🌐
Reddit
reddit.com › r/redditdev › client id and secret
r/redditdev on Reddit: Client ID and Secret
January 31, 2023 -

Hey guys!

I've been trying to get a client ID and Secret for a project with PRAW, but the provided link (https://www.reddit.com/prefs/apps) doesn't work. Someone experiencing this? Is this link up-to-date or broken?

I can only access a page that says: "Welcome back! You are already logged in and will be redirected back to Reddit shortly. If you are not redirected automatically, follow this link."

Clicking on "this link" does nothing.

Any help appreciated. Thank you :D

Discussions

Where to store client_id and client_secret
On July 1st, a change to Reddit's API pricing will come into effect. Several developers of commercial third-party apps have announced that this change will compel them to shut down their apps. At least one accessibility-focused non-commercial third party app will continue to be available free of charge. If you want to express your strong disagreement with the API pricing change or with Reddit's response to the backlash, you may want to consider the following options: Limiting your involvement with Reddit, or Temporarily refraining from using Reddit Cancelling your subscription of Reddit Premium as a way to voice your protest. I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns. More on reddit.com
🌐 r/learnprogramming
8
1
December 10, 2023
How to Generate and Authorize Reddit API Credentials for use With the OpenBB Terminal.
Client ID = the string that is displayed under the name, in the "authorized applications" tab of the account settings. Secret = viewing the details of your newly created application will show a field with the title, "secret". More on reddit.com
🌐 r/openBB
3
9
September 12, 2022
Alert on Azure app registration client secret expiry : AZURE
We have built a custom solution to get notified whenever an Azure app registration client secret is close to expiring. But the problem is it... More on old.reddit.com
🌐 r/AZURE
How to implement Client ID and Client Secret based API Authentication for my REST API?
I believe what you are describing is implementing oauth2. You can take a look at https://github.com/openshift/osin More on reddit.com
🌐 r/golang
5
1
May 9, 2018
🌐
Heateor
support.heateor.com › home › how to get reddit client id and secret?
How to Get Reddit Client ID and Secret? - Heateor - Support Documents
September 20, 2021 - Copy Reddit Client ID and Reddit Client Secret and save these at the plugin configuration page
🌐
Reddit
reddit.com › r/learnprogramming › where to store client_id and client_secret
r/learnprogramming on Reddit: Where to store client_id and client_secret
December 10, 2023 -

Hello guys. New programming learning about backend (SpringBoot). I am building a simple library app and am using Google Oauth2 for log in and out, and planning to host it using AWS with docker. I want to ask, what are some of the most popular ways to store client_scret in a safe way?

I tried googling but never seems to find a straight answer. There must be like, top 3 most popular ways to store client secret, or something.

Please help

Top answer
1 of 3
2
You can't really get much "safer" than just storing these credentials in a file or environment variable on your server. No matter what you do, the client ID and client secret must be accessible to your server-side code. So for instance, there is little point in encrypting them, because your program would also need to have the corresponding decryption key. If your server was compromised, then an attacker would be able to get both the encrypted credentials and the key, so this is just security by obscurity. So the important thing is not how you store the credentials on the server itself, but minimizing the number of possible other ways they could be compromised. For instance: Make sure your application only serves static files from one particular directory, and that your credentials aren't stored in that directory. Poorly-written static file servers may be vulnerable to path traversal attacks. Don't store a copy of the production credentials in your Git repo. If other users have access to the same server, then don't pass credentials on the command line (where they could be viewed using tools like ps). Pass them in environment variables, or store them in files with permissions set to limit who can read them. Don't accidentally generate debugging output that might cause your credentials to be written to log files.
2 of 3
1
On July 1st, a change to Reddit's API pricing will come into effect. Several developers of commercial third-party apps have announced that this change will compel them to shut down their apps. At least one accessibility-focused non-commercial third party app will continue to be available free of charge. If you want to express your strong disagreement with the API pricing change or with Reddit's response to the backlash, you may want to consider the following options: Limiting your involvement with Reddit, or Temporarily refraining from using Reddit Cancelling your subscription of Reddit Premium as a way to voice your protest. I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
🌐
Read the Docs
praw.readthedocs.io › en › stable › getting_started › quick_start.html
Quick Start - PRAW 7.7.1 documentation
You may choose to provide these by passing in three keyword arguments when calling the initializer of the Reddit class: client_id, client_secret, user_agent (see Configuring PRAW for other methods of providing this information).
Find elsewhere
🌐
Reddit
reddit.com › r/redditdev › couldn't find client secret
r/redditdev on Reddit: Couldn't find client secret
July 2, 2024 -

I can successfully see the client id but couldn't see client secret after I clicked on "edit". Only basic informations (app name, descriptions, etc) are shown.

