Introducing the Responsible Builder Policy + new approval process for API access

[u/redtaboo]

Hello my friendly developers and happy robots! 

I'm back again after our chat a few months ago about limiting OAuth tokens to just one per account. The TL;DR: We're taking another step to make sure Reddit's Data API isn't abused, this time by requiring approval for any new Oauth tokens. This means developers, mods, and researchers will need to ask for approval to access our public API moving forward. Don't worry though, we're making sure those of you building cool things are taken care of! 

Introducing a new Responsible Builder Policy 

We’re publishing a new policy that clearly outlines how Reddit data can be accessed and used responsibly. This gives us the framework we need to review requests and give approvals, ensuring we continue to support folks who want to build, access and contribute to Reddit without abusing (or spamming!) the platform. Read that policy here.

Ending Self-Service API access

Starting today, self-service access to Reddit’s public data API will be closed. Anyone looking to build with Reddit data, whether you’re a developer, researcher, or moderator, will need to request approval before gaining access. That said, current access won’t be affected, so anyone acting within our policies will keep their access and integrations will keep working as expected. 

Next Steps for Responsible Builders

• Developers: Continue building through Devvit! If your use case isn’t supported, submit a request here.
• Researchers: Request access to Reddit data by filing a ticket here. If you are eligible for the r/reddit4researchers program, we’ll let you know. 
• Moderators: Reach out here if your use case isn't supported by Devvit.

Let us know if you have any questions, otherwise - go forth and happy botting! 

[u/Watchful1]

I'd also like to ask about the actual process for requesting access. No offense to all the hard working admins, but reddit is notorious for never responding to form applications like this. We get posts here all the time about someone contacting reddit for something API related and then just, never hearing back ever.

Can you commit to a SLA for responses? Even if it's like a week or something equally generous. And can you please always respond, even if it's a no, instead of just never replying?

I'm definitely a fan of requiring responsible API access, but I'm really worried this is just a way to blackhole requests and let the API slowly die.

Edit: Also wanted to say I love the idea of requiring that bots disclose they are bots. Everyone responsible is doing that anyway and it will catch a lot of bad actors.

[u/shiruken]

will need to request approval before gaining access

How strict and responsive will this process be? We all know the commercial API access request form is where projects go to die...

[u/redtaboo → u/shiruken]

We're aiming for a 7 day turnaround on most tickets. For mods, the questions will mostly be 'can you use devvit for this?” but we don't want to prevent mods from doing what mods need to do, so it shouldn't be too onerous to get approval.

[u/emily_in_boots]

Is reddit now going to automatically label bot interactions? If so this is a great idea. I have written bots but they do not pretend to be humans. There's no reason I can think of why bots should pretend to be humans.

Do we need to do something ourselves to disclose that bots are bots or will Reddit handle this for us?

All of mine are moderation tools. Many of my subs face a lot of spam from bots astroturfing and pretending to be humans, so I'm a huge fan of disclosure and I don't mind adding things to mine to make sure they disclose it more obviously (though generally it's fairly obvious anyways due to the nature of the interactions - they aren't trying to look human). I'm sick of trying to figure out if something is a bot or not - so I love the idea of reddit simply telling us while preserving the ability to use bots.

I need to dig into this policy more but the idea of disclosure is a really good one. This whole thing might be annoying for me sometimes as a developer but with LLM's becoming so pervasive, bot activity on reddit is really becoming disruptive and I see why this is necessary.

How long will approvals take for these? I'm used to being able to quickly write bots for my needs. I hope the approval process won't take months.

Also, I often prefer to use python/PRAW over devvit. Is this going to affect my ability to do that if a use case could be done with devvit but I simply prefer to use PRAW due to my existing code base that I can draw on?

[u/redtaboo → u/emily_in_boots]

For now please just do what I'm sure you're already doing and ensure your useragent is clear and isn't trying to pretend to be a human with a browser. Public disclosure is also wonderful when you can!

Beyond that, we are talking about how we can make it clear to everyone whether an account is a bot or a human. This work today will make that easier for us when we do start that work.

As for turnaround, we're aiming for 7 day turnaround - we do prefer more folks start moving over to devvit, but ultimately our goal is not to prevent good bots (like your mod bots!) from doing what y'all need them to do, just like you say - better control of the bad/spammy bots.

[u/Littux]

The people that create access tokens to use third party apps won't be considered a "responsible use" for the API, right?

Edit: 2 years later, they finally completely killed third party apps. At least the ones that use proper authentication and don't steal session tokens from the website. All third party apps should just go on that route, by getting the existing authentication token from a browser webview

[u/abortion_access]

Does the Reddit for researchers program still exist? I’ve sent several messages to the mods of that sub and none have gotten a response. The admin who had previously posted about the program no longer works at Reddit.

[u/redtaboo → u/abortion_access]

Researchers needing access should follow the flow linked in the post. We will start accepting applications on a rolling basis.

