Reddit API Key Safety - Rotate, Revoke and Leaked Keys

Every /api/* call is authorized by one API key, sent as Authorization: Bearer <API_TOKEN>. Anyone holding the key can spend your balance, so treat it like a password.

Keys look like this

reddit-api-<48 lowercase hex characters>

The fixed reddit-api- prefix makes our keys easy for secret scanners to pattern-match.

Store it safely

• Shown once. The dashboard shows the full key only when you create it. Copy it into your secrets manager or an environment variable then; it cannot be shown again.
• Never commit it. Keep it out of source code, git history, issues, screenshots and logs. Send it only in the Authorization header over HTTPS.
• One key per place. Create a separate named key for each app, environment or agent you give access to. Then you can revoke any one of them without touching the others.

Revoke a key

Open API keys in the dashboard, click the trash icon on the key (its tooltip reads "Revoke key"), then click Confirm. Every API call checks the key against our database, so the next call made with it is refused. Revoking is free and cannot be undone.

Rotate a key

1. Create a new key in the dashboard.
2. Put the new key wherever the old one was used, and confirm those calls succeed.
3. Revoke the old key.

Because you can hold several active keys at once, there is no window where your app has no working key.

If a key leaks

Revoke it straight away from the dashboard, then rotate as above. Until it is revoked, anyone holding the key can make calls billed to your balance, see your account email and payment history, and, if you have stored a Reddit session, post, comment, vote and send DMs as that Reddit account. It cannot sign in to your RedditAPIs account, change your email or password, create or revoke keys, or see your card details.

We are registering the reddit-api- format with GitHub secret scanning. Once that is live, a key of ours found in a public GitHub repository, gist or package will be revoked automatically, and we will email the account owner once with the key's name, its last four characters and where it was found. Your other keys keep working, and a string that matches the format but is not a key we issued is ignored. Until then, revoking a leaked key is up to you.

Report a security issue

Email emma@redditapis.com with the details and steps to reproduce. Please give us a chance to fix it before disclosing it publicly.