> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ofauth.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments

> Sandbox, Test, and Live are fully isolated

Every External Integration has three environments. Each has its own client ID and secret, redirect URIs, linked accounts, tokens, webhook destinations, and data. Nothing crosses environments.

The client ID selects the environment. You never send a resource or environment parameter.

| | Sandbox | Test | Live |
| - | - | - | - |
| Client ID | `ofext_sandbox_...` | `ofext_test_...` | `ofext_live_...` |
| Data | Mock. No OnlyFans calls are made. | Real. Only the integration owner's designated test accounts. | Real customer accounts. |
| Who can authorize | Anyone with the Sandbox client. | Members of your organization using designated test accounts. | Any OFAuth user. |
| Operation limits | Standard rate limits. | Standard rate limits plus a daily operation quota. | Standard rate limits. |
| Redirect URIs | HTTPS, or `http://127.0.0.1` / `http://[::1]` loopback. | Same as Sandbox. | HTTPS with a domain hostname only. |
| `purpose` parameter | Must be omitted. | Must be omitted. | Required. |
| Approval | None. | None. | Live approval of your integration. |

Every access token has the same audience, `https://api.ofauth.com/v3`. The environment is a signed claim in the token, taken from the client that requested it.

## Sandbox

Use Sandbox for development, CI, and demos. Authorization works end to end and returns mock linked accounts with deterministic fixture data. Sandbox never contacts OnlyFans, so there is no risk of triggering OnlyFans security checks. Sandbox accounts always have Vault+ on.

Because the data is mock, Sandbox cannot verify that your integration handles real account states. Use Test for that.

## Test

Use Test to validate against real OnlyFans accounts you control. Only accounts designated by the integration owner in the dashboard can be shared. Each day a fixed number of Access operations are allowed; when the quota is used up, calls return `429 quota_exhausted` with `Retry-After` set to the seconds until the UTC reset.

<Warning>
  Avoid repeated logins to real accounts. Too many login attempts can trigger OnlyFans "suspicious activity" detection. Link each test account once and rely on refresh tokens.
</Warning>

## Live

Live is for your customers. Requirements:

1. An active Developer plan on your organization.
2. Live approval of your External Integration. Request it from the dashboard once your integration works in Test. Approval reviews your purpose statement, scopes, redirect URIs, and privacy policy.
3. HTTPS redirect URIs with domain hostnames.
4. A `purpose` statement on every authorization request.

Until approval, Live calls fail with `integration_not_approved`. Without the plan, they fail with `subscription_required`. See [Errors](/v3/errors).

## Switching environments in code

Everything is parameterized by the credentials. Keep one configuration object per environment.

```javascript Node.js theme={null}
const environments = {
  sandbox: {
    clientId: process.env.OFAUTH_SANDBOX_CLIENT_ID,
    clientSecret: process.env.OFAUTH_SANDBOX_CLIENT_SECRET,
    redirectUri: "http://127.0.0.1:3000/oauth/ofauth/callback"
  },
  live: {
    clientId: process.env.OFAUTH_LIVE_CLIENT_ID,
    clientSecret: process.env.OFAUTH_LIVE_CLIENT_SECRET,
    redirectUri: "https://developer.example.com/oauth/ofauth/callback",
    purpose: "Read the selected OnlyFans profile and inbox"
  }
}
```

Store the environment next to each refresh token and linked account id. A Sandbox token cannot reach a Live account, and a Live linked account id does not exist in Sandbox.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.