How to get a Reddit API key before October 31

You can’t create a Reddit API key on your own anymore. Since November 11, 2025, every new client id and secret waits on Reddit’s approval, and you ask for it on its Data Access Request form. That form stops taking new requests for public API access on October 31, 2026.

That’s why the older tutorials fail. They send you straight to reddit.com/prefs/apps to click “create app”, and without approval the page reloads with no app and no error, so there’s nothing to debug. Start at the form; the button works once Reddit says yes. And if all you want is to read public posts and comments, you don’t need a key: skip to the last section.

The form has no box for a script that only reads

The form asks whether you’re a developer, a researcher or a commercial developer. Developers then pick an app or a mod tool “that does not work in the Devvit ecosystem” (Devvit is Reddit’s own platform for apps that run inside Reddit). Nothing fits a personal script that just reads posts, so a PRAW script goes in as an app, with six required answers:

• your Reddit account name
• what the app will do on Reddit, in detail
• which subreddits it will run in
• what it gives Redditors
• a link to its source code, or to the platform that will call the API
• what’s missing from Devvit that stops you building there

Reddit wants a tool that does something for specific subreddits. Mod bots get approved. Many other requests don’t.

The Devvit question has a plain answer for Python: Devvit runs JavaScript, and Reddit has said Python isn’t on its roadmap. Researchers and businesses have their own branches of the form. If you only run ads, skip all of this: Reddit’s Ads API needs no approval.

File once. Reddit’s Responsible Builder Policy forbids several requests for the same use case, and second accounts. Screenshot the confirmation; the form sometimes reloads without a ticket number. Reddit aims to answer within 7 days, so a request filed in the last week may still be open on October 31.

After approval you get one client id, so pick the type first

Each account can create one client id. A script app is for code only you run, a web app for a server that serves other people, and an installed app for phones and desktops, which gets no secret. To read Reddit from your own server, a script is enough. Reddit asks for a redirect URI even for a script that never uses one; http://localhost:8080 will do.

Your client id is the string of 14 or more characters just under “personal use script”, and the secret is the one of 27 or more next to “secret”. Put both in environment variables, not in the code you link on the form.

Your first call: a token, then oauth.reddit.com

A token is one POST to www.reddit.com, and every call after it goes to oauth.reddit.com:

UA="script:subdigest:v0.1 (by /u/you)"
WWW=https://www.reddit.com
API=https://oauth.reddit.com

# 1. A token, good for an hour
curl "$WWW/api/v1/access_token" \
  -u "$CLIENT_ID:$SECRET" \
  -A "$UA" \
  -d grant_type=client_credentials
# → access_token, expires_in: 3600

# 2. Every call after it
curl -G "$API/r/redditdev/new" \
  -d limit=100 \
  -H "Authorization: bearer $TOKEN" \
  -A "$UA"

import praw

ua = "script:subdigest:v0.1 (by /u/you)"
reddit = praw.Reddit(
    client_id="YOUR_ID",
    client_secret="YOUR_SECRET",
    user_agent=ua,
)

sub = reddit.subreddit("redditdev")
for post in sub.new(limit=100):
    print(post.title)

Tokens last an hour, and app-only tokens never come with a refresh token, so ask for a new one before expires_in runs out. The User-Agent needs Reddit’s format, platform:app id:version (by /u/username), because defaults like Python/urllib are “drastically limited”.

A server that calls oauth.reddit.com without a valid token gets an HTML page saying “You’ve been blocked by network security”, not a 401, so check the token before you suspect a ban. And the free limit is 100 queries a minute per client id, so ask listings for limit=100: the default page is 25 items, and the bigger one still costs one query.

A key you get today works until March 2027

Reddit’s migration schedule moves every app off the public API and onto Devvit:

The only exception Reddit has named is partners with written agreements, such as accessibility apps and mobile clients. PRAW calls the same API, so a PRAW script stops when its app does. If you hold a key, new or old, register it at developers.reddit.com/app-registration with a personal Reddit account: by November 30 to be considered for Reddit’s $1,000 porting bounty, and before January 12 to stay clear of the first cutoffs. What stays free until then is in Reddit API pricing in 2026.

Only reading Reddit? You don’t need a key

If your code reads public Reddit (a subreddit’s feed, a thread and its comments, search results, a community’s stats) and never posts or votes, skip the form. LurkAPI reads reddit.com’s public pages and answers one HTTP request with JSON. Sign up, copy a key, and you start with 100 free credits. Each call costs 1 credit, and once a UTC day a balance under 25 is topped back up to 25, so a script that makes 25 calls a day never pays.

This call asks for r/redditdev’s newest posts:

URL=https://api.lurkapi.com
curl -G "$URL/v1/reddit/subreddit" \
  -d subreddit=redditdev \
  -d sort=new \
  -d trim=true \
  -H "x-api-key: $LURK_KEY"

The fields keep Reddit’s own names (title, score, num_comments, created_utc), and paging works as it does on Reddit: send back the after you got for the next page.

The same key works on all five Reddit endpoints, at 1 credit a call. For a spreadsheet without code, the free Reddit scraper exports a subreddit to CSV, no account needed. A bot that posts or moderates still goes through the form above, or onto Devvit.