Reddit Bot Rules in 2026: What Automation Is Actually Allowed

Reddit's bot rules changed twice in twelve months, and almost nothing written about them has caught up. Search the question today and the first result is a community etiquette wiki written years before either change, the fifth is a thread from more than a decade ago, and the two editorial pages in the top ten are both tutorials about how to build a bot rather than references about what a bot is allowed to do. This page is the reference: what Reddit permits, what needs approval, what is prohibited, and the primary source and the number behind each one.

Not affiliated with Reddit Inc. redditapis.com is an independent third-party REST proxy for Reddit's API. This reference quotes Reddit's own policy documents directly so you can check every claim against the source, and it describes the native access path and a managed path side by side.

---

TL;DR: Reddit allows bots. It says so in its own policy, which calls automation "not inherently bad" and notes that thousands of apps help moderators run communities. What changed is process, not permission. Since 11 November 2025 self-service API access is closed and every new OAuth credential needs a reviewed request under the Responsible Builder Policy. Since 31 March 2026 automated accounts carry a visible App label. The free tier is 100 queries per minute per OAuth client id, averaged over a 10-minute window, and traffic without OAuth is blocked rather than throttled. Reading, commenting, posting and moderating as a labelled app are permitted. Direct messages need explicit user consent. Vote and karma manipulation, repeated content across subreddits, reselling data, and training a model on Reddit content without written approval are prohibited, the last of those for non-commercial projects too.

---

What this page covers:

• The two rule changes that decide the answer in 2026, with dates and primary sources
• The permitted surface, stated as permissions rather than as a list of bans
• What approval requires, and what developers report about the queue
• Every published limit a bot runs against, including the chat ceilings most guides omit
• The deletion and AI-training duties that catch teams after they ship

THE ANSWER IN ONE PANEL

What Reddit Automation Permits in 2026

Read off the policy text

FREE-TIER CEILING

100 QPM

SELF-SERVICE CLOSED

2025-11-11

APP LABEL LIVE

2026-03-31

Reading public posts and comments with an approved credential

Running a moderation bot, posting and commenting as a labelled app

Using the Reddit wordmark, in the form X for Reddit

Direct messages without explicit user consentConsent rule, not a volume rule

Training a model on Reddit data, commercial or notNeeds written approval

Vote or karma manipulation, evading blocks or bansNamed explicitly as prohibited

Each row traces to a named clause in the Responsible Builder Policy or the Data API Terms, quoted in full in the sections below, so this panel is a summary of cited rules rather than an interpretation of them.

The three numbers every Reddit bot runs against

---

Self-Service Access Closed on 11 November 2025

The most consequential fact for anyone reading this question today appears in almost none of the pages that rank for it. On 11 November 2025, Reddit admin u/redtaboo posted to r/redditdev:

Starting today, self-service access to Reddit's public data API will be closed. Anyone looking to build with Reddit data, whether you're a developer, researcher, or moderator, will need to request approval before gaining access.

The same post confirmed the other half, which matters just as much and gets quoted far less often:

That said, current access won't be affected, so anyone acting within our policies will keep their access and integrations will keep working as expected.

So this was not a shutdown. It was a gate placed in front of new credentials, with existing ones grandfathered. If your bot had a working client id on 10 November 2025 and you have stayed inside the rules, nothing about your setup broke. If you went to create a new app on 12 November, you hit a redirect.

That redirect is the symptom most people arrive with. You open reddit.com/prefs/apps, click the button to create an app, and instead of a client id you get bounced to a policy page with no error message. It produced a run of near-identical threads across r/redditdev and r/help through 2026, with titles like "Stuck in prefs/apps loop / Responsible Builder Policy redirect", "Trouble creating Reddit app, only seeing Responsible Builder Policy page", and "can't create API app, page reloads with Responsible Builder Policy". Every one of them describes the same thing, and none of them is a browser problem. It is the policy working as designed.

The announcement itself is worth reading in full, because the developer discussion under it is the clearest available picture of what changed. So is a thread from six months later, where a developer trying to create an ordinary script app for an n8n workflow describes the loop exactly as it presents:

r/

r/redditdev·u/Correct-Plane-5400

Stuck in prefs/apps loop / Responsible Builder Policy redirect when trying to create an n8n Script App

00

Open on Reddit

Two things about the reception are worth recording as data rather than as impression. First, the thread carries an upvote ratio of 0.28, read off the post object on 1 September 2026. An official announcement in a platform's own developer subreddit sitting at roughly a quarter positive is unusual, and it tells you the change landed badly. Second, and more useful, the top comment is not an objection to the rules. It is u/Watchful1, at 61 points, asking about the process:

I'd also like to ask about the actual process for requesting access. No offense to all the hard working admins, but reddit is notorious for never responding to form applications like this. [...] Can you commit to a SLA for responses? Even if it's like a week or something equally generous. And can you please always respond, even if it's a no, instead of just never replying? I'm definitely a fan of requiring responsible API access, but I'm really worried this is just a way to blackhole requests and let the API slowly die.

That is the shape of the whole market reaction. u/shiruken, at 16 points, put the same worry more briefly: "We all know the commercial API access request form is where projects go to die." The complaint is about response times, not about being asked to follow rules. Keep that distinction in mind, because it is also the difference between a page that lectures you about compliance and a page that tells you what the permitted surface is.

The five steps between an idea and a compliant credential

---

What the Responsible Builder Policy Actually Says

The Responsible Builder Policy is a help-centre article, last updated 5 June 2026, and it is short enough to read end to end in about ten minutes. It is also the document that decides whether your project is viable, so reading it is worth those ten minutes more than reading any summary, this one included.

