Overview
The Dynamic Rules API (/v2/dynamic-rules) provides the current signing parameters required to generate valid signatures for OnlyFans API requests. OnlyFans requires cryptographically signed requests and changes their signing requirements very frequently - sometimes multiple times per day.
Use the Access API Instead
Automatic signing, no maintenance required. Recommended for most use cases.
Use the TypeScript SDK
Full-featured SDK with built-in signing and error handling.
When You Need Dynamic Rules
Dynamic rules are required when:- Direct OnlyFans API Integration: Making requests directly to
onlyfans.comAPIs - Custom Proxy Solutions: Building your own request proxy system
- Advanced Use Cases: Specific requirements that can’t use OFAuth’s Access API
Update Detection: Set up webhooks for proactive notifications, or watch for 400 “Please refresh the page” errors when making direct OnlyFans API requests.
When You Don’t Need Dynamic Rules
You can skip dynamic rules implementation if:- Using Access API: All OnlyFans requests go through OFAuth’s
/v2/accessendpoints - Standard Integration: Following OFAuth’s recommended integration patterns
- Simplified Architecture: Want OFAuth to handle all OnlyFans API complexity
Why Dynamic Rules Are Essential
OnlyFans implements sophisticated anti-abuse measures that require:- Cryptographic Signatures: Every API request must include a valid signature
- Current Parameters: Signing algorithm, fields, and formats change frequently
- Exact Implementation: Minor deviations result in rejected requests
- Real-time Updates: Rules can change multiple times per day without notice
What Happens Without Current Rules
- Authentication Failures: 401/403 errors for all OnlyFans API requests
- Service Interruption: Applications stop working until rules are updated
- User Impact: Authentication flows fail, data access blocked
How OFAuth Solves This
OFAuth provides two solutions for handling OnlyFans’ complex signing requirements: 1. Access API (Recommended)- Automatic Signing: All request signing handled transparently
- No Implementation Required: Use standard REST endpoints
- Always Current: Signing rules updated automatically
- Zero Maintenance: No code changes needed for rule updates
- Real-time Monitoring: OFAuth tracks rule changes 24/7
- Instant Access: Latest rules available via API immediately, and sent as a webhook event
- Manual Signing: Use the
/signendpoint for custom implementations - High Availability: Multiple redundant systems ensure rule availability
Base URL
Authentication
All Dynamic Rules API requests require your API key:Access Control
Access to dynamic rules is available in two forms:- Current Rules (Paid): Real-time signing payloads delivered via API and webhooks. This is the add-on sold with OFAuth and includes 24/7 monitoring and SLA-backed uptime.
- Public Rules (GitHub): Delayed snapshots published for the community at no cost. Grab them from github.com/deviint/onlyfans-dynamic-rules.
Core Endpoints
Get Current Rules
Retrieve the latest OnlyFans API rules and signing parameters.Sign Request
Generate a signed request using current rules for OnlyFans API access.Check Rules Status
Get the current status of dynamic rules without fetching the actual rules.Implementation Guide
1. Fetch and Cache Rules
2. Generate Signed Requests
3. Handle Rules Updates
There are two proper ways to detect when rules need updating:- Error-Driven (Reactive): Monitor for 400 “Please refresh the page” errors from OnlyFans APIs
- Webhook-Driven (Proactive): Set up a webhook endpoint to receive rules updates with the new rules included in the payload
No API Call Required: The webhook includes the complete rules object in the payload, so you don’t need to make a separate API request to
/v2/dynamic-rules when you receive the webhook.Advanced Integration Patterns
Self-Signing Implementation
For high-volume applications, you can implement local signing after fetching rules:Error Handling
Rules Update Required (400 from OnlyFans)
Rules Update Required (400 from OnlyFans)
When making requests to OnlyFans APIs with signed headers, you may receive:Solution: This indicates your rules are outdated. Fetch new rules and retry the request.
Insufficient Access (403)
Insufficient Access (403)
Rules Not Current (503)
Rules Not Current (503)
Invalid Method (405)
Invalid Method (405)
/, POST for /sign, GET for /status).Best Practices
Rules Management
Cache Efficiently
Cache rules but refresh when
is_current becomes falseMonitor Changes
Use webhooks or watch for 400 “Please refresh the page” errors
Handle Access Tiers
Design your app to gracefully handle different access levels
Auto-Retry Logic
Implement automatic rule refresh and request retry on 400 errors
Plan for Outages
Build fallback strategies for OnlyFans API disruptions
Error Handling
Implement robust error handling for third-party dependencies
Performance Optimization
Reliability Considerations
Migration Guide
From Legacy Signing
If you’re migrating from a legacy signing implementation:- Replace static rules with dynamic rule fetching
- Update signing algorithms based on current rules structure
- Implement proper caching with
is_currentchecks - Add monitoring for rules changes using
/statusendpoint
Next Steps
Access API
Use signed requests with the Access API
Link API
Establish user connections for signing
Connections
Manage connection lifecycle