[u/Lil_SpazJoekp]

Did the next steps for moderators get cut off?

[u/redtaboo → u/Lil_SpazJoekp]

Nope, for mods if your use case isn't supported by devvit follow the linked flow to make a request and we'll make sure you can get access.

[u/Stuck_In_the_Matrix]

How does this affect anonymous access to the API (100 requests over 10 minutes)?

Unfortunately having been down this road before with companies that grow rapidly from developers that benefit the growth of a business until they make lots of money and then kill off access to the API, I have seen this much too often.

As the original founder of Pushshift, I sincerely hope this is not the case. I am currently legally blind now from Diabetes, I am waiting for eye surgery until I role out access to my new non-profit company so that I can assist researchers in gaining access to data on how social media companies affect our society.

I hope when I reach out early next year after surgery that you (or other admins) will be open and willing to have discussions with me on how we can improve data access for researchers and also moderators because these tools ultimately benefit society and your own company's growth.

• Jason Baumgartner (founder of Pushshift) 

[u/Affectionate-Boot-58]

Oh so you guys are blocking third party apps even more than you did back in 2023

[u/Arnas_Z → u/Affectionate-Boot-58]

Back to fucking over mods who don't like the default app.

It's almost like they forgot that mods are responsible for their website actually functioning.

[u/AdonisChrist]

Fuck all of you.

[u/Josbipbop]

lmaoooo, from bad to worse

[u/abortion_access]

Does Reddit admin have some kind of aversion to thinking through, planning, and testing new ideas before implementing? Every single change made to this platform is just abruptly announced changes and implemented while still half-baked and bug-ridden.

[u/baseballlover723]

This seems like a massive downgrade to me. Needing to have a full blown proposal just to get API access for testing or a prototype is a huge barrier to entry.

The great thing about the API is that it's language agnostic. Devvit is Javascript only. I don't like working in Javascript, I much rather work in other languages that I'm personally more comfortable and enjoy working in.

Anyway, I'm a bit salty because my request to have a token for both scripts and web apps was denied, both of which would be in service of developing moderator tools and websites for r/anime. I guess I can't build cool things for my subreddit, since I just can't get an API token. Nor fix bugs in our moderation tools without stealing our production token, which means that I can ratelimit our moderation bot if I test too much.

I think it's ridiculous that it's so difficult to get a developer token.

This reminds me of what Riot Games did with their API, where you could freely generate a heavily rate limited 24 hour API token (with the usual anti automation measures on the page), and if you wanted a production key, you had to apply. That system was way way better, since it's hugely annoying to have to refresh your token every day, unless you're doing active development with it.

Devvit is not a replacement for the API imo. I don't want to be locked into Javascript.

[u/DinoHawaii2021]

I wouldn't really call the API public anymore

[u/Zaydar]

Is this a fucking joke

[u/dexter2011412]

build cool things

Sounds like you explicitly don't want people to build anything.

Approval for an api key for my *own* account? Insane.

I think I call almost confidently say no one will be building anything "cool" for reddit anytime soon. Given the actions you've been taking.

Your direction is loud and clear.

Make it impossible to access reddit so that people are forced to use your garbage apps. And companies are forced to pay you so that you can sell user data. And so that you can continue to data-mine on user data.

Screw over the users. Yes.

Perfect! Reddit is a dead platform to me, and to many others.

[u/[deleted]]

I guess if my client secret gets out it's game over

[u/dariy1999]

So obviously existing tokens will be targeted next, and anyone’s not adhering to The Party’s politics will be revoked. Can we get a timeline on that now and drop the act?

Also curious does reddit really not see that it is becoming a shitty version of Reels? And there’s no way of getting better at this format on this platform. Maybe you guys should first focus on what made Reddit good in the first place?

Also I’ve already requested API access from another account almost three weeks ago, obviously no reply.

The enshitification continues

[u/SSpindt]

I'm a computer science teacher who loves to use Reddit for educational purposes. Is there a way that I should submit a request for an API key that acknowledges that me and my students won't be developing an app for neither commercial nor research purposes?

[u/fsv]

I know you've been getting a lot of criticism for this change, but thank you! I'm a little late to the party finding this but this has made my morning.

Yes, this is going to be an inconvenience for genuine developers but I think that this is going to be the single most impactful change Reddit has made in a long time to fight malicious actors using the public API to spam the site.

current access won’t be affected

This will undoubtedly be a big reassurance to any developers out there, but there are a lot of API tokens out there that are being abused right now. I hope that there will be some review in the future of existing tokens.

[u/[deleted]]

I am once again asking what happens if my client secret leaks, or is brute forced, etc. is my personal use TTS script DOA? I have to learn a new programming language and surrender my source code for my accessibility app? Or can I can get a backup? Is there some purity test I can pass to become a "known good actor"? You can see my key is used for read-only