How to Collect Reddit Data in 2026: API Limits, Private .json, and the Role of Proxies

In May 2026, Reddit closed unauthenticated access to .json endpoints — the very trick of "adding .json to any URL" that dozens of scripts, dashboards, and pet projects relied on for years. A check on July 28, 2026: a request to https://www.reddit.com/r/webscraping/top.json?t=week with a standard browser User-Agent returns 403 Forbidden. At the same time, Reddit's robots.txt contains only two significant lines: User-agent: * and Disallow: / — referencing the Public Content Policy.

This changes not "how to bypass," but how to build a data collection pipeline for Reddit at all. Below is a working scheme for 2026: what is actually available, what the limits are, where proxies are needed, and where they won't help.

What exactly broke: a brief timeline

• June 2023 — Reddit introduced a paid plan of $0.24 for 1000 API calls for high-load applications. The consequence: the closure of Apollo (the developer estimated the cost of access at about $20 million per year), the departure of most third-party clients, and the halt of Pushshift — a public archive of posts and comments that half of academic research relied on.
• May 2026 — deprecation of unauthenticated .json. Tools that "just pulled URLs" stopped working; traffic went through Cloudflare protection with session verification.
• October 2025 — present — Reddit's lawsuit against Perplexity AI, Oxylabs UAB, AWMProxy, and SerpApi (Southern District of New York, Judge Engelmaier). Reddit accuses the defendants of industrially extracting its content through Google search results and reselling the data, citing anti-circumvention provisions of the DMCA. The first amended complaint has been filed; as of March 2026, the case is at the motion to dismiss stage. The defendants deny any violations: Perplexity calls it an attempt to close public data, while SerpApi and Oxylabs claim access to the public web is legal.

The practical takeaway from the third point is: collecting data from Reddit outside the official API is not a technical but a legal risk zone, and the cost of mistakes for a commercial project is measured not in bans, but in lawsuits. More about how courts in 2026 interpret data extraction from search results was discussed in our article on the ruling in the Google and SerpApi case.

Official Data API: real limits for 2026

This is the only path that does not create legal claims. Here are the numbers you need to know before designing:

• 100 requests per minute for an OAuth client. The window averages over about 10 minutes, meaning short bursts are acceptable.
• 10 requests per minute without OAuth — this is insufficient for anything other than debugging.
• The limit is counted per application key, not per end user. Five streams on one token do not provide five times the capacity — they simply burn through one budget five times faster.
• The free plan covers personal projects, bots, moderation tools, and academic research. There is no monetary counter, only a frequency cap.
• Commercial use requires a contract and manual approval; the rate is $0.24 for 1000 calls. According to industry estimates, the entry threshold for a commercial contract starts at about $12,000 per year.
• Training ML models on API data is explicitly prohibited by the terms of the Data API. Licenses for training are separate private contracts (Reddit's deal with Google was estimated in the press at about $60 million per year).

Headers that must always be parsed

Reddit returns three headers for each response: X-Ratelimit-Used, X-Ratelimit-Remaining, and X-Ratelimit-Reset. This is the only reliable source of truth about your budget — not a constant in the code and not an old wiki with the figure "60 requests per minute" (which became outdated back in 2023).

User-Agent requirements

Reddit expects a unique descriptive string in the format platform:app_id:version (by /u/username). Generic and empty User-Agents are strictly limited in frequency — this is the first thing to check if limits are running out sooner than expected.

Step-by-step: how to build a pipeline that doesn't fail

1. Register a script-app in Reddit settings and obtain client_id/client_secret. For read-only loads, this is the simplest type of application.
2. Set a correct User-Agent in the format above. Do not copy a string from someone else's tutorial — app_id and username should be yours.
3. Read X-Ratelimit-Remaining on every response, not just on errors. When the remaining count drops to about 20 requests, switch to a steady pace: delay per call = seconds until window reset ÷ remaining requests. This way, you spread the quota over the window instead of hitting a wall.
4. Handle 429 correctly. Take the first pause from the Retry-After header. Then, use exponential backoff with jitter: wait = 2^attempt + random(). Jitter is essential: without it, parallel clients repeat requests synchronously and cause a second cascade of failures.
5. Cache reads with TTL. Repeated requests for the same listing are the most common reason for quota drain in monitoring projects.
6. Scale by rotating tokens, not streams. Each OAuth token carries an independent counter; multiple applications on different accounts with round-robin distribution (in Python — itertools.cycle) increase throughput linearly. Important: for commercial loads, this does not replace a contract with Reddit — it is a way to fit within fair limits, not to bypass them.
7. Plan for bypassing listing caps. Reddit returns a maximum of about 1000 items per listing (100 per page, cursor after). Older content is not available through standard endpoints. The standard solution is not to "break" the cap, but to slice the sample by time and make several narrow requests instead of one broad one.
8. For historical data, look for an index, not an API. After the closure of Pushshift, its niche is filled by external indexes like PullPush (free, but without SLA) and commercial search APIs with their own index and other caps. For academic work, Reddit has a separate program called Reddit for Researchers.

Pitfalls that will be discovered too late

PRAW puts the flow to sleep but doesn't save from everything. The built-in limiter of PRAW reads headers and sets pauses itself — this works great for a single-threaded script. The current state can be seen through reddit.auth.limits. It breaks in two cases: with multithreading using shared credentials (instances do not see each other's consumption) and in async code, where blocking time.sleep hangs the event loop.

AI agents burn through the quota unnoticed. One reasoning step of the agent can easily unfold into 10–15 tool calls. Ten parallel sessions mean 100–150 simultaneous requests, which is the entire minute's budget in seconds. If you are building an agent on top of Reddit, a limiter is needed at the pool level, not at the individual call level.

Polling without backoff. Checking for updates "every N seconds" without exponential pauses is the second most common reason for 429 after a shared token.

Where proxies are really needed and where they are not

Let's be honest: proxies do not increase your limit on the official API. The quota is tied to the application key, not the outgoing IP, and trying to "multiply" it by changing the address does not work and contradicts the terms. The tasks that proxies actually solve in the Reddit pipeline are different:

• Geo-access and connectivity. Reddit is unavailable or partially restricted in several countries, and corporate networks block it as a social network. A stable outbound node in the required region is a matter of infrastructure availability, not limit circumvention. For server tasks with a constant IP, data center proxies are usually sufficient.
• Regional output. Some content and recommendations from Reddit are given based on the geography of the request; if you are analyzing what an audience in a specific country sees, you need an exit from that country.
• Infrastructure distribution. When several independent services (collection, monitoring mentions, analytics) live on the same server, a single IP becomes a common point of failure for all integrations at once.
• Working with your own accounts. For moderation, community management, and legitimate SMM activities from multiple profiles, the pairing of "account ↔ permanent IP" is basic hygiene. Here, residential proxies with sticky sessions are appropriate.

However, here’s what proxies won’t do: they won’t legalize commercial collection bypassing the contract, won’t remove the listing cap of 1000 items, and won’t cancel Disallow: / in robots.txt. The general approach to working with platform limits is discussed in the analysis of rate limiting in APIs and the role of proxies.

Conclusion

Reddit in 2026 has definitively ceased to be "an open dataset that can be accessed via .json." The working scheme looks like this: official OAuth access + honest limiter on headers + token rotation within the rules + external index for history. Proxies in this scheme are responsible for availability and geography, not for bypassing quotas — and that is the only role in which they provide predictable results.

If your project is commercial, plan your budget for a contract with Reddit in advance: the legal history with Perplexity, Oxylabs, and SerpApi shows that the platform is willing to spend significantly more on protecting its data than the cost of legal access.