Separate the person, the job and the paying account
Treat the onboarding feature as three identities: the signed-in product user, your internal job and the domain account charged for archive reads. Connect the first two in your own backend. The browser should receive the permitted result, not the shared retrieval credential. Otherwise one copied key can start paid work outside the limits you placed on the screen.
Do not place the secret in browser JavaScript, public repositories, request URLs or diagnostic output. Use protected server configuration, such as environment variables or a secrets manager, and ensure error handling does not print the header. Merely moving a secret into an environment variable does not guarantee security. Review where your own application reads, forwards and logs it, including build and deployment processes.
Build one permitted archive request
For the first job, fix the destination host and permit the intended search route. Construct q=onboarding, subreddit=SaaS and limit=3 from validated inputs, then add the key only at the outbound request boundary. Do not forward a visitor-supplied URL with that header attached. Local permission checks must happen before this step.
Start with https://api.redditapigateway.com/v1/search?q=onboarding&subreddit=SaaS&limit=3, the homepage example. Your server can fix the archive host and permitted routes, validate inputs and insert X-API-Key: <key> or Authorization: Bearer <key>. Both work with the archive key. Do not accept an arbitrary visitor-supplied target URL for a credentialed request. The account panel's Secure HttpOnly cookie is a separate authentication mechanism.
Record attempts before deciding to retry
Assign the job an internal identifier and a small attempt allowance. Record the route, filters, attempt number and outcome without authentication headers. An example policy permits three attempts in total, including page changes and repeats. This is a product rule you implement; the archive supplies neither that per-user quota nor an authoritative job ledger.
Walk through an awkward outcome: an empty successful first call spends one credit; the next call loses its response and may still have spent another; a successful retry spends a further credit. Do not record the lost response as a free failure. Upstream failures refund reservations, while a local parsing or storage error does not undo a charged success.
Store the response before interpreting it
Save the received payload before transforming it for the screen. Records are flat; absent fields and unresolved parent_id or link_id references must remain possible. Local grouping cannot establish complete conversations. If adding dates, use YYYY-MM-DD in UTC with to inclusive. q matches title and text with AND terms within a matching field; min_score filters, and _doc order is neither ranking nor chronology.
Replace the credential without an overlap assumption
Prepare a replacement procedure that stops new product jobs while the credential changes. After signed-in password confirmation, regeneration invalidates the previous key immediately. Update the processes that send archive requests before resuming them; there is no overlap window to depend on. Restrict secret access and remove it from diagnostics during this handover as well.
A local request limit only controls traffic through your backend. It cannot constrain someone using an exposed key directly. Compare your attempt ledger with the account context when investigating unusual use, but do not infer a leak from volume alone or promise that rotation recovers spent credits. Protect the password too: no password-reset or emailed-key workflow is supplied.
Check the complete path with a small job
Finally, run the small permitted job and examine the actual outcome. Treat 400 as parameters, 401 as credentials, 402 as balance and 429 as request frequency before choosing a next action. Retrieval is bounded to 100 records per request and 100 pages per query, without complete coverage. Public /v1/status is static scope information, not a probe of archive health. A saved sample and a recorded decision to stop are valid product outcomes.