It opens with four principles, and the first is the gate:

Approval is required: You must request access and get explicit approval before accessing any Reddit data through our API, and you must agree to comply with all applicable terms.

The second is the anti-masking rule, and it has a specific consequence people miss:

Be transparent: You must not misrepresent or mask how or why you are accessing Reddit data. This prohibits registering multiple accounts or submitting multiple requests for the same use case.

Read that second sentence carefully. Submitting the same use case twice, from two accounts, is itself named as a violation. If your first request was rejected or ignored, the instinct to re-apply from another account is the instinct the policy explicitly forecloses. Several of the r/redditdev threads describe people applying twice and hearing nothing, and while re-applying with the same account and a better description is a different act, the policy is unambiguous about the multiple-account version.

The third is the limits rule, phrased generally with no number attached:

The third principle is headed "Respect the limits", and paraphrasing rather than quoting it here: it forbids working around or exceeding access limits, and forbids excessive usage that disrupts Reddit's APIs or the networks behind them. No number is attached to it anywhere in the policy.

The numbers live somewhere else, in the Data API Wiki, which is one of the reasons this question is hard to answer from a single page. The policy that governs you states no rate limit; the technical page that states the rate limit says the policy governs in a conflict.

The scope sentence is the one that decides whether this document is about you at all:

This section applies to all users and developers who use or develop apps, including bots, AI agents, or non-human operated accounts, with Reddit data. All apps must also abide by the Moderator Code of Conduct.

Two details there. "AI agents" is named explicitly, which settles a question a lot of teams have been asking since agent frameworks started shipping Reddit tools. And the Moderator Code of Conduct is applied to every app, not only to moderation bots, which is a broader hook than most developers realise they are agreeing to.

---

The Permitted Surface: What You Can Still Build

Every editorial page currently ranking for this query is organised around not getting banned. One of them says so in its title. That framing is the reason those pages feel thin: a list of prohibitions cannot tell you whether your specific project is viable, and viability is the actual question.

So here is the inverse, read off the same documents. These things are permitted.

Reading public posts and comments. With an approved credential, reading is the ordinary case the API exists for. Nothing in the Responsible Builder Policy restricts read volume beyond the general limits rule and the published rate limit.

Running a moderation bot. The policy carves out moderator access explicitly, with a scope condition: "Your data access is granted solely for the purpose of performing moderation actions on Reddit. You must not use your moderator status for any application or functionality outside of these moderation purposes." Your mod credential is for moderation, and a mod credential used to power an unrelated analytics product is outside its grant. Commercial scope is a separate question with its own answer, covered in the commercial licensing guide.

Posting and commenting as a labelled app. The App label announcement is unambiguous that this is expected behaviour, not a tolerated exception. Reddit's own words: "automation isn't inherently bad. Thousands of apps on Reddit help moderators run communities, surface helpful information or create new experiences like games for redditors."

Using the Reddit wordmark, in one specific form. This one surprises people, because the assumption is that trademark use is simply forbidden. The Data API Terms, effective 19 June 2023 and last revised 20 July 2026, grant it:

Reddit hereby grants to you a non-transferable, non-sublicensable, nonexclusive license while the Data API Terms are in effect to use or display "Reddit" wordmark, so long as you use "for" preceding such use (e.g., "[insert name] for Reddit").

So "Digest for Reddit" is licensed. "RedditDigest" is not. That is a naming decision worth making before you buy a domain rather than after.

Binding your employer. Section 1.2 of the Data API Terms, which sits alongside the OAuth flow you will implement either way, recognises that an individual can accept the terms on behalf of an entity, which means there is a company access path and not only an individual-hobbyist one.

Bursting above the rate limit, briefly. The averaging window is a permission, not a footnote. More on that below.

Allowed, conditional, prohibited, read off the policy text

The pattern in that map is worth stating plainly, because it is the answer to the head question. Reddit's rules are not about whether software may act on the platform. They are about three things: whether the operator is identified, whether the account is honestly labelled, and whether the behaviour would be abusive if a person did it. A bot that is approved, labelled and behaving like a good community member has a large permitted surface. A bot that hides what it is has almost none, no matter how modest its request volume.

---

What Approval Actually Requires

The policy sets the bar but does not publish a rubric, so what follows separates what Reddit states from what developers report. The two are different kinds of evidence and mixing them is how bad advice gets written.

What Reddit states. Access must be requested and explicitly granted before any call. You must not mask how or why you are accessing data, and you must not submit multiple requests for one use case. Your app "should have a clearly specified purpose and scope of access, only accessing the subreddits and API actions they need and which are permitted". Contact details are required and, per section 1.3 of the Data API Terms, "must be up to date and accurate at all times". Commercial use is a separate approval: "If you'd like to use Reddit data for commercial purposes, you'll need to get explicit written approval."

The announcement routed requests into three named categories, and picking the wrong one is a slow way to fail. Developers whose use case is not supported by Devvit file an enterprise-type request. Researchers file a research-type request and may be routed to the Reddit for Researchers programme. Moderators file a moderator-type request when Devvit does not cover the tool they need. Reddit's stated preference sits behind all three: "Developers should use the Developer Platform ("Devvit") to build apps on Reddit." Devvit is documented at developers.reddit.com, and everything built on it is additionally bound by the Developer Terms.

