Link Authentication

Connect OnlyFans accounts to your platform securely. OFAuth handles credentials on hosted pages—you receive a Connection ID for API access.

Use Sandbox for testing! Before testing with real OnlyFans accounts, use Sandbox test credentials. Too many login attempts on production accounts can trigger OnlyFans “suspicious activity” detection.

Choose Your Integration

Redirect Flow

Redirect users to OFAuth’s authentication pages. Simple to implement.

Popup Flow

Show authentication in a popup. Best user experience.

How It Works

Create a Link session with your redirect URL
Redirect the user to OFAuth’s secure authentication page
User authenticates on OFAuth (2FA and captcha handled automatically)
Receive Connection ID via callback URL or webhook

Prerequisites

Complete Platform Profile

Set up your platform profile (app name, description, website, privacy policy) in the OFAuth Dashboard.

Create a Client App

Create a client app in Dashboard > Client Apps. Choose your app type (Redirect, Embed, or Whitelabel) and configure allowed redirect URIs or origins. Copy your clientAppId.

Get API Key

Get your API key from Dashboard > API Keys.

Set Permissions

Configure which OnlyFans data your platform can access in Dashboard > Client Apps > Settings > Access Permissions.

Redirect Flow

The simplest integration—redirect users to OFAuth’s hosted authentication pages.

Step 1: Create a Link Session

const response = await fetch("https://api.ofauth.com/v2/link/init", {
  method: "POST",
  headers: {
    apikey: "YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    redirectUrl: "https://yourapp.com/callback",
    clientReferenceId: "your-internal-user-id"
  })
})

const session = await response.json()

if (session.mode !== "hosted") {
  throw new Error(`Expected hosted Link session, received ${session.mode}`)
}

console.log("Send user to:", session.url)

import requests

response = requests.post(
    "https://api.ofauth.com/v2/link/init",
    headers={
        "apikey": "YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    json={
        "redirectUrl": "https://yourapp.com/callback",
        "clientReferenceId": "your-internal-user-id"
    }
)

data = response.json()
if data["mode"] != "hosted":
    raise ValueError(f"Expected hosted Link session, received {data['mode']}")

print("Send user to:", data["url"])

curl -X POST https://api.ofauth.com/v2/link/init \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "redirectUrl": "https://yourapp.com/callback",
    "clientReferenceId": "your-internal-user-id"
  }'

Response:

{
  "mode": "hosted",
  "url": "https://link.ofauth.com/cs_abc123...",
  "expiresAt": "2024-01-15T10:30:00Z"
}

Session Options

Option	Type	Description
`clientAppId`	string	Your client app ID. Recommended for production integrations.
`redirectUrl`	string	Callback URL. Must be in your client app’s allowed redirect URIs for redirect apps.
`clientReferenceId`	string	Your internal user ID for correlation
`connectionId`	string	Existing connection ID to reconnect

Step 2: Redirect User

window.location.href = session.url

The user will enter their credentials, complete 2FA if enabled, and solve captchas—all handled automatically by OFAuth.

Step 3: Handle the Callback

After authentication, users are redirected to your URL:

https://yourapp.com/callback?status=success&connection_id=conn_abc123

const params = new URLSearchParams(window.location.search)
const status = params.get("status")
const connectionId = params.get("connection_id")

if (status === "success" && connectionId) {
  await saveConnectionId(userId, connectionId)
  redirect("/dashboard")
} else if (status === "cancelled") {
  console.log("User cancelled at:", params.get("step"))
} else if (status === "error") {
  console.error("Error:", params.get("error_code"))
}

Callback Parameters

Parameter	Description
`status`	`success`, `cancelled`, or `error`
`connection_id`	The connection ID (on success)
`client_reference_id`	Your internal ID (if provided)
`step`	Where user cancelled: `pre-login`, `login`, `2fa`
`error_code`	Error type: `session_expired`, `invalid_credentials`, `account_locked`, `2fa_failed`

Keep users in your app with a popup authentication experience.

