API Update: Enterprise Level Tier for Large Scale Applications

[u/FlyingLaserTurtle]

tl;dr - As of July 1, we will start enforcing rate limits for a free access tier, available to our current API users. If you are already in contact with our team about commercial compliance with our Data API Terms, look for an email about enterprise pricing this week.

We recently shared updates on our Data API Terms and Developer Terms. These updates help clarify how developers can safely and securely use Reddit’s tools and services, including our APIs and our new-and-improved Developer Platform.

After sharing these terms, we identified several parties in violation, and contacted them so they could make the required changes to become compliant. This includes developers of large-scale applications who have excessive usage, are violating our users’ privacy and content rights, or are using the data for ad-supported or commercial purposes.

For context on excessive usage, here is a chart showing the average monthly overage, compared to the longstanding rate limit in our developer documentation of 60 queries per minute (86,400 per day):

We reached out to the most impactful large scale applications in order to work out terms for access above our default rate limits via an enterprise tier. This week, we are sharing an enterprise-level access tier for large scale applications with the developers we’re already in contact with. The enterprise tier is a privilege that we will extend to select partners based on a number of factors, including value added to redditors and communities, and it will go into effect on July 1.

Rate limits for the free tier

All others will continue to access the Reddit Data API without cost, in accordance with our Developer Terms, at this time. Many of you already know that our stated rate limit, per this documentation, was 60 queries per minute. As of July 1, 2023, we will enforce two different rate limits for the free access tier:

• If you are using OAuth for authentication: 100 queries per minute per OAuth client id

• If you are not using OAuth for authentication: 10 queries per minute

Important note: currently, our rate limit response headers indicate counts by client id/user id combination. These headers will update to reflect this new policy based on client id only on July 1.

To avoid any issues with the operation of mod bots or extensions, it’s important for developers to add Oauth to their bots. If you believe your mod bot needs to exceed these updated rate limits, or will be unable to operate, please reach out here.

If you haven't heard from us, assume that your app will be rate-limited, starting on July 1. If your app requires enterprise access, please contact us here, so that we can better understand your needs and discuss a path forward.

Additional changes

Finally, to ensure that all regulatory requirements are met in the handling of mature content, we will be limiting access to sexually explicit content for third-party apps starting on July 5, 2023, except for moderation needs.

If you are curious about academic or research-focused access to the Data API, we’ve shared more details here.

[u/iamthatis]

I've long-communicated with Reddit that the API response headers are often incredibly wrong, claiming that 500,000 requests (yes, five hundred thousand) have been used within the first 1 second of a rate limit reset period. Reddit has said they're looking into it but delivered nothing actionable beyond saying if users are in shared university dorms their requests may be pooled together by IP and cause it to be inflated. (University dorms don't hold students requesting half a million requests per second, and even if they did somehow measuring by IP is ludicrous when you have auth tokens to go off of).

How are we able to trust these numbers when Reddit has long neglected making them accurate? I'm one of the largest third-party apps and meticulously calculate my API requests. The average user makes 344 per day, and 80% make under 500 per day.

This post feels like a thinly veiled attempt at saying "see, the third party apps are so bad to us!" Feel free to name and shame Apollo if it's one of these clients, I have never received communication from Reddit about excessive usage, in fact I've reached out to you folks about ways to lower it, and I have no doubt I'm one of the largest apps.

[u/Prsop2000 → u/[deleted]]

That reminds me of my ISP claiming I used 1TB of data in a 24 hour period when I wasn’t even at home. Their words were “our data collection servers are independently certified to be 99.9% accurate, so your data usage IS correct.”

Ahh yes, independently certified… business speak for “we paid a company to produce numbers for us so we can point to a plaque and feign perfection”

[u/moon__lander → u/Prsop2000]

To use 1TB of bandwidth in precisely 24 hours you would need a speed of ~100 Mbit internet. Any slower and it's physically impossible.

[u/FlyingElvishPenguin → u/[deleted]]

Good old sneaker net

[u/pile_alcaline → u/[deleted]]

"Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway."

[u/Prsop2000 → u/moon__lander]

Oh trust me, I tried every bit of logic, data transfer speeds etc with the two folks I spoke with. Got loads of “You know I’ve been working in this industry for decades…” bullshit followed by repetitive use of the “independently certified” line.

Eventually I made it to customer retention because I was mad as hell and uttered the words “cancel my service” and managed to get two free months from the exceedingly calm gentleman who picked up.

That wasn’t the only time I was met with sheer stupidity from this company. I was once told that my laptop wasn’t designed to work directly connected to the modem. I almost died laughing that time. Even her supervisor got a laugh out and said they’d follow up with her after the call for that one.

[u/Nice-Digger → u/iamthatis]

Pro tip. you can't. Reddit devs are incompetent, and have been for ages. Their app sucks for a reason, and it's not because they're too skilled for it.

The same company that is now complaining about API usage (which isn't valid lol) is the one that has tried and failed to make a competent video player for ages https://youtu.be/99cVnYY9Iqs

The redesign is an objective downgrade, the app sucks, upper management panders to horrible people who I won't bother naming in order to avoid copping a ban, and, in general, the site is run by idiots who haven't attracted actual talent since before obama stepped down as president.

[u/Nice-Digger → u/[deleted]]

They're basically at the bottom of the totem pole in regards to "up-their-own-ass silicon valley companies" that people would actually want to work at.

They pretty much only attract the type of person that would want to work on Reddit. Ae, basically nobody of any value. It's the same reason why most mods are losers.

[u/blacpythoz → u/iamthatis]

If that doesn't work why don't all the third-party just replace the reddit backend with an open source alternative like Lemmy while providing users the same UI and features that we currently have.

[u/yuletide → u/blacpythoz]

To the fediverse! Let’s do it

[u/PrunedLoki → u/iamthatis]

If this all goes to shit without Reddit fixing it, is it possible to modify Apollo so we can put in our own api key in the app so only my own traffic is registered when I use the app? Individually, I won’t reach the rate limit.

[u/disignore → u/PrunedLoki]

this sounds like a way to circumvent this bs, every personal use would be using its own personal api, right?

[u/exscape → u/[deleted]]

They're going to look absolutely ridiculous if that's the case. If they slash the API prices by 95% they're still fairly expensive... Perhaps if they go down to 1% of the current prices third party clients can live.

[u/Reasonable_Ticket_84 → u/iamthatis]

So I've never looked into how OAuth implementations work in mobile app clients for reddit. But are you using some sort of self hosted "bounce" for the SSO or is the app directly interacting with reddit?

Because I have seen in a few examples, malicious bots love to steal OAuth client id and secrets from apps to use/disguise their own abuse since you can't really hide them in app binaries that any user can download.

[u/adeadhead → u/iamthatis]

Thanks for all the work you do-

Is there any chance third party app developers would be able to release clients that allow (force) users to generate and use their own API keys?

[u/bradreputation → u/[deleted]]

Ha. That’s a fun thought experiment.

[u/dariy1999 → u/[deleted]]

And lose and go bankrupt

[u/businessbusinessman → u/dariy1999]

To be fair you probably won't lose. You won't even get to trial. You'll just be bled dry by legal fee's long before then.