That preference is the friction point for anyone with an existing codebase, and u/emily_in_boots put the cost of switching away from PRAW concretely at 18 points in the announcement thread:

Some of us prefer to use PRAW because we have an existing code base and it's just easier to implement. I might be able to implement something in a few minutes with PRAW that would take days or weeks with devvit because of my existing code base. Will this now be restricted? These are moderation tools. They are not pretending to be people.

What developers report. This is the part to read with appropriate scepticism, because it is self-selected: people who get approved rarely post about it, and people who are stuck post repeatedly. With that caveat, the reports are consistent across three platforms and eight months.

On r/redditdev, threads titled "Anyone else struggling to get Reddit Data API approval after the new Responsible Builder Policy" and "Academic API Access Rejected (Responsible Builder Policy)" describe detailed applications, aligned with the policy, being declined without a stated reason. u/LurkyRabbit, at 8 points on the App label thread, described the pattern:

Reddit Dev seems to be dead. Any request to make an app for reddit outside of for a specific subreddit is just ignored for weeks if not months on end before getting denied (this seems to be everyone else's experience talking about it here).

On Hacker News, a developer shipping a desktop tool wrote in December 2025: "Getting API approval now takes weeks or never happens." On X, a solo developer applying in February 2026 compared it to another platform's process:

Applying for Reddit API approval for RawBot. I managed to get approved for Google's Business Profile API last year as a solo developer, which I thought was pretty impressive. It took me like a year and 4 attempts to get it. They literally give you no feedback, you just have to guess what they're looking for, lmao.

Here is the honest gap in the evidence, stated rather than papered over: across every thread and post collected for this reference, nobody described a successful approval and explained what worked. That absence is itself the finding. It means any "here is how to get approved" checklist you read, including one written here, would be reasoning from rejections rather than from acceptances. What can be said with confidence is what the policy asks for, and the most common shape of a rejected application in these threads is one where the purpose and the scope were broad rather than narrow.

The practical reading: name one use case, name the specific subreddits, name the specific endpoints, and ask for the smallest access that does the job. That is not a trick, it is a restatement of the scope clause, and it is the only part of the process Reddit has actually written down.

---

The App Label Made Disclosure Structural

Four months later, on 25 March 2026, Reddit announced the other half of the current rules, and the reception could not have been more different. This announcement carries an upvote ratio of 0.93. Same subreddit, same admin team, four months apart, and a swing from roughly a quarter positive to roughly nine tenths.

The change itself, from the announcement:

Starting March 31st, accounts that use automation in allowed ways (what many call "good bots") will be known as "apps" and show a clear App label. This label will apply to apps built on Reddit's Developer Platform as well as other non-violating automated accounts we've identified across Reddit.

There are two label variants, and the distinction matters for how your account reads to a moderator. "Developer Platform App" marks apps built on Devvit. Plain "App" marks automated accounts not hosted on the Developer Platform that Reddit has either identified or that have registered. Registration happens at developers.reddit.com/app-registration, and in the announcement thread the admin confirmed a detail the images did not make obvious: the label renders on posts and comments, not only on the profile.

The Responsible Builder Policy states the same duty from both directions. Apps "must register and create a developer profile to get an App profile label", and a second clause, paraphrased here because of its wording, forbids working around any labelling Reddit applies. So there is an obligation to obtain the label and a separate obligation not to defeat it.

Reddit also asks for account separation: "App accounts should solely be used to perform app functions (no mixed use accounts)." If you have been running occasional scripted actions from the account you also comment from, that is the pattern being discouraged. In the thread, u/emily_in_boots asked exactly this, describing a custom moderation queue written in PRAW run from a personal account, and the admin's answer is worth having:

In a perfect world, we'd love for automations to run only on app accounts. I wouldn't worry about good moderation scripts for right now!

That is a first-party clarification that does not appear in the written policy, and it should be treated as what it is: an admin's guidance in a thread, softer than the policy text, and not something to build a business on. The written rule still says no mixed use.

What is genuinely surprising about this announcement is how much the developers who write bots wanted it. u/shiruken, the same person who called the commercial access form "where projects go to die", opened with "Finally! I think this has been asked for for at least a decade!" u/tinselsnips argued the label did not go far enough:

This absolutely should be inline with the username on submissions/comments, not strictly in the profile/on hover. If these are in fact all "good bots", there should be zero problem indicating this directly with the username.

And u/emily_in_boots, who writes bots, volunteered for it:

I have written bots but they do not pretend to be humans. There's no reason I can think of why bots should pretend to be humans.

If you are weighing whether disclosure costs you something, that is the room you are in. The developers already shipping on this platform treat labelling as an asset rather than a tax, and the people you most need to not annoy, the moderators, are the ones who asked for it.

Disclosure became structural rather than voluntary

The announcement also signalled what comes next, and it is worth planning for:

Accounts running automations that haven't registered their app will be prompted to complete a simple, privacy-preserving verification flow to check whether there's a human behind the username. [We'll be doing this through things like passkeys and will test other solutions with third-party partners as well.]

An unregistered automated account is therefore on a path toward a human-verification prompt. Registering ahead of that is the cheaper order of operations.

---

The Limits a Compliant Bot Runs Against

The published numbers live in the Data API Wiki, updated 11 May 2026, and that page carries its own status disclaimer worth knowing about: it notes that some legacy documentation may be out of date and that the Developer Terms and Data API Terms govern. So these are the operative technical figures, subordinate to the contract.

