OnlyFans Webhook Events Explained

Polling wastes calls — you ask "anything new?" thousands of times for a handful of yes-es. Webhooks flip it: ofapis calls you when something happens. This guide covers the OnlyFans webhook events and how to handle each one safely.

What a webhook is

You register an HTTPS endpoint and the events you care about. When one fires, ofapis POSTs a signed JSON payload to your URL. A typical message.received body:

{
  "id": "evt_7f31",
  "type": "message.received",
  "accountId": "42",
  "createdAt": "2026-07-21T09:30:00Z",
  "data": { "chatId": "123", "from": { "id": "u_88", "username": "fan_jane" }, "text": "hey!" }
}

Step 1 — Register an endpoint

Add your URL and the events in the dashboard, or via the webhooks API. You get back an endpoint secret — store it; you need it to verify signatures.

Step 2 — Verify the signature

Every delivery carries an HMAC-SHA256 signature over the raw body in the X-Ofapis-Signature header. Recompute it with your secret and compare in constant time. Reject anything that doesn't match:

import crypto from "crypto";

function verify(rawBody, signature, secret) {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Verify on the raw bytes, before any JSON parsing reformats them.

Step 3 — Respond fast, work async

Return 2xx immediately and push the payload onto a queue for real processing. A slow endpoint looks like a failure and triggers retries:

app.post("/webhooks/ofapis", (req, res) => {
  if (!verify(req.rawBody, req.headers["x-ofapis-signature"], SECRET)) {
    return res.status(401).end();
  }
  queue.add(req.body);   // heavy work happens elsewhere
  res.status(200).end();
});

Step 4 — Handle idempotently

Networks retry, so treat every delivery as at-least-once. Key your processing on the event id so a duplicate doesn't double-send a reply. ofapis retries failed deliveries with backoff and shows delivery health — retries and failures — in the dashboard.

Events

message.received is the headline event today; more types are on the roadmap. See the webhooks reference for the current list.

FAQ

How do I verify a webhook is really from ofapis?

Recompute the HMAC-SHA256 of the raw request body with your endpoint secret and compare it to the X-Ofapis-Signature header using a constant-time check. Reject any mismatch.

What happens if my endpoint is down?

ofapis retries failed deliveries with exponential backoff and records each attempt. Because delivery is at-least-once, make your handler idempotent by keying on the event id.

Do webhook deliveries cost credits?

No. Credits are spent on your outbound API calls. Inbound webhook deliveries from ofapis are not metered.

Which events can I subscribe to right now?

message.received is live today, with more event types planned. Check the webhooks reference for the up-to-date list before you build.

Next steps

• Webhooks capability
• Build a chatbot
• Messaging API
• Get a token free

Related: Webhook setup guide