Sandbox & Testing

OFAuth provides a sandbox environment for safe development and testing. Use sandbox API keys to test all features without affecting real OnlyFans accounts.

Always use Sandbox for testing logins. Too many login attempts on production OnlyFans accounts can trigger “suspicious activity” detection, which may cause OnlyFans to reset the account.

How Environments Work

The environment is determined by your API key prefix:

Key Prefix	Environment	Purpose
`sk_live_...`	Live	Production - real OnlyFans requests
`sk_sandbox_...`	Sandbox	Testing - deterministic fixtures

Use a Sandbox API key during development and switch to a Live key for production. No code changes needed.

Creating API Keys

Go to OFAuth Dashboard > Developers > API Keys
Create keys for both environments:
- Sandbox key for development and testing
- Live key for production

Sandbox Test Credentials

Use these test accounts to complete Link authentication flows:

Scenario	Email format	Password	OTP
Creator (no 2FA)	`{identifier}@creator.sandbox.com`	`good-password`	—
Creator (with OTP)	`{identifier}@creator-otp.sandbox.com`	`good-password`	`123456`
Fan (no 2FA)	`{identifier}@fan.sandbox.com`	`good-password`	—
Fan (with OTP)	`{identifier}@fan-otp.sandbox.com`	`good-password`	`123456`

Examples:

jane@creator.sandbox.com          // Creator without 2FA
alex@creator-otp.sandbox.com      // Creator with OTP 123456
marco@fan.sandbox.com             // Fan without 2FA
sasha@fan-otp.sandbox.com         // Fan with OTP 123456

Any identifier works (e.g., demo, user123, test). The domain controls the behavior.

What You Can Test

Feature	Sandbox Behavior
Link	Full auth flows with test credentials
Access API	Returns realistic fixture data
Webhooks	Simulated events mirror production payloads
SDK	Identical behavior to production

Environment Differences

Aspect	Sandbox	Live
Data source	Deterministic fixtures	Real OnlyFans data
Billing	Free	Pay per usage
Rate limits	Same as production	Same
API behavior	Identical	Identical

Switching Environments

Simply change your API key—no code changes required:

// Development
const API_KEY = process.env.OFAUTH_SANDBOX_KEY // sk_sandbox_...

// Production
const API_KEY = process.env.OFAUTH_API_KEY // sk_live_...

// Same code works for both
const response = await fetch("https://api.ofauth.com/v2/account/whoami", {
  headers: { apikey: API_KEY }
})

Common Troubleshooting

Wrong password error

Use good-password for all sandbox test accounts.

OTP required but not expected

Only *-otp.sandbox.com accounts require OTP. The code is always 123456.

Invalid email error

Verify the domain format: creator.sandbox.com, creator-otp.sandbox.com, fan.sandbox.com, or fan-otp.sandbox.com.

Data doesn't persist

Sandbox data is deterministic fixtures, not persistent storage. Treat responses as test fixtures.

Introduction

Setup

Reference

Advanced

Sandbox & Testing

How Environments Work

Creating API Keys

Sandbox Test Credentials

What You Can Test

Environment Differences

Switching Environments

Common Troubleshooting

Next Steps

Quickstart

Link Authentication

​How Environments Work

​Creating API Keys

​Sandbox Test Credentials

​What You Can Test

​Environment Differences

​Switching Environments

​Common Troubleshooting

​Next Steps

Quickstart

Link Authentication

How Environments Work

Creating API Keys

Sandbox Test Credentials

What You Can Test

Environment Differences

Switching Environments

Common Troubleshooting

Next Steps