The headline free-tier limit:

Published free-tier limits, and where each number comes from

Limit	Published value	Scope	Source	Source
Data API requests	100 queries per minute	Per OAuth client id	Data API Wiki	published
Rate-limit averaging window	10 minutes	Rolling, allows bursting	Data API Wiki	published
Chat messages, per recipient	2,000 per day	Per recipient account	Data API Wiki	published
Chat messages, total	3,000 per day	Per account	Data API Wiki	published
Chat rooms joined	300 per day	Bot API users	Data API Wiki	published
Unauthenticated traffic	Blocked	No anonymous tier exists	Data API Wiki	published
Recommended deletion window	48 hours	Stored user data and content	Data API Wiki	published

as of 2026-09-01

We enforce rate limits for those eligible for free access usage of our Data API. The limit is: 100 queries per minute (QPM) per OAuth client id

And the averaging window, which is a permission rather than a restriction:

QPM limits will be an average over a time window (currently 10 minutes) to support bursting requests.

Read those two together and the operational picture is different from a hard per-minute cap. Your budget over ten minutes is roughly a thousand requests, which is the arithmetic behind the throughput ceilings in the rate-limit reference, and spending three hundred of them in one minute to backfill a thread and then idling is within the design. The word "currently" is doing real work in that sentence, so do not hardcode ten minutes as a constant you never revisit.

The limit that surprises people is what happens without OAuth:

Traffic not using OAuth or login credentials will be blocked, and the default rate limit will not apply.

There is no anonymous tier. Older guides describe an unauthenticated allowance, and in the announcement thread the founder of Pushshift asked about exactly that, "How does this affect anonymous access to the API (100 requests over 10 minutes)?" The current answer on Reddit's own page is that unauthenticated traffic is blocked outright rather than served slowly. If your fallback plan was "drop to anonymous when the token expires", that plan does not exist any more. What a 429 looks like when you hit it, and how to recover, is covered in the rate-limited error guide.

Chat has its own ceilings, and these are the numbers most bot guides omit entirely:

Free access usage also includes the following rate limits for chat messages: 2,000 messages per day per recipient, 3,000 messages per day total

Plus a separate room limit: "Bot API users can join up to 300 chat rooms per day."

The message limits a bot hits before it hits the rate limit

There is also a stated escalation path for one category, which is more than exists for most: "If you believe your mod bot needs to exceed these updated rate limits, or will be unable to operate, please reach out using our contact form." A moderation bot that genuinely cannot function inside 100 QPM has somewhere to ask. A commercial product does not; that conversation is the separate-agreement one under section 3.1 of the Data API Terms, which treats "research in excess of rate limits" the same way it treats commercial use.

---

Read the Rate-Limit Headers, Do Not Count Requests

The limits rule in the Responsible Builder Policy, paraphrased, forbids working around or exceeding access limits. The Data API Wiki tells you how to know where you stand, and it is three response headers rather than a counter you maintain:

Monitor the following response headers to ensure that you're not exceeding the limits: X-Ratelimit-Used: Approximate number of requests used in this period. X-Ratelimit-Remaining: Approximate number of requests left to use. X-Ratelimit-Reset: Approximate number of seconds to end of period.

The REST and PRAW comparison covers which of the two handles this for you. Counting requests client-side goes wrong for a reason that has nothing to do with your arithmetic. Your process is not the only consumer of that client id. A second worker, a retry you forgot about, a colleague's local run against the same credential, all of it lands in the same bucket, and only the server knows the total. The headers are the server's answer. Note also that Reddit calls all three "approximate", so treat them as a live signal to pace against rather than as an exact ledger.

Here is the pattern that keeps a bot inside the window without guessing:

import os
import time
import requests

SESSION = requests.Session()
SESSION.headers.update({
    # The Wiki's required format: <platform>:<app ID>:<version> (by /u/<username>)
    "User-Agent": "python:com.example.mybot:v1.4.0 (by /u/your_username)",
    "Authorization": f"Bearer {os.environ['REDDIT_TOKEN']}",
})

# Keep a floor of spare budget so a burst never lands you at zero.
RESERVE = 10

def get(url, **kw):
    resp = SESSION.get(url, timeout=30, **kw)

    remaining = resp.headers.get("X-Ratelimit-Remaining")
    reset = resp.headers.get("X-Ratelimit-Reset")

    if remaining is not None and reset is not None:
        # Values arrive as strings and remaining is a float on this API.
        if float(remaining) <= RESERVE:
            # Sleep to the end of the window rather than a fixed backoff.
            time.sleep(float(reset) + 1)

    if resp.status_code == 429:
        # Respect Retry-After when Reddit sends it; fall back to the window.
        wait = resp.headers.get("Retry-After") or reset or 60
        time.sleep(float(wait) + 1)
        return get(url, **kw)

    resp.raise_for_status()
    return resp

Two details in that snippet are policy compliance rather than engineering taste. The User-Agent string follows the format the Wiki specifies:

<platform>:<app ID>:<version string> (by /u/<reddit username>)

Reddit's guidance on default library user agents is more precise than the folklore. They are not banned; they are throttled harder. In the Wiki's words, "Many default User-Agents (like "Python/urllib" or "Java") are drastically limited to encourage unique and descriptive user-agent strings." So shipping with python-requests/2.31 will not get you a policy violation. It will get you a fraction of the throughput you expected and a debugging session that blames the wrong thing.

The other detail is the instruction that follows it in the Wiki, which is short and absolute: "NEVER lie about your User-Agent." That is the same rule as the Data API Terms section 2.8, which says "you will not misrepresent or mask either the user agent or OAuth identity when using the Data APIs", and the same rule as the Responsible Builder Policy's anti-masking principle. Three documents, one rule, stated three times. When a platform repeats itself that precisely, that is the rule it enforces.

