Reddit

Verified on 25 October 2026 against the Reddit Data API at oauth.reddit.com.

The Reddit connector reaches https://oauth.reddit.com, Reddit's API for signed-in use, as one Reddit account: yours. It suits the jobs you would otherwise do by scrolling: pull a subreddit's new posts into a digest, read a thread's comments, look up who a user is, search for mentions of your product, check your inbox. It can also post, comment, edit, delete and send private messages as you, and all five of those ship switched off and ask a human before they run, because every one of them is published under your name.

What you need

A Reddit app that you register yourself. Reddit issues no API keys; every call is made with an OAuth token for an account, through an app that account owns.

1. Create the app. Signed in as the account the agent should act as, open reddit.com/prefs/apps and choose create another app.

• Pick web app. Not script, which only ever acts as the developer and would need the account password, and not installed app, which gets no client secret.
• redirect uri is the one field Reddit checks byte for byte. Enter your gateway's address followed by /oauth/callback: http://127.0.0.1:7376/oauth/callback for a gateway on your own machine, or https://<your-gateway-host>/oauth/callback for a tunneled or hosted one. The console shows the exact value to copy when you connect. A Reddit app holds one redirect URI, so an app you already use for something else needs a second app here.
• name and description are shown to you on the consent page and nowhere else.

2. Note the client id and secret. After saving, the client id is the short string under the app's name, and the secret is labeled secret. Reddit shows both whenever you open the app, so there is nothing to copy down in a hurry.

Reddit asks every client to send a User-Agent that names it and throttles the generic ones; the connector sends one on every call, so there is nothing to set.

Add the connection

In the console, open Access, Connections, Add connection, pick Reddit from the catalog, and under the credential choose OAuth, then Gateway-held · your own app. Paste the client id and secret, check the redirect URI matches the one on your Reddit app, and choose Add. The gateway starts the authorization and the console opens Reddit's consent page in a new tab; approve it as the account, and Reddit sends your browser back to the gateway, which exchanges the code, seals the tokens with the client secret as the connection's credential, and shows a plain "Connected" page. Reload the connection and it shows its credential. Nothing can use it until a grant allows it.

The same flow runs against the gateway's REST API, which is what the console calls:

BASE=http://127.0.0.1:7376
curl -s -X POST $BASE/v1/connections/from-preset \
  -H "authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{
    "preset_id": "reddit",
    "name": "reddit-marcus"
  }'

The response carries the connection_id. Then, with an operator token:

curl -s -X POST $BASE/v1/connections/$CONNECTION_ID/oauth/start \
  -H "authorization: Bearer $TOKEN" \
  -H 'content-type: application/json' -d '{
    "client_id": "…the client id…",
    "client_secret": "…the secret…",
    "redirect_uri": "http://127.0.0.1:7376/oauth/callback"
  }'

Open the authorize_url it returns and approve. A few things to watch:

• The authorize link is single-use and expires after ten minutes. Start again if it goes stale.
• Reddit's consent page asks for a permanent grant. The gateway adds duration=permanent to the request, which is what makes Reddit issue a refresh token. Without one the connection would die when the access token did, so the gateway refuses to seal a response that lacks it.
• Your gateway refreshes on its own. Reddit's access tokens last a day. The gateway mints a new one two minutes before expiry, on the invoke path, authenticating to Reddit's token endpoint the one way Reddit accepts, an HTTP Basic header carrying the client id and secret. Nothing to re-paste, and nothing reaches permaura.com.
• Scopes. Left alone, the gateway asks for identity, read, mysubreddits, history, submit, edit and privatemessages, which cover every action below. Pass a scopes list to the start call to ask for less; Reddit's consent page lists exactly what was requested.
• Run it from the gateway's own host if you have a device enrolled for approvals. Sealing a credential changes the identity the connection acts as, so it is held for a device signature, and a browser redirect cannot carry one. Starting the flow over a tunnel or the broker is refused in that setup.

What the agent can do

Action	What it does	On by default
me.read	Reads the account the connection acts as	Yes
subreddits.about	Reads a subreddit's description and subscriber count	Yes
subreddits.rules	Reads a subreddit's rules	Yes
subreddits.mine	Lists the subreddits the account subscribes to	Yes
subreddits.search	Searches subreddits by name and description	Yes
posts.hot, posts.new, posts.top	Lists a subreddit's posts (top takes t: hour, day, week, month, year, all)	Yes
posts.search	Searches posts within a subreddit	Yes
search	Searches posts across Reddit	Yes
comments.list	Reads a post with its comment tree	Yes
users.about, users.posts, users.comments	Reads a user's public profile, posts and comments	Yes
things.info	Looks up posts, comments or subreddits by fullname or URL	Yes
messages.inbox	Reads the account's inbox, including private messages	Yes
posts.create	Submits a post to a subreddit as the account	No, and needs approval
comments.create	Replies to a post, comment or message as the account	No, and needs approval
things.edit	Edits one of the account's own posts or comments	No, and needs approval
things.delete	Deletes one of the account's own posts or comments	No, and needs approval
messages.send	Sends a private message as the account	No, and needs approval

Voting is deliberately not included. Reddit's rules forbid automated voting, and an agent has no business doing it under your name.

Good to know

• Every write is published as you. A post, comment or message made through this connection is indistinguishable from one you typed, which is why all five writes ask a human each time, even after you enable them. Reddit's rules also expect a bot to say so; if an agent will post regularly, say it is one in the post or the account's profile.
• Writes take api_type: "json". Reddit's write endpoints answer with a web page unless the call passes api_type=json, in which case they return a JSON document whose json.errors list is where a refusal shows up (a subreddit that forbids links, a rate limit, a missing flair). Have the agent pass it on every posts.create, comments.create, things.edit and messages.send.
• Posts are kind: "self" or kind: "link". A text post sends text; a link post sends url. The subreddit is sr, the bare name without r/.
• Fullnames. comments.create and things.edit take a thing_id such as t3_abc123 (a post) or t1_def456 (a comment); things.delete takes the same value as id. things.info resolves a URL to one.
• Paging is by cursor. Listings return an after value; pass it back to get the next page. limit goes up to 100.
• Rate limit. Reddit allows 100 requests per minute per OAuth client, averaged over ten minutes, and answers 429 past it. Agents that page through large subreddits are the usual cause.
• Text comes HTML-escaped unless you ask otherwise. Reddit escapes <, > and & in every text field by default; pass raw_json: 1 on a read to get the text as written.
• Reddit's terms. The Data API is free for non-commercial use within those limits. A commercial use, or anything above them, needs Reddit's approval first; this connector does not change what Reddit permits, only who holds the token.