🌐
GeeksforGeeks
geeksforgeeks.org › python › how-to-get-client_id-and-client_secret-for-python-reddit-api-registration
How to get client_id and client_secret for Python Reddit API registration ? - GeeksforGeeks
July 12, 2025 - Login to your Reddit account. ... Click on "create an app...". The following fields will be requested: Give an appropriate name to the application and fill rest of the fields: Click on "create app". The text in the green box is the client_id. Click on "edit". The text in the green box is the client_secret.
🌐
Postiz
docs.postiz.com › providers › reddit
Reddit - Postiz Docs
Copy the Reddit client id and client secret and add them to your .env file.
🌐
Read the Docs
praw.readthedocs.io › en › stable › getting_started › authentication.html
Authenticating via OAuth - PRAW 7.7.1 documentation
The second line of output reveals the name of the Redditor that completed the code flow. It also indicates that the Reddit instance is now associated with that account. The code flow can be used with an installed application just as described above with one change: set the value of client_secret to None when initializing Reddit.
🌐
Make
apps.make.com › reddit
reddit - Apps Documentation
reddit is a social platform for ... the client id displayed under your application copy the client secret displayed under your application you will use this value while creating ......
🌐
Better Auth
better-auth.com › docs › authentication › reddit
Reddit | Better Auth
import { betterAuth } from "better-auth" export const auth = betterAuth({ socialProviders: { reddit: { clientId: process.env.REDDIT_CLIENT_ID as string, clientSecret: process.env.REDDIT_CLIENT_SECRET as string, }, }, })
🌐
NextAuth.js
next-auth.js.org › providers › reddit
Reddit | NextAuth.js
providers: [ RedditProvider({ clientId: process.env.REDDIT_CLIENT_ID, clientSecret: process.env.REDDIT_CLIENT_SECRET, authorization: { params: { duration: "permanent", }, }, }), ]
🌐
Langchain
docs.langchain.com › oss › python › integrations › tools › reddit_search
Reddit Search - Docs by LangChain
# Adapted code from /docs/modules/agents/how_to/sharedmemory_for_tools from langchain.agents import AgentExecutor, StructuredChatAgent from langchain.chains import LLMChain from langchain.memory import ConversationBufferMemory, ReadOnlySharedMemory from langchain_community.tools.reddit_search.tool import RedditSearchRun from langchain_community.utilities.reddit_search import RedditSearchAPIWrapper from langchain_core.prompts import PromptTemplate from langchain.tools import Tool from langchain_openai import ChatOpenAI # Provide keys for Reddit client_id = "" client_secret = "" user_agent = ""
🌐
Auth.js
authjs.dev › getting-started › providers › reddit
Auth.js | Reddit
October 9, 2025 - export const { handlers, auth, signin, signout } = NextAuth({ providers: [ RedditProvider({ clientId: process.env.REDDIT_CLIENT_ID, clientSecret: process.env.REDDIT_CLIENT_SECRET, authorization: { params: { duration: "permanent", }, }, }), ], })
🌐
Reddit
reddit.com › r/openbb › how to generate and authorize reddit api credentials for use with the openbb terminal.
r/openBB on Reddit: How to Generate and Authorize Reddit API Credentials for use With the OpenBB Terminal.
September 12, 2022 - Client ID = the string that is displayed under the name, in the "authorized applications" tab of the account settings. Secret = viewing the details of your newly created application will show a field with the title, "secret".
🌐
Reddit
reddit.com › r/redditdev › oauth: client_secret vs pkce
r/redditdev on Reddit: OAuth: client_secret vs PKCE
June 6, 2024 -

Learning OAuth2, and I'm seeing the reason for using PKCE is for when you have a completely public app, like a javascript application where it's entire source code lives in the browser and therefore the client_secret would be exposed.

It then recommends using PKCE. But in this case, isn't the code_verifier basically the password? It sends the initial code_challenge, the hashed value, in the original request...so this could be intercepted, it is even stated it's not a secret.

It then POSTS the code_verifier later with the auth_code from what I'm reading. So, how is this different than having a client_secret? If an app's source is published, won't the code_verifier be leaked as well? Or maybe it's generated at run time and that's the point...

If so, is the security of this flowed based on the fact that the password is basically randomly generated?

🌐
Reddit
reddit.com › r/redditdev › installed apps and protecting "client secret"
r/redditdev on Reddit: Installed apps and protecting "client secret"
November 5, 2021 -

I am planning on building an installed app that uses reddit API. Let's assume a native android app.

Here is the relevant excerpt from the docs:

Your app won't be able to keep a client secret safe and secure. For example, Android, Windows or iOS apps that access the reddit API should choose this app type, as anyone who installs the app would be able to figure out your client secret.

For relevant requests, you should still send and use the client secret like normal. The reddit servers will simply not make the assumption that an installed app sending a secret has "proven" to be a request on behalf of that app.

I don't even understand what this paragraph means. What does it mean that reddit servers won't assume an installed app sending a secret has "proven" to be a request on behalf of that app? Should I send the secret or no?

From the sounds of it, it is awfully similar to Authorization Code Flow from spotify API. In that case does reddit not implement PKCE for preventing Authorization Code Interception Attack ? Spotify seems to do it.