Published: April 2026 | Reading time: 10 min | Author expertise: Developer tools & API integration work by HA Creations
Quick answer: To get a Reddit API key, go to reddit.com/prefs/apps, create an app, accept Reddit’s Responsible Builder Policy, and collect your Client ID and Client Secret. But there’s more nuance here — especially if you’re new to this process or if your previous guide is now outdated. Read on.
Who This Article Is For
If you’ve typed “I need Reddit API key” into a search engine, you’re probably one of the following:
- A developer building a tool, bot, or data pipeline using Reddit data
- A researcher or data analyst trying to pull subreddit content programmatically
- A hobbyist who wants to automate something on Reddit
- Someone who tried to follow an older tutorial and got confused because things changed
This guide is written from hands-on experience setting up Reddit API credentials post-2023. I’ve walked through this process multiple times across personal projects and client work, and I’ll tell you exactly what to expect — including the parts that trip most people up.
What Is a Reddit API Key, Really?
Let’s clear up some terminology before we dive in. When people say “Reddit API key,” they usually mean a combination of credentials:
- Client ID — a short string that identifies your app
- Client Secret — a longer, private string that authenticates your app
- Access Token — a temporary token you generate using the above two, valid for 1 hour
There’s no single “API key” the way you might get from OpenAI or Google Maps. Reddit uses the OAuth 2.0 standard, which means you’ll use your Client ID and Client Secret to request an access token, and that token is what you actually send with each API call.
Understanding this upfront saves a lot of frustration.
What Changed in 2023–2024 (And Why Your Old Tutorial Might Be Broken)
Here’s the context you need before doing anything else.
In July 2023, Reddit overhauled its API pricing model. Before that, access was essentially free for everyone. After the change, high-volume usage moved to a paid tier — reportedly around $0.24 per 1,000 API calls for commercial use. This forced several popular third-party Reddit apps to shut down entirely.
Then, in late 2024, Reddit went a step further: self-service API access was removed for many use cases. Instead of just signing up and getting credentials, some developers now have to submit an application and wait for approval.
The good news? For personal, non-commercial projects — the kind most individual developers are building — free access is still available. But you do have to agree to Reddit’s Responsible Builder Policy first, which is a newer requirement that many tutorials skip.
Step-by-Step: How to Get Your Reddit API Key
Step 1: Create or log in to your Reddit account
You need a Reddit account to create an app. If you already have one, log in. Your developer app will be tied to this account, so use one you intend to keep active.
Step 2: Go to the developer apps page
Navigate to: https://www.reddit.com/prefs/apps
If you prefer the old Reddit interface: https://old.reddit.com/prefs/apps
Look for the button that says “are you a developer? create an app…” at the bottom of the page. Click it.
Step 3: Fill in your app details
You’ll see a form asking for:
- Name — call it whatever makes sense for your project
- App type — this is important (see below)
- Description — a brief summary of what your app does
- About URL — optional; a link to more info about your project
- Redirect URI — for personal scripts,
http://localhost:8080works fine
Choosing the right app type:
- Script — best for personal automation; gives access to your own account’s data only
- Web app — for applications that users log in to
- Installed app — for mobile or desktop apps where the client secret can’t be kept secure
For most developers getting started, choose script.
Step 4: Read and agree to the Responsible Builder Policy
This is the step that many outdated guides miss. Before your credentials will actually work, you must visit https://support.reddithelp.com/hc/en-us/articles/42728983564564-Responsible-Builder-Policy and formally agree to Reddit’s Responsible Builder Policy.
Skipping this step means your API calls will fail or your access request won’t be approved. Budget a few minutes to read it — it covers things like data retention, content deletion requirements, and prohibited use cases.
Step 5: Collect your credentials
After creating the app, Reddit will display your:
- Client ID — shown just below the app name (a short alphanumeric string)
- Client Secret — labeled “secret”
Copy both of these somewhere secure. Treat the client secret like a password — don’t commit it to public GitHub repos.
Step 6: Get an access token
With your Client ID and Client Secret in hand, you’re ready to authenticate. Here’s a basic example using Python’s requests library:
python
import requests
import base64
CLIENT_ID = "your_client_id"
CLIENT_SECRET = "your_client_secret"
USERNAME = "your_reddit_username"
PASSWORD = "your_reddit_password"
USER_AGENT = "MyApp/1.0 by u/your_username"
auth = requests.auth.HTTPBasicAuth(CLIENT_ID, CLIENT_SECRET)
data = {
"grant_type": "password",
"username": USERNAME,
"password": PASSWORD
}
headers = {"User-Agent": USER_AGENT}
response = requests.post(
"https://www.reddit.com/api/v1/access_token",
auth=auth,
data=data,
headers=headers
)
token = response.json()["access_token"]
print(token)Your token is valid for 60 minutes. After that, you need to request a new one. For long-running applications, build in an automatic refresh mechanism.
Making Your First API Call
Once you have a token, all your requests go to https://oauth.reddit.com (not the regular reddit.com). Every request must include:
- An
Authorizationheader:Bearer YOUR_TOKEN - A
User-Agentheader with a descriptive string (e.g.,MyResearchBot/1.0 by u/yourusername)
Example — fetching top posts from a subreddit:
python
headers = {
"Authorization": f"bearer {token}",
"User-Agent": "MyApp/1.0 by u/your_username"
}
r = requests.get(
"https://oauth.reddit.com/r/python/top",
headers=headers,
params={"limit": 10, "t": "week"}
)
posts = r.json()["data"]["children"]
for post in posts:
print(post["data"]["title"])Important about User-Agent: Reddit actively rate-limits or blocks generic User-Agent strings like Python/urllib. Always use a specific, descriptive string that includes your app name and Reddit username. Reddit’s own documentation emphasizes this clearly.
