Reddit's self-service OAuth app creation has been closed since 2025-11-11. New credentials come only from a manually reviewed support ticket, existing credentials were grandfathered, and the pages that look like they should issue credentials do not. If you are about to migrate a scraper onto Reddit's Data API, read this before writing code, because there is a measurement that may make the whole migration pointless.
Searching this topic returns mostly adversarial content
Start here, because it poisoned my first research pass. Query anything like "reddit api access 2026" and the top results are a genre of blog posts (fetchlayer, redditapis, crawlora, snitchfeed, molehill, assorted Medium reposts) published by companies selling scraped Reddit data. They are accurate on the policy dates, because those are copied from Reddit's own posts, and systematically pessimistic on everything downstream, because "the official API is dead, buy ours" is the funnel.
I had a research subagent return a confident "NO, access is impossible" verdict sourced almost entirely from that genre. The primary sources tell a more nuanced story. Read support.reddithelp.com, redditinc.com/policies, and r/redditdev directly. Note that r/redditdev itself is unreachable from many datacenter IPs, which is how the research problem and the subject matter become the same problem.
The policy, from Reddit
The original announcement (u/redtaboo, r/redditdev, 2025-11-11, "Introducing the Responsible Builder Policy"):
Starting today, self-service access to Reddit's public data API will be closed. Anyone looking to build with Reddit data, whether you're a developer, researcher, or moderator, will need to request approval before gaining access. That said, current access won't be affected, so anyone acting within our policies will keep their access and integrations will keep working as expected.
An admin committed in that thread to "a 7 day turnaround on most tickets."
A later official post (2026-08-05, "Our Plans for the Future of Reddit's Public Data API") states the direction: "we'll gradually start restricting all new requests and third-party apps will be required to port and operate through our Developer Platform", while also saying "it honestly won't happen this year", and setting a 2026-09-30 deadline to register existing apps to remain in good standing.
Three pages that look like the answer and are not
This is where the time goes.
| Page | What it actually does |
|---|---|
reddit.com/prefs/apps | For accounts with no existing app, silently redirects to the Responsible Builder Policy page. No error, no explanation, no create form. Multiple r/redditdev posts describe exactly this. If you have a pre-Nov-2025 app it still lists it, so check here first: grandfathered credentials skip the entire approval question. |
developers.reddit.com/app-registration | Registers apps that already have credentials, for labeling and migration-program eligibility. It issues nothing. Easy to mistake for the signup flow. |
developers.reddit.com/docs (Devvit) | A different product. Apps run inside Reddit's runtime in JS/TS and must be installed into a subreddit by that subreddit's moderators. If you want to pull data from communities you do not moderate, this is not a path, no matter how often you are told to "just use Devvit". |
The real intake is a Zendesk form. The role is selected by query parameter:
https://support.reddithelp.com/hc/en-us/requests/new?ticket_form_id=14868593862164
&tf_42139884615700=api_request_type_developer_clone # non-commercial
&tf_42139884615700=api_request_type_enterprise_clone # commercial
&tf_42139884615700=api_request_type_researcher_clone # academicThe field id changed when Reddit rebuilt the form: older announcements link tf_14867328473236=api_request_type_enterprise and current help-center pages link tf_42139884615700=..._clone. Both reach the same form; use the current one. The branch you pick changes which fields are required, so hitting the bare ticket_form_id URL and guessing is worse than using the parameter.
The commercial definition is broader than you expect
From "Developer Platform & Accessing Reddit Data", commercial purposes include "any use of our services by a business or on behalf of a business or as part of a monetized product or service", with examples that explicitly name "Publishing content from Reddit on monetized websites or apps with ads" and "Free product features available for upsell".
The Data API Terms (last revised 2026-07-20) §3.2 forbid "derive revenues from the use or provision of the Data APIs ... unless there is express written approval from Reddit", and §3.1 says commercial use "will need to enter into a separate agreement."
So a free feature inside a for-profit product is commercial by their definition. Filing under the non-commercial "developer" branch to get an easier yes is misrepresentation, and both the Responsible Builder Policy's transparency clause and Data API Terms §2.8 ("you will not misrepresent or mask either the user agent or OAuth identity") make that a revocation trigger. The policy also prohibits "submitting multiple requests for the same use case", so you get one shot.
One obligation people miss entirely: you must delete content that gets deleted on Reddit, and the wiki "strongly recommend[s] routinely deleting any stored user data and content within 48 hours", noting that retaining deleted content "even if disassociated, de-identified or anonymized" violates the terms. If your pipeline stores post bodies indefinitely, approval turns that into a live compliance item.
Measure this before you migrate anything
The assumption worth falsifying: "OAuth is the sanctioned server-to-server surface, so it fixes our datacenter-IP block at the root." Measured from a cloud platform's shared outbound pool:
GET oauth.reddit.com/r/<sub>/top, no token, 10 reps | 403 x 10, text/html, server: snooserv |
| same, browser UA / no UA / via residential proxy | 403, identical |
same with Authorization: bearer <garbage> | 403, body is an explicit <title>Blocked</title> page |
POST www.reddit.com/api/v1/access_token, bogus HTTP Basic | 401 {"message": "Unauthorized", "error": 401} |
Token minting is reachable from cloud egress; the API host is not, at least unauthenticated. That 403 is consistent with either an IP block or Reddit's documented "traffic not using OAuth or login credentials will be blocked", which is precisely what an unauthenticated request to the OAuth host is. The two are indistinguishable without a valid client id, and the vendor blogs asserting the former are selling proxies.
So the sequence is: get credentials, then run one probe from your deployed egress that mints a token and makes one authenticated listing call, and only then write the scraper. The expensive outcome is a finished OAuth client that 403s in production.
Two other gotchas
The User-Agent rule is host-specific and the two hosts want opposite things. Reddit documents <platform>:<app ID>:<version string> (by /u/<username>) and says "NEVER lie about your User-Agent", and default agents like Python/urllib are "drastically limited". But on the RSS/HTML surface, browser-navigation headers are what keep you out of 429s. Sending a descriptive bot UA to the RSS host got a 429 with x-ratelimit-used: 1 in the same test run where browser headers got a 200. Apply the honest-UA rule to oauth.reddit.com only; do not globally rip out browser headers on the legacy path.
robots.txt is not a blocklist tell. A blocked IP gets a 27-byte User-Agent: * / Disallow: / variant instead of the real multi-KB file, which is a tempting cheap probe. It is unreliable: I measured that stub still being served to an IP that was simultaneously returning 200 on every feed. Reddit's own wiki says "Our robots.txt is for search engines, not Data API users." Probe the endpoint you actually care about.