Reddit

$ lanes link connect reddit --profile personal --workspace local

Reddit is the one account here that needs an app of your own. It takes a couple of minutes, once.

What your agent can do

Reads are granted when you connect. Posting, editing, and voting need the write bundle.

There is no moderation, no direct messages, and no browsing history. Reddit publishes thirty scopes and this asks for eight, so nothing on the consent screen is a permission no tool can spend.

Before an agent posts anywhere

Writing on Reddit happens publicly, under your username, and cannot be taken back: deleting a post leaves the deletion behind, and anything quoted or replied to in the meantime stays. Two things save most of the trouble:

• Most subreddits require a flair. reddit.list_flairs returns the templates and their ids; pass one as flair_id. A submission without one is rejected by the subreddit, not by the API, so the error does not mention flair.
• Read the rules first. reddit.get_rules is cheap, and most removals are rule violations rather than API errors.

If you want an agent that reads Reddit but never writes to it, deny the write half:

$ lanes link policy deny reddit.submit_post reddit.add_comment reddit.vote --profile personal --workspace local

Why there is no shared client for this one

Google and Slack authorise against a client Lanes operates, so there is no console to visit. Reddit cannot work that way, because of how it meters access: Reddit's rate limit is a hundred queries a minute per OAuth client id, not per user and not per token.

A shared client would pool every install of this program into one bucket. Your limit would be reached by strangers, and the failure would arrive as somebody else's traffic. An app of your own gets its own hundred, which is the whole budget for one person.

Registering the app

1. Open https://www.reddit.com/prefs/apps and choose create another app....

2. Give it a name you will recognise later. The name is how you revoke this one without touching your other apps.

3. Choose web app. The other two do not fit: script only ever reaches your own account, and installed app issues no secret for this to hold.

4. Set the redirect uri to exactly:

   Code

   http://127.0.0.1:8765/callback
   

   Reddit matches this character for character. It is the address connect listens on, and a different port, or localhost in place of 127.0.0.1, is refused after you approve the consent screen rather than before.

5. Create the app. The client id is the string just under the app name; the secret is the field labelled secret.

Then run the connect command above. You are asked for both values once, they go into your credential store, and the browser opens.

Getting API access approved

Creating an app is not the same as being allowed to call the API. Reddit's Responsible Builder Policy says access must be requested and approved, and the create-app page links to that separately.

The quickest way to find out where you stand is to ask for an app-only token:

$ curl -sS -X POST -u "<client_id>:<client_secret>" \
    -A "lanes-link/0.3" \
    -d "grant_type=client_credentials" \
    -w "\nHTTP %{http_code}\n" \
    https://www.reddit.com/api/v1/access_token

200 means the gate is open. 403, or an HTML page instead of JSON, means the app exists but access has not been granted yet.

When it stops working

If you regenerate the secret:

$ lanes link connect reddit --profile personal --workspace local --replace

The scopes it asks for

Reddit publishes thirty scopes. This asks for eight.

The three marked broad are broad for a different reason from most: not for how far they reach into a private space, but for acting publicly under your username. They are the only writes here that cannot be taken back, so connect stops and asks for an explicit yes.

Not asked for:

• privatemessages. It would put the account's DMs in reach of a tool list whose subject is public posting.
• The mod* scopes. They act on other people's content in subreddits this account moderates, which is a different job with a different blast radius.

How to narrow or widen any of this is on Scopes and permissions.

What is recorded

Subreddit, flair id, nsfw, and spoiler are kept. The body is withheld, and so is the title, and so is a link post's url.

The title looks like metadata and is not. A Reddit title is usually the whole of the post and the body is often empty, so keeping it would defeat withholding the body. See the audit log.

Next: every provider, or Add it to your agent.