Reddit API Login - Username and Password

Authenticate to Reddit with username and password (plus optional 2FA TOTP) and get the session cookies for comment, vote, and DM calls.

POST/api/reddit/login$0.012 / call

Log in to Reddit with username + password. Returns the session cookies you need to paste into /comment, /vote, and /dm.

Request Body

Field	Type	Required	Description
`username`	string	Yes	Reddit username or email
`password`	string	Yes	Account password
`totp_secret`	string	No	Base32 TOTP secret for accounts with 2FA enabled. The 6-digit code is generated server-side. Omit if 2FA is off.
`method`	string	No	`http` (default, recommended) or `browser`. `http` is the reliable path. `browser` is best-effort: Reddit currently serves our headless browser a human-verification challenge that can block it, so prefer `http` unless support tells you otherwise.
`proxy`	object \| string	No	Bring your own sticky IP for this account, `{server, username?, password?}` or a URL string. Omit to use the default pool. See Per-account proxies.
`locale` / `timezone`	string	no	Browser-context identity, e.g. `de-DE` and `Europe/Berlin`. Match these to your proxy's country, or the account acts from your IP while reporting a New York clock. They set the browser context, so they apply with `method: "browser"`, and with the default `method: "http"` only when that login falls back to a browser (see Notes). Defaults `en-US` / `America/New_York`. See Per-account proxies.

{
  "username": "your_reddit_username",
  "password": "...",
  "method": "http",
  "proxy": {
    "server": "http://host:port",
    "username": "...",
    "password": "..."
  }
}

Response (200)

{
  "success": true,
  "username": "your_reddit_username",
  "link_karma": 1,
  "comment_karma": 315,
  "cookies": {
    "reddit_session": "...",
    "loid": "...",
    "token_v2": "...",
    "csrf_token": "...",
    "edgebucket": "...",
    "csv": "2",
    "session_tracker": "..."
  }
}

Failure returns success: false plus a diagnostic error message. The status code tells you whose problem it is:

Status	Meaning	What to do
`401`	Reddit rejected the credentials: wrong password, or 2FA is enabled and no `totp_secret` was supplied. Temporarily not returned, see the note below.	Fix the credentials. Retrying as-is will fail the same way.
`502`	The upstream path failed before Reddit ruled on the credentials: anti-bot block, captcha solver unavailable, or a proxy fault.	The credentials are not implicated. Retry after a short pause.
`502` with `"code": "UNKNOWN"`	Reddit served a page we could not read as a verdict either way, so we cannot tell whether the login would have succeeded.	Explicitly not a password rejection. Retry, ideally from a different proxy IP.
`502` with `"code": "UPSTREAM_ERROR"`	Reddit returned a generic error of its own and gave no verdict on the credentials. The body carries Reddit's own reference for the attempt where one was supplied.	Explicitly not a password rejection. Retry, ideally from a different proxy IP; quote the reference if you report it to us.

Only 401 is a statement about your credentials. Anything else means the request did not get far enough to be one, so do not disable an account or prompt a user to re-enter a password on a 502.

A 502 carrying "code": "UNKNOWN", "UPSTREAM_ERROR" or "UPSTREAM_BLOCKED" is not billed. Those are the cases where we could not get a verdict from Reddit at all, and the call is recorded at zero. A 502 carrying "code": "AUTH_FAILED" (see the note below) is billed like the 401 it stands in for: a real login was attempted and Reddit ruled on it. A retry loop on that code cannot succeed and only spends credits: fix the credentials first.

Temporary: 401 is not currently returned for credential rejections. It is still returned for TWO_FACTOR_REQUIRED (2FA is enabled and no totp_secret was sent) and TWO_FACTOR_INVALID (the secret could not produce a code), which are statements about your request and are safe to act on. Reddit is intermittently answering valid logins with its own "Invalid username or password" message, so we cannot tell a genuine rejection from a false one. Rather than tell you your password is wrong on evidence we know to be unreliable, every login failure is currently reported as 502 with the real code (AUTH_FAILED, UPSTREAM_ERROR, UNKNOWN or UPSTREAM_BLOCKED) in the code field. A 502 carrying "code": "AUTH_FAILED" means Reddit blamed the credentials and we could not confirm it. This note will be removed when 401 resumes.

Notes

Flow: call /login once → get cookies → paste them as flat top-level fields into /comment, /vote, or /dm. Re-login when they expire.
Login method: omit method or use http for the default flow. This is the reliable path and the one to use. If the http transport is blocked before the login form renders, the login attempts a browser fallback (the response then carries "fallback_from": "http", and it can add 45 to 130 seconds). Note that method: "browser" and that fallback are best-effort: Reddit currently serves our headless browser a "Prove your humanity" challenge that can block it, so a browser attempt may fail where http succeeds. Stay on http unless support advises the browser method for your case.
2FA: pass totp_secret (the Base32 string from the QR code) when enrolling the account; the server generates the 6-digit code per request.

Example

curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"username":"your_reddit_username","password":"your_password","method":"http"}' \
  "https://api.redditapis.com/api/reddit/login"

const response = await fetch("https://api.redditapis.com/api/reddit/login", {
  method: "POST",
  headers: {
    Authorization: "Bearer TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    username: "your_reddit_username",
    password: "your_password",
    method: "http",
  }),
});

import requests

response = requests.post(
"https://api.redditapis.com/api/reddit/login",
json={
"username": "your_reddit_username",
"password": "your_password",
"method": "http",
},
headers={"Authorization": "Bearer TOKEN"},
)

Independent third-party API for developers and researchers. Not affiliated with, endorsed by, or sponsored by Reddit, Inc.

Reddit API Login - Username and Password

Request Body

Response (200)

Notes

Example

On this page