How to Get a Reddit API Key (and When You Don't Need One)

A Reddit API key is the client ID and client secret Reddit gives you when you register an app. With them you request an OAuth access token, and every API call carries that token. This guide walks through how to get a Reddit API key, which app type to pick, a minimal Python example, the errors you will most likely hit, and the rate limits. At the end we cover the cases where you do not need a key at all.

Reddit’s developer pages change, and its current registration notes live on the Reddit Data API Wiki. That page refused our automated request when we wrote this, so check it for any approval step Reddit has added. The steps below follow Reddit’s OAuth2 documentation.

How to get a Reddit API key

1. Log in to Reddit with the account that will own the app. A script app only has access to this account.
2. Read the terms. Creating an app means accepting the Data API Terms and Developer Terms. Reddit asks for accurate contact details (Data API Terms, section 1.3).
3. Open the app page at reddit.com/prefs/apps and click “are you a developer? create an app…”.
4. Pick the app type (script, web app or installed app). The next section explains which one you need.
5. Fill in the name, description and redirect URI. Give the app a clear name and description. For a web app, the redirect URI points to a URL on a server you control, and it must match exactly in every authorization request.
6. Create the app and copy the credentials. Reddit shows the client ID and, for script and web apps, the client secret on the app’s entry. Store the secret like a password: in an environment variable or a secrets manager, never in code.

Reddit’s terms forbid registering several apps for one use case to get around limits (Developer Terms). Create one app per real project.

Keep the key safe

Reddit’s terms treat your credentials as yours alone. The Developer Terms say you may not share your access details with a third party, and the Data API Terms (section 2.8) say you must use the OAuth token Reddit gave you and must not mask your User-Agent or OAuth identity. In practice:

• keep the secret out of Git, screenshots and client-side code,
• give each project its own app instead of sharing one key across teams,
• if a secret leaks, stop using it at once, replace the app’s credentials and update your code.

Script, web or installed app

The OAuth2 documentation defines three types:

App type	Where it runs	Gets a secret	Typical use
Script	Hardware you control, such as your laptop or server	Yes	Personal scripts and bots. Only has access to your own account.
Web app	A web service on a server you control	Yes	Sites where other Reddit users log in through your app
Installed app	Devices you do not control, such as a user’s phone	No	Mobile and desktop apps

The type decides which OAuth flows the app may use. Only installed apps may use the implicit flow, and only script apps may use the password grant. For reading public data without a user context, script and web apps can use the client_credentials grant, which is what the example below does.

OAuth basics in one minute

• You send your client ID and secret as HTTP Basic auth to https://www.reddit.com/api/v1/access_token, with the grant type in the POST body.
• Reddit returns an access_token of type bearer. All bearer tokens expire after one hour.
• You call the API at https://oauth.reddit.com (not www.reddit.com) with the header Authorization: bearer TOKEN.
• To act for another user, you send them to https://www.reddit.com/api/v1/authorize with the scopes you need (for example read, submit or identity). Ask only for the scopes you use.
• App-only tokens never come with a refresh token. When one expires, request a new one.

Get a Reddit API key working in Python

This minimal example uses the requests library and the app-only client_credentials grant. It reads the credentials from environment variables.

import os
import requests

CLIENT_ID = os.environ["REDDIT_CLIENT_ID"]
CLIENT_SECRET = os.environ["REDDIT_CLIENT_SECRET"]
# Format from Reddit's API rules: <platform>:<app ID>:<version> (by /u/<username>)
USER_AGENT = "script:my-research-app:v0.1 (by /u/your_username)"

token_resp = requests.post(
    "https://www.reddit.com/api/v1/access_token",
    auth=(CLIENT_ID, CLIENT_SECRET),
    data={"grant_type": "client_credentials"},
    headers={"User-Agent": USER_AGENT},
    timeout=30,
)
token_resp.raise_for_status()
token = token_resp.json()["access_token"]

resp = requests.get(
    "https://oauth.reddit.com/r/python/hot",
    headers={"Authorization": f"bearer {token}", "User-Agent": USER_AGENT},
    timeout=30,
)
resp.raise_for_status()
print("Requests left:", resp.headers.get("X-Ratelimit-Remaining"))
for child in resp.json()["data"]["children"][:5]:
    print(child["data"]["title"])

Set the two variables in your shell, run the script, and it prints five post titles from r/python. If you prefer a library, Reddit’s OAuth2 page links an example with PRAW, a Python wrapper; the Data API Terms (section 2.10) say you must also follow any limits set by third-party libraries you use.

Common errors and how to fix them

Error	Likely cause	Fix
401 from /api/v1/access_token	Client ID or secret wrong, or not sent as HTTP Basic auth	Send the client ID as the user and the secret as the password. Installed apps use an empty password.
unsupported_grant_type	Wrong grant type, or the body is not form-encoded	Use a grant your app type allows and send application/x-www-form-urlencoded.
invalid_grant	An authorization code that expired or was already used	Codes are one-time use. Start the authorization again.
403 in the browser during authorization	Missing or wrong client_id or redirect_uri	The redirect URI must match the registered one exactly.
401 on API calls	Token expired (after one hour) or sent to www.reddit.com	Request a new token and call https://oauth.reddit.com.
429 Too Many Requests	Over the rate limit	Slow down, read the rate limit headers and wait for the reset.

The fixes for the first five rows come from the error tables in Reddit’s OAuth2 documentation.

Reddit API rate limits

Reddit’s published free limits are 100 queries per minute per OAuth client ID with OAuth and 10 queries per minute without it, effective July 1, 2023 (Key Facts). Reddit can change limits at any time (Data API Terms, section 2.9).

Each response tells you where you stand (API rules):

• X-Ratelimit-Used: requests used in this period,
• X-Ratelimit-Remaining: requests left,
• X-Ratelimit-Reset: seconds until the period ends.

The same rules ask for a unique, descriptive User-Agent and warn that default ones such as “Python/urllib” are “drastically limited.” Never copy a browser’s User-Agent: Reddit says it bans clients that spoof it. For costs above the free tier, see our guide to Reddit API pricing.

When you don’t need a Reddit API key

Get your own key if you post, comment, vote, moderate, run a bot or act for logged-in users. Our tools cannot do any of that.

If you only want to read public posts and comments, for example to track brand mentions, collect comments for sentiment analysis or find people asking for a product like yours, you can skip the app, the OAuth code and the token refresh. Our Reddit Actors run on Apify and need only an Apify account, with no Reddit account and no Reddit credentials:

• Reddit Scraper: posts and comment threads from subreddits, Reddit search and post links, with an “only new posts” mode for daily monitoring.
• Reddit Comments Scraper: one row per comment with its post, and filters for keywords or minimum score. Filtered-out comments are free.
• Reddit Keyword Monitor: only new posts that mention your keywords, with a snippet around the match.

On the day we wrote this, the Reddit Scraper and Reddit Comments Scraper cost $1.20 per 1,000 results on the Apify Starter plan and the Keyword Monitor $2.40 per 1,000 mentions, less on higher plans. The cards below show the current prices. You get rows as JSON, CSV or Excel, or through the Apify API.

Either way, follow Reddit’s terms and data protection law, and treat usernames as personal data.