Common Questions and Problems
Q: Why is my API call returning a 401 Unauthorized error?
Almost always one of these reasons:
- Your access token expired (they last only 1 hour)
- Your Client ID or Secret was copy-pasted incorrectly
- You didn’t include the
Authorizationheader in the correct format (Bearer TOKEN, not just the token) - You haven’t agreed to the Responsible Builder Policy yet
Q: Why am I getting a 429 Too Many Requests error?
You’ve hit Reddit’s rate limit. For OAuth-authenticated apps, the limit is 100 queries per minute (QPM), averaged over a 10-minute window. That means brief bursts above 100 QPM are allowed, but sustained high volume will trigger throttling.
The response headers X-Ratelimit-Used, X-Ratelimit-Remaining, and X-Ratelimit-Reset tell you exactly where you stand. Build your app to read these headers and back off automatically when you’re close to the limit.
Q: I submitted a request for higher-tier API access. How long does approval take?
For personal and research projects, approval typically takes a few days. Commercial use cases may take longer or require additional review. Reddit doesn’t publish a guaranteed SLA here, so plan accordingly if you’re building on a deadline.
Q: Can I access NSFW content through the API?
As of July 2023, NSFW content access is restricted. This affected many third-party apps significantly. If your project requires this type of content, expect additional friction and potentially limited availability through the standard developer API.
Q: My app type is “script” — does that limit what I can access?
Yes. The “script” app type is designed for personal use and gives you access to your own account’s data. It’s appropriate for automation, personal bots, or reading public subreddit data. If you need to act on behalf of other Reddit users, you’ll need to use the “web app” type with a full OAuth authorization code flow.
Q: What scopes should I request?
Start minimal. For read-only access to public posts and comments, read and identity are enough. Adding unnecessary scopes like * (wildcard for all scopes) is a bad practice in production — it creates security exposure and may raise flags during review.
Q: Is the Reddit API free?
Free tier access is available for personal and non-commercial use, with a 100 QPM rate limit for OAuth apps. For unauthenticated requests, the limit is 10 QPM — and be aware that unauthenticated access is effectively unsupported and will be blocked for most meaningful endpoints.
Commercial use, higher volume, or data resale puts you into the paid tier. Pricing isn’t publicly listed on Reddit’s site; you’d need to contact them directly for commercial terms.
Rate Limits at a Glance
| Access type | Rate limit |
|---|---|
| OAuth (authenticated) | 100 requests/minute (10-min average) |
| Unauthenticated | Effectively blocked |
| Pagination depth | Up to 1,000 posts per subreddit |
| Token validity | 60 minutes |
| Commercial threshold | Contact Reddit for pricing |
Data Compliance: What Reddit Requires of You
This is a part many developers overlook — and it has legal implications. Reddit’s Responsible Builder Policy includes requirements around data retention and deletion:
- If a post or comment is deleted on Reddit, you must delete all related content from your systems — this includes the title, body, embedded URLs, and anything else associated with that content
- If a user account is deleted, you must remove all references to that user’s identity from your stored data
These aren’t optional recommendations. If you’re building any kind of persistent data store using Reddit content, make sure your architecture supports deletion propagation from the start. Building this in retroactively is painful.
When the Official API Isn’t the Right Tool
Let’s be practical. There are scenarios where going through the official Reddit API isn’t the best path:
- You need more than 1,000 posts from a single subreddit — the API’s pagination ceiling makes this impossible through standard endpoints
- You need historical data — the API has limited reach into older content
- You’re building a commercial product at scale — the complexity of managing OAuth tokens, rate limits, and compliance at volume adds significant engineering overhead. Some teams find third-party Reddit data providers more practical
- Your approval is delayed or denied — if Reddit doesn’t approve your use case, you’re stuck
For academic research, there are also archived Reddit datasets available through platforms like Pushshift (though access there has changed considerably too). If your need is analytical rather than real-time, it’s worth exploring whether a historical dataset covers your requirements before investing in live API integration.
Final Tips From Experience
Always set a meaningful User-Agent. This isn’t just a courtesy — Reddit actively throttles generic strings. Use a format like AppName/Version by u/yourusername.
Store credentials in environment variables, not in code. Use a .env file locally and proper secrets management in production. Never commit credentials to version control.
Build for token expiry from day one. Access tokens last 60 minutes. If you’re building anything that runs longer than an hour, handle refresh logic before you need it — not after it breaks in production.
Read the response headers. The X-Ratelimit-* headers give you real-time visibility into your quota. Use them to implement smart backoff rather than reacting to 429 errors after they happen.
Test with low request volume first. Hit rate limits during testing, not during a demo or production run.
Summary
Getting a Reddit API key in 2025 involves more steps than it used to, but it’s still accessible for personal and non-commercial use. Here’s the core checklist:
- Log in to your Reddit account
- Go to
reddit.com/prefs/appsand create an app - Choose the correct app type (usually “script” for personal use)
- Agree to Reddit’s Responsible Builder Policy
- Save your Client ID and Client Secret securely
- Use these credentials to request an OAuth access token
- Send all API calls to
https://oauth.reddit.comwith your token and User-Agent - Monitor rate limit headers and handle token refresh
If you’re building something commercial or at scale, evaluate upfront whether the official API meets your needs — or whether you need to have a conversation with Reddit about enterprise access or explore compliant third-party data solutions.
Last verified: April 2026. Reddit’s API terms and processes change periodically — always check Reddit’s official developer documentation for the most current requirements.