, open about:support and look for "User Agent". In Chrome, open chrome://version.

The cookie file gives full access to your Payback account. Treat it like a password: never commit it, keep it chmod 600, and delete old copies.

Configuration

Example NOTIFY_URL values:

pushover://shoutrrr:APP_TOKEN@USER_KEY
telegram://BOT_TOKEN@telegram?chats=CHAT_ID
ntfy://ntfy.sh/YOUR_TOPIC

Credentials, cookie values and the notify URL are never logged.

Usage

docker compose logs -f                                   # follow logs
docker compose run --rm payback-coupons --once           # run one cycle now
docker compose run --rm payback-coupons --test-notify    # send a test notification
docker compose run --rm payback-coupons --version

Example log:

level=INFO msg="Starting Payback coupon activation"
level=INFO msg="Found 6 pending coupons"
level=INFO msg="Activated coupon: 10 FACH °P auf Artikel der Kategorie Autoteile & Zubehör!*"
level=INFO msg="Activated coupon: 22 FACH °P auf diadent!*"
...
level=INFO msg="Activation finished: 6 activated, 0 failed, 0 still pending" duration=9s
level=INFO msg="Next run scheduled" at=2026-10-11T04:00:00+02:00

Without Docker (needs Go and Chrome/Chromium):

go build -o payback-coupons ./cmd/payback-coupons
COOKIES_FILE=./data/cookies.json ./payback-coupons --once

--once exits with 0 on success, 1 if anything needs attention and 2 on invalid configuration. That makes it usable from cron or systemd timers.

Troubleshooting

Development

go test -race ./...   # browser tests run if Chrome/Chromium is installed, otherwise they are skipped

Layout:

License

MIT – see LICENSE.