Reddit API credentials for posting: approval, rate limits, and the cross-subreddit rule

Three things decide whether a Reddit posting integration works, and none of them is your code. Reddit's Data API is open to approved developers only, so registering an application is a step toward access rather than access itself. The free-tier rate ceiling is 100 queries per minute per OAuth client ID, not per user, so every customer of a multi-tenant product shares one budget. And Reddit's policy names posting identical or substantially similar content across subreddits as prohibited spamming, which is the shape most people assume a publishing integration should have.

This page covers how to get Reddit API credentials for an app that posts on behalf of its users, what the free tier actually allows, and where the Reddit API stops. Every claim here was checked against Reddit's published policy and help centre and against Outstand's own documentation on 2026-08-31, and all of it is linked so you can re-check it yourself.

What is a Reddit API key?

A "Reddit API key" is not one value. Registering an application at reddit.com/prefs/apps gives you two: a client ID and a client secret. Those are the credentials your integration holds, and they identify your application to Reddit rather than any particular Reddit user.

Getting a user's post onto Reddit takes a second step: an OAuth authorization that returns tokens scoped to that user's account. So the setup has two halves. Register one application, then authorize each account that will publish through it.

There is a third step, and it is the one that catches people out. Registering an application is not the same as being allowed to call the API. Read the next section before you build anything on top of those credentials.

Does Reddit require approval before you can use the API?

Yes, and this is the part most Reddit API tutorials skip.

Reddit's Responsible Builder Policy states it in its opening restrictions:

Approval is required: You must request access and get explicit approval before accessing any Reddit data through our API, and you must agree to comply with all applicable terms.

Read the scope carefully. That says any Reddit data, not commercial use only.

Reddit's help centre says the same thing in three other places. Its Developer Platform and Accessing Reddit Data article describes the Data API as one that "allows approved developers the ability to access and modify Reddit data programmatically". Under Getting Started it says that to use the Data API for non-commercial purposes "you need to sign-up". And it names the gate explicitly:

The information you provide about your use case and App during Reddit's App Review will determine your eligibility and approval for commercial (or non-commercial) use of Reddit's developer tools and services.

The Reddit Data API Wiki adds the same instruction under its rules: you can use the Data API subject to the Responsible Builder Policy, Developer Terms and Data API Terms, and "to request, please contact us".

Where you actually request it. This is the part worth writing down, because most guides send you to the app registration screen and stop there. In the same Getting Started section, Reddit says that to use its Data API for non-commercial purposes "you need to sign-up here", and that link goes to a support request form, not to the app registration page: Reddit's Data API access request form.

So the practical sequence is register, request through that form, and wait, not register and start calling. Plan your launch around an approval step you do not control. If you followed a tutorial that ended at the registration screen, you have done one step of three.

Commercial use is a further gate, not the same one. If your product is monetised in any way, Reddit requires separate permission and a contract. Its list of commercial purposes is broad and explicitly includes subscription services, paywalled apps, and "free product features available for upsell". If you are building a paid product, you are in that category.

What we will not tell you, because we have no primary source for it: how long approval takes, how often it is refused, or what commercial access costs. Pages that quote you a rejection rate or a price are not working from a Reddit source either. Ask Reddit through its contact form.

Policy and help centre text read 2026-08-31.

Script app or web app? Pick by who is posting

Reddit asks you to choose an application type when you register one. The choice follows a single question: whose Reddit account does the post appear as?

If your product publishes on behalf of your users, with each of them authorizing their own Reddit account, you need a web app. A web app has a redirect URI and runs the browser OAuth flow, which is what lets a user grant your application access to their own account. Outstand's Reddit integration requires a registered application of type web app for exactly this reason, with the redirect URI pointed at our callback.

If instead you are automating a single Reddit account that you own, the browser redirect flow buys you nothing, and a script app is the usual choice.

The short version: if other people's posts go through your application, register a web app.

Why your Reddit integration stops working after one hour

Reddit access tokens expire after 1 hour. If your authorization request does not also ask for a refresh token, your integration will work in testing and then stop the same day.

The fix is to request duration=permanent at authorization time. That is what returns a refresh token, which you exchange for fresh access tokens from then on. Outstand's Reddit connect flow sets duration=permanent for this reason.

This is the most common way a first Reddit integration fails, and it fails an hour after you stopped watching it.

Set your User-Agent, or get throttled for reasons you cannot see

Reddit's Data API Wiki requires a unique, descriptive User-Agent in a specific format:

<platform>:<app ID>:<version string> (by /u/<reddit username>)

For example: android:com.example.myredditapp:v1.2.3 (by /u/kemitche).

This is not decoration. Reddit's own wording is that "many default User-Agents (like Python/urllib or Java) are drastically limited", and that traffic not using OAuth or login credentials will be blocked outright. If you are testing with a default HTTP client User-Agent and seeing throttling you cannot explain, that is the first thing to change.

Which OAuth scopes does posting need?

Five, for an integration that publishes and also reads back what it published:

If you only ever publish and never read anything back, identity and submit are the minimum. Reddit's policy asks that apps request only the access they actually need, so do not request the full set out of habit. Those five are Outstand's default set, and a caller can narrow them.

Is the Reddit API free, and what are the limits?

