DEV Community

Digital Growth Pro
Digital Growth Pro

Posted on

Building a Multi-Account Reddit Management Backend with BitBrowser API + Proxy Rotation


Reddit is a notoriously hostile environment for multi-account workflows, even for legitimate ones. Social media agencies managing brand presence across 10+ subreddits, market research teams running parallel survey threads, and community management platforms all hit the same wall: Reddit's anti-multi-account detection is aggressive, opaque, and unforgiving. A single shared IP across two work accounts can trigger a shadowban that takes weeks to discover.

This article walks through the architecture of a multi-account Reddit management backend that handles isolation correctly. The stack uses BitBrowser's local API for browser-level identity separation, a residential proxy rotation layer, and a Node.js orchestration service. Detection evasion is not the goal here. What matters is making each account look like what it actually is: a separate human operator working from a consistent device and network.

Why Reddit Is Harder Than Facebook or TikTok

Most multi-account literature assumes Facebook-grade detection. Reddit operates differently. Three things make it harder:

  1. Shadowbans replace hard bans. Your account looks active to you. Posts appear in your profile. Comments seem to land. But nobody else sees them. Detection of a shadowban often takes 2-3 weeks of wasted work.

  2. Account age weighs heavily. A 3-month-old account posting in finance subreddits gets auto-filtered. The same account 18 months later, with consistent karma history, posts freely. Your backend has to track this and gate which accounts can do what.

  3. Cross-account signals are subtle. Reddit fingerprints include browser canvas, timezone vs IP geolocation mismatch, posting cadence patterns, and even typing rhythm in newer detection updates.

For legitimate use cases (agency client management, research data collection, brand monitoring), this means the technical bar is high. The setup below is what we run in production for an agency handling 24 brand accounts across 12 industries.

Architecture Overview

The system has four layers:

┌─────────────────────────────────────┐
│  Orchestration Service (Node.js)    │
│  - Account state machine            │
│  - Task queue (BullMQ + Redis)      │
│  - Action scheduler                 │
└───────────────┬─────────────────────┘
                │
        ┌───────┴────────┐
        │                │
┌───────▼────────┐  ┌────▼─────────────┐
│ BitBrowser     │  │ Proxy Pool       │
│ Local API      │  │ Manager          │
│ (per-profile)  │  │ (sticky sessions)│
└───────┬────────┘  └──────┬───────────┘
        │                  │
        └────────┬─────────┘
                 │
       ┌─────────▼─────────┐
       │ Reddit (via API   │
       │ or browser-driven │
       │ Playwright)       │
       └───────────────────┘
Enter fullscreen mode Exit fullscreen mode

The orchestrator never talks to Reddit directly. It dispatches actions to BitBrowser profiles, which route through assigned proxies. Each profile carries its own fingerprint, cookies, and session state, locked to one Reddit identity for its entire lifetime.

For the antidetect browser layer we use BitBrowser because of its local REST API, which lets the orchestrator open, close, and inspect profiles programmatically without UI interaction.

Setting Up the BitBrowser Local API

BitBrowser exposes a local API on http://127.0.0.1:54345 once the desktop client is running. The endpoints we need:

Endpoint Purpose
/browser/create Provision a new profile with custom fingerprint
/browser/open Launch a profile and get its CDP WebSocket URL
/browser/close Cleanly close a profile
/browser/list List all profiles
/browser/update Modify profile config (proxy, fingerprint)

A minimal Node.js client wrapper:

import axios from 'axios';

const BB = axios.create({
  baseURL: 'http://127.0.0.1:54345',
  timeout: 30000,
});

export async function createProfile({ name, proxyConfig, os = 'Win11' }) {
  const { data } = await BB.post('/browser/create', {
    name,
    platform: 'https://www.reddit.com',
    proxyMethod: 2,
    proxyType: proxyConfig.type,
    host: proxyConfig.host,
    port: proxyConfig.port,
    proxyUserName: proxyConfig.username,
    proxyPassword: proxyConfig.password,
    browserFingerPrint: {
      ostype: 'PC',
      os: os,
      version: '120',
      userAgent: '',
      languages: 'en-US,en',
      timeZone: proxyConfig.timezone,
    },
  });
  return data.data.id;
}

export async function openProfile(profileId) {
  const { data } = await BB.post('/browser/open', { id: profileId });
  return { ws: data.data.ws, http: data.data.http };
}

export async function closeProfile(profileId) {
  await BB.post('/browser/close', { id: profileId });
}
Enter fullscreen mode Exit fullscreen mode

The ws returned from open is a Chrome DevTools Protocol WebSocket, which Playwright or Puppeteer can attach to.

Proxy Rotation Strategy

For Reddit, the rotation rules are tighter than for Facebook ads. Three principles drive the proxy layer:

1. One proxy per account, sticky for the account's lifetime.

Rotating proxies on a single Reddit account is a red flag. The IP must stay consistent within a city-level geography for the account's life. Use sticky residential sessions (most providers offer 10-30 minute or session-bound stickiness; for Reddit, configure for session lifetime).

2. Proxy geography must match the account's claimed location.

If an account historically posted from US East and suddenly logs in from Frankfurt, Reddit flags it. The orchestrator stores each account's home_geo and rejects any proxy assignment outside that geography.

3. ASN diversity across the fleet.

If 8 of your 24 accounts all route through the same ASN (e.g., the same residential provider's Comcast pool), Reddit's correlation systems can cluster them. Mix at least 3 providers across the fleet.

