What counts as a credit?

One successful API call. If a request fails — expired session, upstream error — it isn't charged. Mass DMs are the exception: a mailing bills one credit per recipient, and you can preview the exact cost before sending.

How do I authenticate?

A Bearer token: Authorization: Bearer ofapis_sk_…. Create and revoke keys in the dashboard.

Can I manage multiple creators?

Yes. Link several accounts and address each by id under scoped routes. Account count scales with your plan.

Do you have an OpenAPI spec?

A complete OpenAPI 3.0 document and a live Swagger playground — point your generator at it for a typed client.

How to Authenticate an OnlyFans Account Programmatically

How to authenticate an OnlyFans account against the API comes down to two layers, and it pays to keep them straight: your authentication to ofapis (a Bearer token), and the creator account connection that ofapis manages for you. You handle the first in code; ofapis handles the second.

Step 1 — Create a token

Create an ofapis_sk_... token in the dashboard (start free). Keep it server-side — a token is a secret, so never ship it in a browser, mobile app, or public repo.

Step 2 — Authenticate to ofapis

Every API call carries one header. Verify the token works against /me:

curl https://api.ofapis.com/api/public/v1/me \
  -H "Authorization: Bearer ofapis_sk_..."

A 200 returns your workspace and connected accounts:

{
  "workspace": "acme-agency",
  "accounts": [ { "id": "42", "username": "creator_jane", "status": "active" } ],
  "credits": { "remaining": 29760 }
}

Step 3 — Connect the creator account (once)

You connect your own account through the dashboard. ofapis stores the session encrypted (AES-256-GCM), runs a dedicated proxy per account, and keeps the session alive — no refresh cron, no cookie handling in your code. After connecting, calls just work; the connection is not something you redo per request.

Step 4 — Scope calls to the right creator

Agencies with several linked accounts address each one with account-scoped routes:

curl https://api.ofapis.com/api/public/v1/accounts/42/chats \
  -H "Authorization: Bearer ofapis_sk_..."

Omit the account segment and the call uses your first active account:

curl https://api.ofapis.com/api/public/v1/chats \
  -H "Authorization: Bearer ofapis_sk_..."

Read the accounts[].id values from /me to know which ids you can scope to.

Common errors

Status	Meaning	Fix
`401`	Missing, malformed, or revoked token	Check the `Bearer` prefix; reissue the key
`403`	Token valid but account not connected	Connect the account in the dashboard
`404`	`accountId` not on this workspace	Use an id returned by `/me`
`409`	Account session needs re-linking	Reconnect the account once

A failed call from an expired session is not charged a credit — you only pay for successful calls.

Why this beats scraping

Because you connect your own account rather than scraping public pages, and credentials are encrypted at rest behind a per-account proxy, the model is automation on behalf of the account owner. More: is the OnlyFans API safe?.

FAQ

Do I need to log in with an OnlyFans username and password in my code?

No. You connect the account once in the dashboard; ofapis manages the encrypted session. Your code only ever sends the ofapis_sk_... Bearer token.

How do I revoke or rotate a token?

Revoke and reissue keys in the dashboard at any time. Revoking is instant, so rotate on a schedule and whenever a key may have leaked.

Does the session expire and break my integration?

No. ofapis keeps the account session alive with no refresh cron. If a re-link is ever needed, you reconnect once in the dashboard.

Can one token access multiple accounts?

Yes. A token is scoped to your workspace, and you address each connected account by id under /accounts/{id}/.... Multi-account plans start at Pro; see pricing.