Reddit JSON 403 Forbidden: Why Your Script Broke and What Works in 2026

If your script, bot or automation flow suddenly gets a 403 from Reddit’s .json URLs, it is probably not your code and probably not an outage. Reddit announced in late May 2026 that it was shutting down logged-out .json access. On October 18, 2026 every logged-out JSON URL we tried returned a 403 HTML block page or a redirect to a login page, with a real Chrome User-Agent.

Below: the response of each endpoint so you can match yours to a cause, a classifier for your code, the fixes that fail, and Reddit’s dated shutdown schedule.

The short answer

Dated timeline: what closes and when

Reddit has closed its routes in steps. These are the dates Reddit admins have stated.

Every date removes a way in. After November 13 only two routes remain for most people, a registered app or a logged-in browser, and the app route is scheduled to end in March 2027.

What Reddit changed, and when

Reddit announced the change in r/modnews in a post titled “Protecting communities from scrapers and platform abuse”. Developer forums date it around May 28, 2026. The post did not show a date when we fetched it, so we say late May 2026. The paragraph:

“We’ll also be shutting down unauthenticated .json endpoints. These endpoints can be used to scrape Reddit without accountability. Logged-in and authenticated access won’t be impacted.” – Reddit, r/modnews

Two words matter for your 403. “Unauthenticated” means the block keys on whether the request carries a login. A Reddit reply in that thread spelled it out: requests without OAuth or user credentials will be blocked. And “logged-in” is why the URL that fails in your script loads in your browser tab. A developer described the symptom in r/redditdev:

“Trying to fetch public Reddit data using the .json endpoints for a small personal Python project, but I keep getting 403 responses.” – r/redditdev

One reply: “They stopped serving the json endpoints.” – r/redditdev. In the announcement thread a commenter wrote that removing the endpoints “is honestly really frustrating and will break a lot of legitimate automation” – r/modnews. A hobby script and a spam network look the same to the block.

This follows an earlier step. In November 2025 Reddit closed self-service access to its public data API, with the line “Starting today, self-service access to Reddit’s public data API will be closed” – r/redditdev. New access now needs approval; Reddit said current access would not be affected. So both doors a builder used to have, anonymous .json and a self-made API key, are closed to newcomers. The API side is covered in our Reddit API alternative for AI research guide.

The endpoint test: what each URL returns logged out

Forum threads disagree on what is blocked, so we tested it. On October 18, 2026 at about 18:59 UTC we sent ten plain HTTPS GET requests from one residential IP, with a current Chrome User-Agent, no cookies, two seconds apart, using r/smallbusiness and a one-word search. At 19:07 UTC we added an eleventh, a comment thread, under the same setup.

Four results are worth remembering. Every 403 body was exactly 189,908 bytes, so the six most likely came from one block page, which is why the response size is a quick fingerprint. The oauth host answered 403 with no token where many guides predict a 401, so a 403 alone cannot tell you whether the shutdown or a bad token is the cause. The old interface sends logged-out visitors to a login page, so it is not a loophole. And the plain HTML page returned a 200 with 0 post links, the trap for scrapers that only check the status.

The logged-in side: the same day, through our own logged-in Chrome session and the Reddit Connector, listing, search and comment data came back as 200 JSON.

The same thread that returned a 403 block page logged out returned its comments to the logged-in session. The block is about who is asking, not about whether the data is public.

How to read your response: 403, 429, 302 or 200

Log three things for the failing request before changing anything: status code, content type and redirect target. They separate six problems that all get described as “Reddit is blocking me”.

The token row comes from a 2024 r/redditdev thread. A developer sent a bearer token to the www host and got a short JSON body, {"message":"Forbidden","error":403}. The fix was to send the request to the oauth host. Same status as the shutdown, different cause, so check the body first.

To rule out an outage, open the same URL in a logged-in browser tab. If it loads, Reddit is up. Then check the body: our six 403 responses were all HTML and all 189,908 bytes.