One more clarification from the Wiki that saves an argument: "Our robots.txt is for search engines, not Data API users." If someone on your team is reasoning about API access from Reddit's robots.txt, they are reading the wrong document. Crawler rules and API rules are separate systems here.

---

Direct Messages: Consent Is the Rule, Not Volume

This is the section that changes what many teams are planning to build, so it is worth being exact.

The Responsible Builder Policy states the rule in one sentence:

Apps must get a user's explicit consent to engage in private communications.

And separately, in the prohibited list:

Apps must not engage in spamming activity through automated posts, comments, or direct messages.

Notice which of those is the binding one. The chat ceilings published in the Wiki are 2,000 messages per day per recipient and 3,000 per day in total. A team reading only those numbers concludes that automated outreach is permitted up to three thousand a day. The consent clause says otherwise: the question is not how many messages you send, it is whether the recipient agreed to receive them. A single unconsented cold direct message is outside the policy. Three thousand consented notifications a day to users who opted into your app are inside it.

That distinction rules out cold direct-message prospecting on Reddit as a compliant pattern, at any rate. It is worth saying plainly because the pattern is widely sold: there are open job posts on Reddit itself looking to hire someone to build "automated bots that can reply to comments" across platforms, priced at a hundred dollars.

If you are weighing whether to build DM outreach anyway, the honest framing is that you would be building on the one clause in this policy with no volume threshold to hide behind. Every other rule has a number you can stay under. This one does not, because consent is binary. There is a fuller treatment of what compliant Reddit messaging automation looks like in the DM automation guide, and of the outreach patterns that survive the rule in the lead-generation comparison.

What remains permitted, and it is a lot: replying in public threads where the conversation is happening, commenting as a labelled app with a disclosed affiliation, posting content that a subreddit's own rules allow, and messaging users who have installed or authorised your app. If your growth plan depends on the first three, the rules are not in your way. If it depends on unsolicited DMs, the rules are the whole obstacle and no rate limit changes that.

---

What You Must Delete, and When

Data retention is where compliant-looking systems quietly fall out of compliance, because nothing fails at the moment you break the rule. The Data API Wiki is specific:

You must remove any user content in your possession that has been deleted from Reddit.

• When posts and comments are deleted, you must delete all content related to the post and/or comment (e.g., title, body, embedded URLs, etc.).
• When a user account is deleted, you must delete all related user ID info (e.g., t2_*). You must also delete all references to the author-identifying information (i.e., the author ID, name, profile URL, avatar image URL, user flair, etc.) from posts and comments created by that account.
• To best comply with this policy, we strongly recommend routinely deleting any stored user data and content within 48 hours.

Three things about that. The account-deletion clause is broader than the post-deletion clause: when an account goes, you strip author-identifying fields from every post and comment that account ever made, not just from the account record. The 48 hours is phrased as a recommendation while the deletion duty itself is mandatory, so the honest reading is that 48 hours is Reddit's suggested cadence for meeting an obligation that has no published grace period.

And then the sentence that catches the most teams:

Note that retention of content and data that has been deleted, even if disassociated, de-identified or anonymized, is a violation of our terms and policies.

Anonymisation is not a safe harbour here. A pipeline that hashes usernames and keeps the comment bodies forever is still retaining deleted content. If your architecture assumed that stripping identifiers made a dataset permanent, that assumption is contradicted directly.

The Data API Terms add a duty at the other end of the relationship, in section 6:

Upon any termination of the Data API Terms or discontinuation of your access to the Data APIs, you will immediately stop using the Data APIs, delete any cached or stored User Content and Materials that were permitted or transferred via the Data APIs and stop any further distribution or updates of any mobile applications. [...] This includes any data or models that were derived from User Content and Materials that were accessed from the Data APIs or our other Services.

The final clause reaches derived models. If access ends, the obligation extends past the corpus to anything trained on it. That is a materially different risk profile from "we keep a copy of what we downloaded", and it belongs in the design conversation rather than in a legal review after launch.

The practical build implication is simple and cheap if you do it early and expensive if you do it late. Store the Reddit id as the primary key for every record, keep a deletion-check job that re-reads ids on a schedule and purges what has gone, and make the purge cascade to derived artifacts: your search index, your embeddings, your caches, your analytics tables. Retrofitting a cascade into a system that never had one is the part that costs weeks.

---

AI Training, Research, and the Two Rules Teams Get Wrong

Two clauses in this policy are stricter than the common assumption, and both are easy to breach without noticing.

The first is that the AI-training restriction is not only about commercial use. The Responsible Builder Policy says:

You must not sell, license, share, or otherwise commercialize Reddit data without express written approval. This extends to commercial and non-commercial mining, scraping, or using data for purposes like ads targeting or to train machine learning or AI models.

Read the second sentence on its own. "Commercial and non-commercial" modifies mining, scraping and model training alike. A weekend fine-tune on a corpus of r/askscience threads, published for free, is inside the scope of that clause. The Data API Terms say the same thing from the licensing side, in section 2.4:

Except as expressly permitted by this section, no other rights or licenses are granted or implied, including any right to use User Content for other purposes, such as for training a machine learning or AI model, without the express permission of rightsholders in the applicable User Content.

Note the last four words. Permission has to come from the rightsholders in the content, which for user-generated posts and comments is a harder set to obtain from than Reddit alone. Section 3.2 repeats the ban a third time inside the illegal-activity clause. Three statements of one rule across two documents is not accidental drafting.

