Integration Checklist

Use this checklist to ensure your OFAuth integration is complete and production-ready.

Before You Start

Create OFAuth Account

Complete Platform Profile

Set up your platform profile (app name, description, website, privacy policy) via the setup wizard in Dashboard > Client Apps.

Create a Client App

Create a client app and choose your integration type (Redirect, Embed, or Whitelabel). Configure allowed redirect URIs or origins for your app. Copy your clientAppId.

Generate API Key

Go to API Keys and create your API key.

Keep your API key secure. Never commit it to version control or expose it client-side.

Set Data Access Permissions

Configure which OnlyFans data your integration needs access to (profile, posts, messages, etc.) in Dashboard > Client Apps > Settings > Access Permissions.

Configure Webhook Endpoint

Set up your webhook URL at Webhooks to receive System Webhook Events for connection changes.

Development Setup

Use Sandbox Environment

Always develop and test using the Sandbox environment first.

Important: Always use Sandbox for testing logins. Too many login attempts on production OnlyFans accounts can trigger “suspicious activity” detection, which may cause OnlyFans to reset the account. Use Sandbox test credentials to avoid this.

Implement Link Flow

Set up the authentication flow to connect OnlyFans accounts:

// Initialize a Link session
const response = await fetch("https://api.ofauth.com/v2/link/init", {
  method: "POST",
  headers: {
    apikey: "YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    redirectUrl: "https://yourapp.com/callback",
    clientReferenceId: "your_internal_user_id"
  })
});

const session = await response.json();
if (session.mode !== "hosted") {
  throw new Error(`Expected hosted Link session, received ${session.mode}`);
}
// Redirect user to `session.url`

Handle System Webhook Events

Process incoming webhooks to store connection IDs:

app.post("/webhooks/ofauth", async (req, res) => {
  const { type, data } = req.body;
  
  if (type === "connection.created") {
    await db.users.update({
      where: { id: data.clientReferenceId },
      data: { connectionId: data.connection.id }
    });
  }
  
  res.status(200).send("ok");
});

Store Connection IDs Securely

Treat connection IDs like credentials—store them encrypted in your database.

Pre-Production Checklist

API key works with test requests

Link flow completes successfully in Sandbox

System Webhook Events are being received and processed

Connection IDs are stored and retrievable

Access API calls work with stored connection IDs

Error Handling

Ensure your integration handles these scenarios:

Scenario	Your Response
`SESSION_EXPIRED` error	Prompt user to re-authenticate via Link
`RATE_LIMIT_EXCEEDED` error	Implement exponential backoff
`connection.expired` webhook	Notify user, initiate re-auth flow
`connection.disconnected` webhook	Stop API access and remove local connection mapping
Network/timeout errors	Retry with backoff

Session Expiration Flow

async function handleOFAuthRequest(endpoint, options) {
  const response = await fetch(`https://api.ofauth.com${endpoint}`, {
    ...options,
    headers: {
      apikey: process.env.OFAUTH_API_KEY,
      "x-connection-id": connectionId,
      ...options.headers
    }
  });
  
  if (!response.ok) {
    const error = await response.json();
    
    if (error.type === "SESSION_EXPIRED") {
      // Mark connection as needing re-auth
      await markConnectionExpired(connectionId);
      // Notify user
      await notifyUserReauthRequired(userId);
      throw new ReAuthRequiredError();
    }
    
    throw new OFAuthError(error);
  }
  
  return response.json();
}

Go Live Checklist

Switch to Production API Key

Replace your Sandbox API key with your production key.

Production and Sandbox use the same API endpoints. The environment is determined by your API key.

Verify Webhook Signatures

Ensure you’re validating webhook signatures in production:

const crypto = require("crypto");

function verifyWebhook(payload, signature, secret) {
  const [timestamp, hash] = signature.split(",").map(p => p.split("=")[1]);
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${payload}`)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(expected));
}

Set Up Monitoring

Monitor for:

Webhook delivery failures
Rate limit warnings
Session expiration rates
API error rates

Document for Your Users

Create user-facing documentation explaining:

Why you need OnlyFans access
What data you’ll access
How to disconnect their account

Quick Reference

Required Headers

Header	Value	Required
`apikey`	Your OFAuth API key	Always
`x-connection-id`	Connection ID (e.g., `conn_abc123`)	For Access API
`Content-Type`	`application/json`	For POST/PUT/PATCH

Key Endpoints

Purpose	Endpoint
Verify API key	`GET /v2/account/whoami`
Start auth flow	`POST /v2/link/init`
List connections	`GET /v2/account/connections`
Get user profile	`GET /v2/access/self`
List subscribers	`GET /v2/access/subscribers`

Webhook Events

Event	When
`connection.created`	User completes authentication
`connection.updated`	Connection details change
`connection.expired`	Session expires or is invalidated
`connection.disconnected`	Connection is deleted and cannot reconnect

Need Help?

Quickstart Guide

Get your first API call working

Error Handling

Handle errors gracefully

Sandbox Environment

Test safely without affecting real accounts

Contact Support

Get help from our team

Introduction

Setup

Reference

Advanced

Integration Checklist

Before You Start

Development Setup

Pre-Production Checklist

Error Handling

Session Expiration Flow

Go Live Checklist

Quick Reference

Required Headers

Key Endpoints

Webhook Events

Need Help?

Quickstart Guide

Error Handling

Sandbox Environment

Contact Support

​Before You Start

​Development Setup

​Pre-Production Checklist

​Error Handling

​Session Expiration Flow

​Go Live Checklist

​Quick Reference

​Required Headers

​Key Endpoints

​Webhook Events

​Need Help?

Quickstart Guide

Error Handling

Sandbox Environment

Contact Support

Before You Start

Development Setup

Pre-Production Checklist

Error Handling

Session Expiration Flow

Go Live Checklist

Quick Reference

Required Headers

Key Endpoints

Webhook Events

Need Help?