This function applies the table using only built-in fetch.

function classifyRedditResponse(status, contentType, location) {
  const type = contentType || "";
  const isHtml = type.includes("text/html");

  if (status === 200 && type.includes("json")) return "ok: JSON";
  if (status === 200 && type.includes("xml")) return "ok: feed";
  if (status === 200 && isHtml) return "HTML shell, not data";
  if (status === 403 && isHtml) return "logged-out block page";
  if (status === 403) return "forbidden: check token, host, approval";
  if (status === 401) return "token missing or expired";
  if (status === 429) return "rate limited: slow down";
  if (status >= 300 && status < 400 && (location || "").includes("login")) {
    return "login wall";
  }
  return "other";
}

// In a server runtime, ask fetch not to follow redirects so you see the 302.
const url = "https://www.reddit.com/r/smallbusiness/top.json?limit=2";
const res = await fetch(url, { redirect: "manual" });
const label = classifyRedditResponse(
  res.status,
  res.headers.get("content-type"),
  res.headers.get("location")
);
if (label !== "ok: JSON" && label !== "ok: feed") {
  throw new Error("Reddit fetch failed: " + label);
}

The throw is the point. A job that gets a block page, parses zero posts and reports success drops Reddit from your results without any error.

Fixes that do not work

Most 403 advice predates the shutdown. Each of these was either tested by us or reported failing by developers.

Changing the User-Agent

The most common suggestion in the threads is a single question: “Are you setting a user agent?” – r/redditdev. It was standard advice under the old rate limits. Our test sent a current Chrome User-Agent and still got 403 on every logged-out JSON URL. Reddit’s announcement says the block is on unauthenticated requests, and a header is not a login.

Spoofing a browser is also against the grain of Reddit’s Responsible Builder Policy: “You must not misrepresent or mask how or why you are accessing Reddit data.”

Switching to old.reddit.com

In our test the HTML page and its .json URL both returned a 302 to a login page. A client that follows redirects ends up on a login form with a 200 and an HTML body, so check where you landed, not just the status.

Using the api or oauth hostname

Both returned the identical 189,908 byte 403 page with no token. The oauth host is where a valid token goes, but it does not serve anonymous requests either.

Changing IP, proxy or network

A developer on r/webscraping described a script at roughly 30 to 60 requests an hour that suddenly got 403s, and wrote “I switched to a mobile hotspot to rule out an IP issue, but got the same error” – r/webscraping. One report, but it fits our single-IP result: the rule appears to apply to the request type, not the address.

Retries and backoff

Backoff answers a 429, which we saw on the first search RSS call. A 403 block page is not a request to wait.

Copying a session cookie into your script

A reply in that thread said “Grab session cookies and it will work” – r/webscraping. It may. It also puts your account credentials in a script, a risk if it runs on a server or lands in a repository, and sends automated traffic through your personal account. We do not recommend it.

What works in 2026: the five steps

Step 1: Confirm it is the logged-out block

A 403 with an HTML body on a request with no login or token is the block. No header, library setting or retry policy changes a server-side rule on unauthenticated requests, so stop debugging your code.

Step 2: Decide whether a feed is enough

To watch a subreddit for new posts in the next few weeks, RSS works until November 13, 2026. If you need search, comment trees or anything that must run after that date, use the other routes.

Step 3: Apply for approved access if you are building a product

Only if you can get in before October 31, 2026, and only for a product with a clear purpose. See Route 2 for the dates.

Step 4: Use your own logged-in browser for research

For reading and analyzing threads with an AI assistant at a human pace, see Route 3.

Step 5: Make your code fail loudly

Keep the classifier above in the request path on every route. When Reddit changes again, you get an error instead of an empty result.

Route 1: RSS, until November 13, 2026

In our test a subreddit top feed returned 200 as a 7,689 byte Atom document with two entries, each carrying the full post body in its content element. No login needed today.

It is ending. In an r/modnews admin post Reddit wrote: “Because RSS is now a common surface for large-scale scraping and automated abuse, we’ll stop supporting RSS feeds on November 13, 2026.” – r/modnews. The same post adds: “If you use RSS for feeds outside of a community you moderate, there is no replacement.” – r/modnews.

