Environments

Every External Integration has three environments. Each has its own client ID and secret, redirect URIs, linked accounts, tokens, webhook destinations, and data. Nothing crosses environments. The client ID selects the environment. You never send a resource or environment parameter.

	Sandbox	Test	Live
Client ID	`ofext_sandbox_...`	`ofext_test_...`	`ofext_live_...`
Data	Mock. No OnlyFans calls are made.	Real. Only the integration owner’s designated test accounts.	Real customer accounts.
Who can authorize	Anyone with the Sandbox client.	Members of your organization using designated test accounts.	Any OFAuth user.
Operation limits	Standard rate limits.	Standard rate limits plus a daily operation quota.	Standard rate limits.
Redirect URIs	HTTPS, or `http://127.0.0.1` / `http://[::1]` loopback.	Same as Sandbox.	HTTPS with a domain hostname only.
`purpose` parameter	Must be omitted.	Must be omitted.	Required.
Approval	None.	None.	Live approval of your integration.

Every access token has the same audience, https://api.ofauth.com/v3. The environment is a signed claim in the token, taken from the client that requested it.

Sandbox

Use Sandbox for development, CI, and demos. Authorization works end to end and returns mock linked accounts with deterministic fixture data. Sandbox never contacts OnlyFans, so there is no risk of triggering OnlyFans security checks. Sandbox accounts always have Vault+ on. Because the data is mock, Sandbox cannot verify that your integration handles real account states. Use Test for that.

Test

Use Test to validate against real OnlyFans accounts you control. Only accounts designated by the integration owner in the dashboard can be shared. Each day a fixed number of Access operations are allowed; when the quota is used up, calls return 429 quota_exhausted with Retry-After set to the seconds until the UTC reset.

Avoid repeated logins to real accounts. Too many login attempts can trigger OnlyFans “suspicious activity” detection. Link each test account once and rely on refresh tokens.

Live

Live is for your customers. Requirements:

An active Developer plan on your organization.
Live approval of your External Integration. Request it from the dashboard once your integration works in Test. Approval reviews your purpose statement, scopes, redirect URIs, and privacy policy.
HTTPS redirect URIs with domain hostnames.
A purpose statement on every authorization request.

Until approval, Live calls fail with integration_not_approved. Without the plan, they fail with subscription_required. See Errors.

Switching environments in code

Everything is parameterized by the credentials. Keep one configuration object per environment.

Node.js

const environments = {
  sandbox: {
    clientId: process.env.OFAUTH_SANDBOX_CLIENT_ID,
    clientSecret: process.env.OFAUTH_SANDBOX_CLIENT_SECRET,
    redirectUri: "http://127.0.0.1:3000/oauth/ofauth/callback"
  },
  live: {
    clientId: process.env.OFAUTH_LIVE_CLIENT_ID,
    clientSecret: process.env.OFAUTH_LIVE_CLIENT_SECRET,
    redirectUri: "https://developer.example.com/oauth/ofauth/callback",
    purpose: "Read the selected OnlyFans profile and inbox"
  }
}

Store the environment next to each refresh token and linked account id. A Sandbox token cannot reach a Live account, and a Live linked account id does not exist in Sandbox.

External OAuth (V3)

Migration

Sandbox

Test

Live

Switching environments in code

​Sandbox

​Test

​Live

​Switching environments in code

Sandbox

Test

Live

Switching environments in code