There is a distinction here that matters for anyone building with language models, and it is worth stating because the policy does not spell it out. Reading Reddit at query time, putting the retrieved text in a prompt, and answering a user is a different act from training weights on Reddit content. The clauses above are about the second. Retrieval augmented generation over live API reads, the pattern behind most Reddit MCP and agent integrations, is governed by the ordinary access rules: be approved, stay inside the limits, delete what gets deleted. If you are building an agent that reads Reddit to answer a question, you are in the first category. If you are building a dataset, you are in the second and you need written approval.

The second is the research rule, and it is the one academics keep hitting. The Responsible Builder Policy carves out approved participants in the Reddit for Researchers programme, subject to retention conditions:

Researchers must not retain copies of data beyond what is strictly necessary for the immediate research project. Researchers must re-run queries against the most recent data export to ensure findings are up-to-date with any data removals or deletions.

Then it closes the door on the alternative, in a clause paraphrased here: research that uses Reddit data collected outside the Reddit for Researchers programme breaches this policy.

That is stricter than most researchers expect. Collecting via the ordinary Data API for an academic project, with a perfectly valid credential, is named as a policy violation because the collection did not happen inside the research programme. It also explains the r/redditdev thread titled "Academic API Access Rejected (Responsible Builder Policy)", where a master's student describes detailed, policy-aligned applications being declined. If you are doing research, the route is the research request and the programme, not the developer request with a research use case attached.

The re-run clause is quietly demanding too. It means a research dataset is not a snapshot you analyse once. It is a thing you refresh against the current export so that deletions propagate into your findings, which changes how you write your methods section as well as how you write your pipeline.

---

Subreddit Rules Are a Second, Independent Gate

Everything so far is platform permission. It is not the only permission you need, and this is the failure mode that no policy document covers because it is not Reddit's to cover.

A subreddit can ban your bot even when your bot is fully compliant. Moderators set their own rules under the Reddit Rules and their own judgement, and plenty of communities ban all non-mod automation on principle. In the App label thread, u/baseballlover723 spelled out the collision at 8 points:

Our entire mod team exclusively uses old reddit and we ban all bots (that aren't mod run), even the good ones. Us missing a bot that is publicly labeled as such (when that is explicitly against the rules) to the rest of the community undermines our rules.

Read that from the moderator's side and it is entirely reasonable. Read it from the builder's side and it is the thing that decides whether your product works: platform approval buys you a credential, and community approval buys you a place to use it. Communities are also actively tightening, and if you are automating through a workflow tool the n8n guide and the no-code tools comparison both cover where those checks belong. Since 2026 there is a steady flow of subreddits adding explicit AI and bot content rules, adding "bot account" as a report reason, and posting mod transparency updates about mass bot bans.

The good news is that community rules are machine-readable, which means the check belongs in your code rather than in a spreadsheet. Every subreddit publishes its rules as structured JSON, so a bot can read the rules of the place it is about to post in before it posts:

def subreddit_rules(name):
    # Native path: https://www.reddit.com/r/<name>/about/rules.json
    resp = get(f"https://oauth.reddit.com/r/{name}/about/rules")
    data = resp.json()

    community = data.get("rules", [])
    sitewide = data.get("site_rules", [])
    return community, sitewide

def mentions_bots(rules):
    needles = ("bot", "automat", "ai-generated", "ai generated", "llm")
    hits = []
    for r in rules:
        blob = f"{r.get('short_name','')} {r.get('description','')}".lower()
        if any(n in blob for n in needles):
            hits.append(r.get("short_name"))
    return hits

community, _ = subreddit_rules("python")
flagged = mentions_bots(community)
if flagged:
    print("Read these before automating here:", flagged)

That is a crude keyword pass and it is deliberately crude, because the decision it feeds is a human one. What it does is stop a fleet of workers from posting into thirty communities where three of them ban exactly what you are about to do. Cache the result per subreddit and refresh it weekly; rules change on the order of weeks and months, not minutes. There is a fuller treatment of the rules endpoint and its fields in the subreddit rules API guide.

The limit of that check is worth knowing: the public rules endpoint does not expose a subreddit's AutoModerator configuration, which enforces conditions the published rules never mention, such as a minimum account age or a karma floor. So a rules check is necessary and not sufficient. Your post can be removed by a config you cannot read, and that removal is not a policy violation on your part. It is the community exercising the control it is supposed to have.

---

What Happens When You Break a Rule

The Responsible Builder Policy lists the enforcement ladder explicitly, which is more transparency than most platforms offer:

Enforcement actions we can take include, but are not limited to: Revoking your access tokens. Suspending your app or account. Suspending associated accounts, bots, domains, or subreddits.

How developers received the two rule changes

Announcement	Date	Upvote ratio	What it introduced	Source
Responsible Builder Policy	2025-11-11	0.28	Approval gate, end of self-service access	measured
App label for automated accounts	2026-03-25	0.93	Visible bot labelling, registration route	measured

n = 2 · as of 2026-09-01

The last item is the one to read twice. Enforcement can reach associated accounts, domains and subreddits, not only the account that misbehaved. A domain-level action means the links you post stop working across the whole platform, which is a different order of damage from losing one bot account, and it is the reason the multiple-accounts workaround is a worse idea than it looks. If associated accounts are in scope, running a second account to survive the first one being caught is a way to lose both.

The Data API Terms add a permanent-block reservation in section 3.2, attached specifically to exceeding limits:

for clarity, if Reddit believes that you are in breach of this section, Reddit reserves the right to permanently block your access to the Data APIs

Note "believes". The standard is Reddit's assessment, not an adjudication, which is what you would expect in a revocable licence and is worth knowing before you plan around an appeals process.