The search feed returned 429 on its first call, so even now it covers listings better than search. Do not start anything new on it. Per-pattern results and the rate limit are in our Reddit RSS ending guide.

Route 2: an approved Reddit Data API app

Under the Responsible Builder Policy you must get approval before using the Data API. The policy says you must not sell, license or commercialize Reddit data, or use it to train machine learning or AI models, without express written approval, and that apps including bots and AI agents must register.

On timing, a Reddit admin replied in the launch thread: “We’re aiming for a 7 day turnaround on most tickets.” – r/redditdev. We could not measure real approval times or rates, so treat that as Reddit’s aim.

If you do have a token, send authenticated requests to the oauth host, not www.

The deadlines close this route. Reddit’s admins set September 30, 2026 for registering all API apps, October 31, 2026 as the last day new public API requests are accepted, January 12, 2027 for access removal to begin for unregistered apps, and March 2027 for the end of remaining public API access. If you do not already hold approved access, plan as if this route is closed.

Route 3: fetch through your own logged-in browser

Reddit said logged-in access would not be impacted, and your own browser is logged in. The BigIdeasDB Clipper Reddit Connector lets that browser make the request at browsing pace and hand the result to your AI client. Reddit has not promised this stays unchanged, so treat it as current behavior, not a guarantee.

From the Reddit Connector docs: when Claude, ChatGPT, Cursor or any client connected to the BigIdeasDB MCP calls a Reddit tool, BigIdeasDB sends a wake-up message to your Clipper extension. Clipper fetches the requested reddit.com page in your Chrome with your Reddit login and returns the result to your AI client. The four tools are search_reddit, fetch_subreddit, fetch_post_comments and fetch_reddit_json. We measured the round trip, push to browser fetch to result, at about 1.2 seconds on October 18, 2026.

Setup, in full in the docs:

1. Install BigIdeasDB Clipper, version 1.2.0 or later, from the Chrome Web Store.
2. Log in to reddit.com in the same Chrome profile.
3. Open the Clipper popup, go to the Reddit tab and click Turn on Reddit Connector, then accept Chrome’s prompt for reddit.com.
4. Click Test connection. It should show that you are connected as your Reddit user. Then ask your AI to search Reddit.

The connector is off by default, fetches only reddit.com pages your AI asked for at about one request per second, and results are deleted from BigIdeasDB servers once delivered. No Reddit API keys, developer account or approval queue. Examples in searching Reddit from Claude and Cursor and the Reddit research MCP server.

This is not legal advice. Reddit’s Responsible Builder Policy and terms govern what you may do with the data, including commercial use and AI training, so read them for your case. See pricing for Pro.

In the 30 days to October 18, 2026, Reddit tools were more than half of all tool calls on the BigIdeasDB MCP, per our internal usage log. Scripts built on the old API wrapper: see the PRAW alternative guide.

What is the best way to get Reddit JSON in 2026?

For research with an AI assistant, the BigIdeasDB Reddit Connector, because it needs no approval or API keys. For other jobs:

The anonymous door is closed on purpose, so pick the route by job. Ideas from Reddit threads: how to find business ideas on Reddit. Scraping at scale: how to scrape Reddit in 2026.

Method and limits

This is what we tested, how, and what it cannot tell you. Read the limits before you quote a result.

The test cannot show whether the block varies by region, whether Reddit will move its dates, or how long approvals take. If your request differs from our table, believe your request.

Next: run the classifier on your failing URL, match it to the table, pick a route. Setup is in the Reddit Connector docs, and the MCP troubleshooting guide covers connection failures. Background: the BigIdeasDB MCP.

Frequently asked questions

BigIdeasDB Research. (2026). Reddit JSON 403 Forbidden: Why Your Script Broke and What Works in 2026. BigIdeasDB. Retrieved from https://bigideasdb.com/reddit-json-403-forbidden