Since you have to hit the Web API anyways to check for the validity of the code, you might instead have the Web API generate the code for you. This way it can guarantee a unique code per request.

If you want them generated client side, you can generate them in batches, send the batch to the Web API for verification, and then use the first one that is approved. This will minimize the back and forth between the Web API.

You can use a table with an auto-incrementing id as the basis for your code. If need be, start the increments at 100,000 for 6 digits. Insert a row, get the id, and return it. It will be guaranteed to be unique.

Depending on your expected usage levels, you might consider tacking on a few random letters to the id. So that code '1234' becomes '1234AB'. This makes it more difficult to stumble upon other people's codes.

You can also implement the above as a lookup-table. Fill a table with suitable codes, and return the corresponding one based on the auto-incremented id.