The prohibited list itself is the shortest way to understand what triggers this. From the Responsible Builder Policy:

Apps must not engage in spamming activity through automated posts, comments, or direct messages. This includes posting identical or substantially similar content across subreddits.

The clause immediately before that one, paraphrased because of its wording, forbids manipulating Reddit's features, naming voting and karma as the examples, and forbids working around safety mechanisms, naming user blocking and account bans as the examples.

Two things there are more specific than the usual "do not spam". Circumventing user blocking is named, so a bot that routes around a block is in the same category as vote manipulation. And "substantially similar" is the standard for cross-posting, not "identical", which means paraphrasing the same promotional comment into ten communities is the behaviour being described rather than a way around it.

The Data API Terms section 3.2 adds the commercial restriction in operational language: you must not "sell, lease, or sublicense the Data APIs or access thereto or derive revenues from the use or provision of the Data APIs" without express written approval, and you must not "use or retain any User Content, Materials, or data accessed through the Data APIs beyond your approved use case, and you must immediately delete any data not required for it".

That second clause is the one that binds scope to storage. Your approved use case is not only a description you wrote on a form. It is the boundary of what you are allowed to keep.

The nine requirements, each traceable to a clause

---

Why This Question Is So Hard to Answer in 2026

It is worth a short section on why you had to read this far, because the reason is structural and it tells you something about how to keep the answer current.

• The page ranking first is a community etiquette wiki that predates every rule described here
• The two editorial pages in the top ten are build tutorials, not rules references
• The two documents that decide the answer, dated 2025-11-11 and 2026-03-25, are barely represented

Who currently answers reddit bot rules, by host

Host	Results in top 10	Type	Is it a rules reference	Source
reddit.com	7	Forum threads and a community wiki	Partly, and mostly undated	measured
yojji.io	1	How-to-build tutorial	No	measured
codewords.ai	1	How-to-build tutorial	No	measured
techcrunch.com	1	News report	No	measured

n = 10 · as of 2026-09-01

Pull the live search results for the exact phrase and count the hosts. Seven of the ten organic positions are reddit.com, split between forum threads and a community wiki. One is a news report. The two remaining editorial pages are both tutorials about building a bot rather than references about what a bot may do.

Who currently answers this question, counted by host

That composition is what a search engine does when no page matches the intent. It falls back to the places where people asked each other. The top result is a community etiquette wiki that predates every rule described on this page. The r/help thread at position five carries a five-character post id, which on Reddit's base-36 scheme places it more than a decade back. The two documents that actually decide the answer in 2026 are the Responsible Builder Policy and the App label announcement, and neither is near the top.

So the ranking is close to inversely ordered by currency, and that has a practical consequence for you rather than only for us: anything you read about Reddit bot rules that does not name a date is probably describing a regime that ended. The two dates to check any article against are 11 November 2025 and 31 March 2026. An article that mentions neither was written before the rules it is describing.

The single highest-reach statement of the change anywhere was not an article at all. It was one line posted the day after, by a builder whose own Reddit-data product was directly affected:

Robert

@rcwhiteley

Applying for Reddit API approval for RawBot. I managed to get approved for Google's Business Profile API last year as a solo developer, which I thought was pretty impressive. It took me like a year and 4 attempts to get it. They literally give you no feedback, you just have to h… Show more

That is a solo developer in February 2026 comparing Reddit's process to another platform's, and the comparison is not flattering to either. The other reaction worth reading is the one that blames builders rather than Reddit:

Neel Seth

@NeelSeth7

Spam Bois have reached almost everywhere now. This is from a community of 5k members. The reason spam Bois start spamming is because they are dumb, and they don't know it, they feel that oh wow such a crazy idea I can use AI to find stuff automatically talk to people and http… Show more

That reading is factually loose in one way worth correcting, since the correction is useful to you: it was not a blanket ban, and existing access was explicitly preserved. The causal story is not wrong though. The gate exists because unconsented automated messaging at scale is what the platform was absorbing.

If you would rather watch someone build one end to end before deciding whether the rules fit your project, this walkthrough covers the mechanics the policy sits on top of:

The developer reaction to the two changes is the other piece of evidence worth carrying, and it is measurable rather than impressionistic. The access announcement sits at a 0.28 upvote ratio. The labelling announcement sits at 0.93.

The same audience, four months apart, on the two halves of the current rules

Read those two bars together and you have the market's own summary of this policy. Developers did not object to being asked to identify their bots. They objected to a gate with no published response time. If you are deciding how to feel about building on Reddit in 2026, that is a more useful signal than any single complaint thread.

---

The Two Access Paths, and What Each One Costs

There are two ways a request reaches Reddit data, and the rules above apply to both. That last point is the one worth being precise about, because it is where a lot of wishful thinking lives.

The native path is your own approved OAuth app calling Reddit directly. The gate is the approval request. Reddit's free tier covers non-commercial use at 100 queries per minute, and commercial access is a separate agreement, reported at roughly $0.24 per 1,000 calls on a $12,000 a year contract with an approval cycle measured in weeks, which the pricing breakdown works through in full.

