[always_imposter]

>Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills?

I'm hoping nobody is this naive to let your client have mission critical info to implement something as crucial as giving a discount or refills in your case. It would be just be an extra column in your db table, the only identifier available to the user should be just the UUID, along with some identifier.

[steinuil]

I don't think this is that critical; if you stay there long enough and regularly go to refill your drink or come back the next day and make a beeline for the drink machine I think the staff would notice something's off.