Installation

npm install @ofauth/link-embed

<script
  src="https://unpkg.com/@ofauth/link-embed/dist/embed.global.js"
  defer
  data-auto-init
></script>

JavaScript Library Usage

import { OFAuthLinkEmbed } from '@ofauth/link-embed';

// Create a handler
const handler = OFAuthLinkEmbed.create({
  theme: 'auto',
  async onSuccess(metadata) {
    console.log('Connected:', metadata.connection.id);
    await storeConnection(metadata.connection.id);
  },
  onClose(metadata) {
    console.log('Closed:', metadata.type);
  },
  async onInvalidSession() {
    // Session expired, create a new one
    const response = await fetch("/api/create-link-session");
    const session = await response.json();
    if (session.mode !== 'hosted') {
      throw new Error(`Expected hosted Link session, received ${session.mode}`);
    }
    handler.open(session.url);
  }
});

// Open the authentication popup
async function connectOnlyFans() {
  const response = await fetch("/api/create-link-session");
  const session = await response.json();
  if (session.mode !== 'hosted') {
    throw new Error(`Expected hosted Link session, received ${session.mode}`);
  }
  handler.open(session.url);
}

Configuration Options

Option	Type	Description
`theme`	`'light' \| 'dark' \| 'auto'`	Theme for the interface (default: ‘auto’)
`onSuccess`	`(metadata) => void`	Called when authentication succeeds
`onClose`	`(metadata) => void`	Called when user closes the embed
`onInvalidSession`	`() => void`	Called when session expires

Success Metadata

interface SuccessMetadata {
  successUrl: string;
  connection: {
    id: string;         // Connection ID to store
    userData: {
      id: string;
      name: string;
      username: string;
      avatar: string;
    };
  };
}

Global Script (No Build)

<a
  data-ofauth-link
  href="https://link.ofauth.com/cs_xxxxxxxxx"
  data-ofauth-theme="auto"
>
  Connect OnlyFans Account
</a>

<script
  src="https://unpkg.com/@ofauth/link-embed/dist/embed.global.js"
  defer
  data-auto-init
></script>

<script>
  document.querySelector('[data-ofauth-link]')
    .addEventListener('success', (e) => {
      console.log('Connected:', e.detail.metadata.connection.id);
    });
</script>

Use the Connection

Once you have a Connection ID, make API calls:

const response = await fetch("https://api.ofauth.com/v2/access/self", {
  headers: {
    apikey: "YOUR_API_KEY",
    "x-connection-id": connectionId
  }
})

const account = await response.json()
console.log("Connected as:", account.name)

Reconnecting Expired Connections

When a connection expires, reconnect without creating duplicates:

const response = await fetch("https://api.ofauth.com/v2/link/init", {
  method: "POST",
  headers: {
    apikey: "YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    connectionId: "conn_abc123xyz", // Existing connection ID
    redirectUrl: "https://yourapp.com/callback"
  })
})

The existing connection is updated with fresh session data—same Connection ID, no duplicates.

Security Best Practices

Server-Side Verification

Always verify session status server-side, never trust client-side data

HTTPS Only

Use HTTPS for all redirect URLs and API communications

Session Expiry

Link sessions expire after 1 hour. Create a new session if expired.

Allowed URIs

Configure exact redirect URLs in your dashboard. No wildcards.

Troubleshooting

Session Expired

Link sessions expire after 1 hour. Create a new session with /v2/link/init.

Invalid Redirect URL

Add the URL to your client app’s Allowed Redirect URIs in Dashboard > Client Apps.

CSP/CORS Issues (Embed)

Add your domain to your client app’s Allowed Origins in Dashboard > Client Apps.

Authentication

Realtime

Messaging

Content

Media

Management

Link Authentication

Choose Your Integration

Redirect Flow

Popup Flow

How It Works

Prerequisites

Redirect Flow

Step 1: Create a Link Session

Session Options

Step 2: Redirect User

Step 3: Handle the Callback

Callback Parameters

Installation

JavaScript Library Usage

Configuration Options

Success Metadata

Global Script (No Build)

Use the Connection

Reconnecting Expired Connections

Security Best Practices

Server-Side Verification

HTTPS Only

Session Expiry

Allowed URIs

Troubleshooting

Next Steps

Handle System Webhook Events

API Reference

​Choose Your Integration

Redirect Flow

Popup Flow

​How It Works

​Prerequisites

​Redirect Flow

​Step 1: Create a Link Session

​Session Options

​Step 2: Redirect User

​Step 3: Handle the Callback

​Callback Parameters

​Popup Flow (Embed Library)

​Installation

​JavaScript Library Usage

​Configuration Options

​Success Metadata

​Global Script (No Build)

​Use the Connection

​Reconnecting Expired Connections

​Security Best Practices

Server-Side Verification

HTTPS Only

Session Expiry

Allowed URIs

​Troubleshooting

​Next Steps

Handle System Webhook Events

API Reference

Choose Your Integration

How It Works

Prerequisites

Redirect Flow

Step 1: Create a Link Session

Session Options

Step 2: Redirect User

Step 3: Handle the Callback

Callback Parameters

Popup Flow (Embed Library)

Installation

JavaScript Library Usage

Configuration Options

Success Metadata

Global Script (No Build)

Use the Connection

Reconnecting Expired Connections

Security Best Practices

Troubleshooting

Next Steps