Signing Requests

How to sign requests

Using the signing API, you can sign requests to the OnlyFans API. This is necessary to authenticate your requests and ensure that they are valid.

There's two ways to integrate the signing API into your application:

• Sign Request Endpoint
• Self-sign Requests

# Sign Request Endpoint

Using the Sign Request endpoint is the easiest way to integrate the signing API into your application. You can use the endpoint to sign requests for any of the OnlyFans API endpoints.

To get started, you'll need an access key with rules permissions. You can create an access key here.

# Making a Sign Request

Make a POST request to https://api.ofauth.com/v2/dynamic-rules/sign with:

# Headers

• Content-Type: application/json
• apiKey: your_api_key_here

# Request Body

        {
	"endpoint": "https://onlyfans.com/api2/v2/users/me", // Required: The OF API endpoint
	"user_id": "123456789", // Optional: The OF user ID making the request
	"timestamp": 1726600781032 // Optional: Current timestamp in ms
}

      

# Response

        {
	"signed": {
		"sign": "21234:dfgoiuh92348jnkldflksdfj:34f:279349",
		"time": "1799981647642",
		"app-token": "9as8fhjioasjdfhoiaf"
	},
	"is_public": true,
	"is_early_access": true,
	"is_exclusive_access": true
}

      

# Using the Signed Values

Add the values from the response as headers in your OnlyFans API request:

        const response = await fetch('https://onlyfans.com/api2/v2/users/me', {
	headers: {
		sign: signed.sign,
		time: signed.time,
		'app-token': signed['app-token']
		// ... other required OF headers
	}
});

      

# Rate Limits

The signing API has the following rate limits:

# Sign Endpoint (/v2/dynamic-rules/sign)

• 30 requests per minute
• Headers will include remaining requests and reset time

# Rules Endpoint (/v2/dynamic-rules)

• 1 request per minute
• Headers will include remaining requests and reset time
• We recommend caching the rules locally

When you exceed the rate limit, you'll receive a 429 response with headers:

        X-RateLimit-Limit: 20
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1706447400

      

# Self-sign Requests

For high-volume applications, you can self-sign requests to avoid the API rate limits:

1. Get the latest dynamic rules from the Rules Endpoint:

        // GET https://api.ofauth.com/v2/dynamic-rules
const rules = await fetch('https://api.ofauth.com/v2/dynamic-rules', {
	headers: {
		apiKey: 'your_api_key_here'
	}
}).then((r) => r.json());

      

2. Implement the signing algorithm in your application.

3. Use the generated values in your OF API requests:

        const { sign, time } = generateSignature(rules, {
	endpoint: 'https://onlyfans.com/api2/v2/users/me',
	userId: '123456789', // optional
	timestamp: Date.now() // optional
});

const response = await fetch('https://onlyfans.com/api2/v2/users/me', {
	headers: {
		sign: sign,
		time: time,
		'app-token': rules.app_token
		// ... other required OF headers
	}
});

      

# Examples

Check out the examples on the public Github repository.