A simple proxy pool manager:

class ProxyPool {
  constructor(providers) {
    this.providers = providers;
    this.assignments = new Map();
  }

  async assignProxy(accountId, geoHint) {
    if (this.assignments.has(accountId)) {
      return this.assignments.get(accountId);
    }

    const provider = this.selectProvider(accountId);
    const session = await provider.createStickySession({
      country: geoHint.country,
      city: geoHint.city,
      sessionDuration: 'unlimited',
    });

    const proxy = {
      type: 'socks5',
      host: session.host,
      port: session.port,
      username: session.user,
      password: session.pass,
      timezone: geoHint.timezone,
    };

    this.assignments.set(accountId, proxy);
    return proxy;
  }

  selectProvider(accountId) {
    const hash = this.hashAccountId(accountId);
    return this.providers[hash % this.providers.length];
  }
}
Enter fullscreen mode Exit fullscreen mode

The deterministic provider selection (via account ID hash) keeps the same account on the same provider across orchestrator restarts. This avoids accidental ASN drift.

Account State Machine

Not every Reddit account in the fleet should perform every action. A 4-day-old account shouldn't be posting in r/personalfinance. The orchestrator tracks each account through a state machine:

const ACCOUNT_STATES = {
  WARMING: 'warming',           // 0-14 days, read-only + light voting
  ESTABLISHING: 'establishing', // 14-60 days, commenting in low-stakes subs
  ACTIVE: 'active',             // 60+ days, full posting capability
  COOLDOWN: 'cooldown',         // post-action rest period
  SHADOWBAN_CHECK: 'shadowban_check',
  RETIRED: 'retired',
};

function getAvailableActions(account) {
  switch (account.state) {
    case 'warming':
      return ['browse', 'upvote_low_risk', 'save_post'];
    case 'establishing':
      return ['browse', 'upvote', 'comment_replies', 'comment_low_stakes'];
    case 'active':
      return ['browse', 'upvote', 'comment', 'post', 'crosspost'];
    default:
      return ['browse'];
  }
}
Enter fullscreen mode Exit fullscreen mode

The warming phase is the most-skipped step in agency setups, and the most common reason new accounts get filtered. A 14-day pure-browsing warm-up reduces shadowban rate from roughly 35% to under 5% in our internal tracking.

Mobile Sessions for Account Verification

Reddit increasingly asks new accounts to verify via email or phone, and some subreddits require mobile-only posting (especially location-tagged communities). Running mobile sessions from a desktop fleet usually means either physical phones or cloud-based Android instances. We use BitCloudPhone for the cloud Android layer when a brand account needs mobile-app posting alongside its desktop browser presence — it shares fingerprint context with the desktop profile, which keeps the account looking consistent across surfaces.

The mobile cloud instance gets the same proxy and timezone as the linked desktop profile. Any deviation across surfaces is a fingerprinting tell.

Shadowban Detection Loop

Because shadowbans are silent, the orchestrator runs a periodic external check. For each account, every 6 hours:

  1. Submit a test comment from the account.
  2. From an unrelated proxy (different ASN, different account), fetch the target thread via Reddit's public JSON endpoint.
  3. Compare: does the comment appear in the public view?

If three consecutive checks fail, the account moves to SHADOWBAN_CHECK state and the orchestrator stops dispatching actions to it until manually reviewed.

async function isShadowbanned(account, testCommentId, threadUrl) {
  const publicView = await fetchAsAnonymous(threadUrl + '.json');
  const found = findCommentInTree(publicView, testCommentId);
  return !found;
}
Enter fullscreen mode Exit fullscreen mode

This is the single most useful piece of monitoring in the entire stack. Without it, you can run a dead account for weeks.

Action Pacing and Burstiness

Human Reddit usage is bursty. People scroll for 15 minutes, vote on 8 things, comment once, then disappear for 4 hours. Naïve schedulers space actions evenly, which is a strong bot signal.

The action dispatcher uses a Poisson-process model with two parameters per account: average actions per active session, and average session duration. Sessions themselves are scheduled on the account's historical posting hours (US East accounts mostly active 9am-11pm ET, etc.). Within a session, action timing is jittered.

function scheduleNextAction(account, lastActionAt) {
  const lambda = account.profile.actionsPerHour;
  const delaySeconds = -Math.log(1 - Math.random()) / (lambda / 3600);
  return new Date(lastActionAt.getTime() + delaySeconds * 1000);
}
Enter fullscreen mode Exit fullscreen mode

What Goes Wrong in Practice

Three failure modes account for most issues:

  • Cookie corruption across profile reuse. If a profile is closed mid-action, BitBrowser sometimes flushes cookies inconsistently. Always wait for the /browser/close response before re-opening.
  • CDP WebSocket disconnect on long-running scripts. For Playwright scripts that run more than 30 minutes per session, implement reconnection logic. The CDP socket times out on idle.
  • Proxy DNS leakage. Even with proxy configured at the BitBrowser level, ensure WebRTC is disabled and DNS resolution is forced through the proxy. BitBrowser's fingerprint settings include both toggles.

Closing Notes

A multi-account Reddit backend is more about discipline than tooling. The browser layer, proxy layer, and orchestration layer all have to enforce the same constraint: each account behaves like a separate human, consistently, over months. Cut corners on any single layer and the entire fleet pays for it.

The full reference implementation we use in production is around 4,000 lines of TypeScript. The architecture above is the load-bearing 20%. If you build the proxy stickiness, the state machine, and the shadowban detection loop correctly, the rest is glue.

Top comments (0)