The two access paths, side by side

	Reddit's own Data API	A managed REST layer	Source
Approval to start	Reviewed request required since 2025-11-11	No app-approval review	published
Free tier	100 queries per minute, non-commercial	$0.50 in credits at signup	published
Read pricing	About $0.24 per 1,000 calls commercially	$0.002 per read call	published
Commercial commitment	Reported $12,000 a year contract	No subscription, no minimum spend	published
Write and vote calls	Same OAuth credential	$0.012 writes, $0.005 votes, $0.025 DMs	published
Who the rules bind	You	You, on the same terms	derived

as of 2026-09-01

The managed path is a REST layer that holds approved credentials and gives you a bearer token against a single base URL. On redditapis.com (pricing) a read call is $0.002, a write is $0.012, a vote is $0.005 and a direct message is $0.025, billed per request with no subscription and no minimum spend, plus $0.50 in free credits at signup (pricing) and no app-approval review to clear first. Those figures were read from the deployed pricing source rather than from another article, because a stale price is the most expensive kind of error a page like this can make.

Where the approval gate sits in each path

Here is what a managed layer does not do, stated plainly because the opposite is often implied. It does not absorb your obligations. The Data API Terms bind whoever accepts them, and the Responsible Builder Policy governs how Reddit data is used, not only how it is fetched. Routing through someone else's credential does not make unconsented direct messages consented, does not make vote manipulation permissible, and does not put a training corpus inside a licence it was never granted. What it changes is the operational shape of the problem: who queues for approval, who maintains token rotation, who watches the rate-limit headers, and who carries the cost of a pool going stale.

On Hacker News, one commenter framed the decision as three options, and it is the most honest summary of the situation anyone has written:

Now if you want to make any app or bot, you either screen-scrape, steal an API key, or get the approval of Reddit management.

Two of those three are not options for anything you intend to run as a business. Screen-scraping puts you outside the terms you have probably already accepted somewhere, and the legality of scraping Reddit is a narrower question than it is usually presented as. It also collides with a point another commenter made in the announcement thread, that a dedicated API exists partly because it is cheaper for both sides than serving rendered pages to scrapers. Using someone else's key is not a strategy, it is a countdown. The third option is the durable one, and a managed layer is a way of taking the third option without personally sitting in the queue.

There is a genuine counter-argument that deserves a straight answer rather than a dismissal, because a developer made it at 14 points in the announcement thread:

"Let you" is a strong one. Public data is public and hence is scrapable. They can definitely try to make it harder to scrape, but it is definitely not up to them to "let you" do anything.

As a claim about capability that is correct, and as a claim about the law on public data it reflects a genuinely unsettled area. It is not, however, an answer to the contract question. Reddit's Data API Terms bind you because you accepted them, and a licence you accepted is not defeated by an argument about what is technically possible. The practical difference for anyone building a company is who carries the risk when the two views collide, and the answer is you, not the person who posted the comment.

The date that changed the answer to this question

---

A Checklist to Run Before You Ship

Ten checks, each traceable to a clause quoted above rather than to general advice.

1. Is your credential approved? Requested and explicitly granted, under the category that matches your use case: developer, researcher or moderator.
2. Is your purpose narrow and written down? Named subreddits, named endpoints, the smallest access that does the job. Breadth is the most common shape in the rejection threads.
3. Is the app registered? Registration is what produces the App profile label, and an unregistered automated account is on the path to a human-verification prompt.
4. Is the automation on its own account? App accounts perform app functions. Mixed use is the pattern Reddit is discouraging.
5. Does your User-Agent follow the format, and is it true? <platform>:<app ID>:<version> (by /u/username). A default library string will be throttled hard, and a false one violates three separate documents.
6. Are you reading the rate-limit headers? X-Ratelimit-Remaining and X-Ratelimit-Reset, not a counter you maintain, because you are not the only consumer of that client id.
7. Does every private message have consent behind it? The chat ceilings are not permission. Consent is.
8. Does deletion cascade? Reddit ids as primary keys, a scheduled re-read, and a purge that reaches your index, embeddings, caches and analytics tables. Anonymisation does not exempt you.
9. Have you checked the subreddit's own rules? Platform approval is not community approval, and the rules endpoint makes the check programmatic.
10. If a model is involved, which side of the line are you on? Reading at query time is ordinary API use. Training on the corpus needs written approval, non-commercial projects included.

If all ten are yes, you are inside the rules as written on 1 September 2026, and the remaining risk is that the rules move again. They have moved twice in the last year, so build the check into a calendar rather than treating this page as permanent. The two documents to re-read are the Responsible Builder Policy and the Data API Wiki, and both carry an updated date at the top, which makes the check a thirty-second job.

---

The Short Version

Automation isn't inherently bad. Thousands of apps on Reddit help moderators run communities, surface helpful information or create new experiences like games for redditors. But transparency matters.

Reddit allows bots and says so in its own words. It has spent the last year making two things true at once: automation is welcome, and anonymous automation is not. The approval gate that arrived in November 2025 and the App label that arrived in March 2026 are the same policy seen from two sides, and the developer community's own reaction, a 0.28 upvote ratio on the first and 0.93 on the second, tells you which half was the unpopular one and why.

The permitted surface is larger than the pages ranking for this question suggest. You can read public content, run moderation tooling, post and comment as a labelled app, and call yourself something for Reddit. The prohibitions are narrower than "no bots" and more specific than "no spam": no unconsented private messages, no vote or karma manipulation, no evading blocks or bans, no substantially similar content across communities, no reselling access, and no training a model on the data without written permission, whether or not you are charging for it.

What none of that tells you is how long your approval will take, and nobody, including Reddit, has published an answer. That is the real cost of building here in 2026, and it is a scheduling problem rather than a permission problem. Plan for it, or route around the queue with an access layer that has already cleared it, and either way build the deletion cascade before you need it. If throughput is the next question, the production benchmarks have the numbers.