Reddit .json returns 403: why it happens and what works now
Short answer: Nothing is wrong with your code. Reddit shut down unauthenticated access to its .json endpoints in mid-2026, so a request without a login is refused with 403 Forbidden. Changing headers does not bring it back. You need an authenticated route.
What changed
For years, adding .json to almost any Reddit URL returned the page as data, with no key. Many scripts, spreadsheets and automations were built on it.
In mid-2026 Reddit announced in r/modnews that it was shutting that access down, because the endpoints could be used to scrape without accountability. Developers reported 403 responses within days. Reports date the post to late May or June 2026. On September 30, 2026 Reddit added that RSS feeds end on November 13, 2026 and that public API access closes in March 2027. The full list of dates is in the shutdown timeline.
Check which error you have
| You see | It means | Do this |
|---|---|---|
403 Forbidden, or an HTML page where JSON should be | Unauthenticated access is refused | Move to an authenticated route. Retrying will not help |
429 Too Many Requests | You are over a rate limit | Wait and slow down. See rate limits |
401 Unauthorized on oauth.reddit.com | Your OAuth token is missing or expired | Request a new token |
| It works in your browser and fails on your server | Your browser is logged in and your server is not | Same as a 403 |
curl -s -o /dev/null -w "%{http_code}\n" \
-A "myscript/1.0" "https://www.reddit.com/r/typescript/new.json?limit=5"
# 403 means the unauthenticated route is closed for you
What does not fix it
- A different User-Agent. Descriptive and browser-like headers are both refused.
- Retrying in a loop. A 403 is a refusal, not a queue. Retries only add load.
- Switching to old.reddit.com, api.reddit.com or RSS. They refuse the same requests, and RSS has an end date.
- Rotating proxies or copying a session cookie. These get around a block Reddit put there on purpose. Reddit's site rules now name unauthorized scraping, and it has taken scraping companies to court.
What works
| Route | Good for | Limits |
|---|---|---|
| Reddit's Data API with OAuth | Apps that are already registered | New access requests close on October 31, 2026 and public access ends in March 2027 |
| A third-party read API such as Apixstar | Scripts that read public listings, threads and search | Paid per request, read-only, not affiliated with Reddit |
| Community archives | Historical datasets | Not live |
Replace a .json call with Apixstar
The paths mirror Reddit's, so most calls change in two places: the host, and one header.
| You used to fetch | Now call |
|---|---|
reddit.com/r/{community}/new.json | /reddit/v1/r/{community}/new |
reddit.com/r/{community}/comments/{id}.json | /reddit/v1/r/{community}/comments/{id} |
reddit.com/search.json?q= | /reddit/v1/search?q= |
reddit.com/user/{username}/about.json | /reddit/v1/u/{username} |
curl "https://api.apixstar.com/reddit/v1/r/typescript/new?limit=5" \ -H "Authorization: Bearer YOUR_API_KEY"
The response is not Reddit's raw listing. Posts arrive as a flat array with named fields, and a meta.billing block tells you what the call cost. Field names are in the API reference. It costs $0.0007 per request, or per 10 results of a listing or search, and a request that fails is not charged.
Questions about the 403
Why does Reddit .json return 403 Forbidden?
Reddit shut down unauthenticated access to its .json endpoints in mid-2026. A request without a logged-in session or an OAuth token is refused with 403, most reliably from server and cloud addresses.
Does changing the User-Agent fix the 403?
No. Reports from developers who tested both a descriptive User-Agent and a browser one say both are refused. The block is on unauthenticated access, not on the header.
Will a proxy or a VPN fix it?
It may change which requests get through for a while, but it works around a block Reddit put there on purpose, and Reddit now lists unauthorized scraping under its site rules. It is not a base to build on.
What is the difference between a 403 and a 429 from Reddit?
A 429 means you are sending too many requests and should wait. A 403 means the request is not allowed at all, so waiting and retrying does not help.
Does old.reddit.com or the RSS feed still work?
Not as a replacement. Reports say old.reddit.com and api.reddit.com refuse the same unauthenticated requests, and Reddit said RSS support ends on November 13, 2026.
How do I get the same data from Apixstar?
Replace the Reddit URL with the matching Apixstar path and send your API key as a Bearer token. A community listing is /reddit/v1/r/{community}/{sort}, and a thread is /reddit/v1/r/{community}/comments/{id}.
Sources: TechCrunch, September 30, 2026, heise online and PPC Land, each reporting Reddit's posts in r/modnews and r/redditdev. We have summarized them and may be out of date. Reddit's own posts are the authority.
Next: the shutdown timeline and what running your own scraper involves.