Reddit · Authentication Profile

Reddit Authentication

Authentication

Reddit secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

RedditAdvertisingCommunityContentSocial MediaSocial NewsSocial

Methods: oauth2 Schemes: 1 OAuth flows: authorizationCode API key in:

Security Schemes

oauth2 oauth2

· flows: authorizationCode

Source

Authentication Profile

generated: '2026-11-05'
method: searched
source: https://github.com/reddit-archive/reddit/wiki/OAuth2
summary:
  types:
  - oauth2
  oauth2_flows:
  - authorizationCode
schemes:
- name: oauth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://www.reddit.com/api/v1/authorize
    tokenUrl: https://www.reddit.com/api/v1/access_token
    scopes: 19
  description: Reddit uses OAuth 2.0 for authentication. All API requests must include a valid access token obtained
    through one of the supported OAuth grant types.
  sources:
  - openapi/reddit-account-api-openapi.yml
  - openapi/reddit-ads-api-openapi.yml
  - openapi/reddit-flair-api-openapi.yml
  - openapi/reddit-links-comments-api-openapi.yml
  - openapi/reddit-listings-api-openapi.yml
  - openapi/reddit-messages-api-openapi.yml
  - openapi/reddit-moderation-api-openapi.yml
  - openapi/reddit-search-api-openapi.yml
  - openapi/reddit-subreddits-api-openapi.yml
  - openapi/reddit-users-api-openapi.yml
  - openapi/reddit-wiki-api-openapi.yml
docs: https://github.com/reddit-archive/reddit/wiki/OAuth2
docs_additional:
- https://ads-api.reddit.com/docs/v3/guides/quick-start/authenticate
- https://support.reddithelp.com/hc/en-us/articles/16160319875092-Reddit-Data-API-Wiki
documented:
  grants:
  - authorization_code
  - implicit
  - refresh_token
  - client_credentials
  - https://oauth.reddit.com/grants/installed_client
  authorize_url: https://www.reddit.com/api/v1/authorize
  token_url: https://www.reddit.com/api/v1/access_token
  client_auth: HTTP Basic (client_id as user, client_secret as password; empty password for installed apps)
  token_lifetime: Access tokens expire after one hour.
  refresh: duration=permanent requests a refresh token; the implicit flow does not allow permanent tokens.
  authorization_code_validity: 'Ads API docs: the code should be used within the next ten minutes and only once
    per authorization.'
  ads_system_users: Business-owned System User authorization is in Open Beta (Ads API).
  unauthenticated: Traffic not using OAuth or login credentials will be blocked (Data API wiki).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/reddit-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.