There is a free tier. Reddit's Data API Wiki states the ceiling directly:

We enforce rate limits for those eligible for free access usage of our Data API. The limit is: 100 queries per minute (QPM) per OAuth client id

The same page adds that the limit is averaged over a time window, currently 10 minutes, so short bursts above 100 in a single minute are tolerated as long as the average holds. Exceeding it returns HTTP 429, and your current usage comes back in the X-Ratelimit-Used, X-Ratelimit-Remaining and X-Ratelimit-Reset response headers.

The word that matters is "client". The ceiling attaches to your registered application, not to each user who authorizes it. For a single-account bot that is generous. For a multi-tenant product it is one shared budget:

That is the real scaling constraint on Reddit, and it arrives earlier than most teams expect. Publishing is only part of the spend, because reading post analytics back draws on the same budget.

The rule that catches multi-platform publishing tools

This is the most important section on this page if you are planning to let one piece of content reach several subreddits.

Reddit's Responsible Builder Policy lists, under prohibited app activities:

Apps must not engage in spamming activity through automated posts, comments, or direct messages. This includes posting identical or substantially similar content across subreddits.

Note the exact scope. The prohibition is on the same content going to several subreddits. It is not about the same content going to Reddit and to other networks, which the clause does not reach. The trap is that a publishing tool makes "send this everywhere" a single checkbox, and on Reddit that habit points at the one pattern the policy names.

What to do instead:

• Treat each subreddit as a separate destination with its own copy, not as one more checkbox on a broadcast.
• Publish to one subreddit per piece of content unless you have genuinely written it for the second one as well.
• Read the subreddit's own rules first. Plenty of them prohibit cross-posting independently of Reddit's policy.

Enforcement under the same policy includes revoking your access tokens and suspending the app or account. The thing at risk is the integration, not one post.

For what it is worth, Outstand's Reddit configuration takes exactly one subreddit per post, as a single value rather than a list. Cross-subreddit fan-out is not something you can express in our API, which is a design decision rather than a missing feature.

What the Reddit API will not do

The honest list, and this is where a Reddit integration tends to disappoint people:

Two consequences worth designing around. There is no insights API, so if your product shows impressions or reach for other networks, Reddit will be a blank column. Account-level metrics are a current karma snapshot, which means a date range you pass will be ignored rather than honoured. And there is no native scheduling, so anything that looks scheduled is your own scheduler holding the post until its time arrives.

Every Reddit post also needs a subreddit and a title, with the title capped at 300 characters. A title is not optional the way it is on most networks, so a generic "content" string is not enough to publish to Reddit. Whatever abstraction you build has to carry per-network fields.

What you cannot do through Outstand's Reddit integration

Two things in the list above are commonly attributed to Reddit and are not Reddit's fault. They are ours, and we would rather say so on our own page than have you find out after you have built against us:

Both are unbuilt work on our side, not platform limits. If either is load-bearing for you, use Reddit's API directly for those calls or pick a different tool, and do not wait on us for a date, because we do not publish roadmap dates.

The subreddit rules the API cannot bypass

Individual subreddits enforce their own rules on top of the API, and the API will not route around them:

• Flair. Some subreddits require it and auto-remove posts that arrive without it. This is the nasty one, because your API call succeeds and the post quietly disappears afterwards. Pass a flair template ID where the subreddit needs one.
• Karma minimums and account age. A freshly created account will be blocked from posting in many subreddits no matter how correct your credentials are.
• Posting frequency limits. Set per subreddit, and independent of the API rate limit.

A successful API response means Reddit accepted the submission. It does not mean the post is still there a minute later. If it matters to you, read the post back.

One obligation people miss: deleting what Reddit deletes

Reddit's Data API Wiki requires you to remove any user content in your possession that has been deleted from Reddit, including titles, bodies and embedded URLs, and to delete author-identifying information when an account is deleted. Reddit's stated recommendation is to routinely delete stored user data and content within 48 hours, and it says retention of deleted content is a violation even if the data has been anonymised.

If your product caches Reddit posts or comments for a dashboard, that is a retention policy you have to build, not an edge case.

Where Outstand fits, and where it does not

Outstand is a unified social media API, and Reddit is one of the networks it publishes to. Two things worth being direct about.

Outstand does not remove any of the setup above. Reddit is bring-your-own-key with us. We ship no managed Reddit OAuth application, so you register your own Reddit app and add your own client ID and secret before you can connect a single account. That is a platform constraint rather than a paywall, and it means the approval question and the rate ceiling are yours, not ours. We do not raise that ceiling, because it belongs to your client ID.

If Reddit is the only network you publish to, and you publish as one account you own, do not use us. Go to Reddit's API directly or to one of the community wrappers. A unified API earns its keep when you are publishing to several networks and do not want a separate auth model, token lifecycle, and post shape for each one. For a single network it is a layer you do not need.

What we do handle: we refresh the access token before it expires, so an expired Reddit token never reaches you, and one post shape across the networks we support, with Reddit's subreddit, title and flairId passed as network-specific configuration rather than bolted onto a generic body. If a connected account has no refresh token on file, we surface that as a re-authentication error rather than failing quietly.

If that is the problem you have, the Reddit setup guide is at outstand.so/docs/configurations/reddit.

Sources. Reddit's Responsible Builder Policy, its Developer Platform and Accessing Reddit Data help article, and its Reddit Data API Wiki, all read on 2026-08-31, plus Outstand's public API documentation read the same day. Reddit changes its API access terms periodically, so check the policy against the date on this post before relying on it.