Skip to main content
V3 is the current way to integrate OFAuth. Your application is an External Integration. It asks people to share their OnlyFans accounts through a standard OAuth 2.0 Authorization Code flow with PKCE, receives per-user bearer tokens, and calls typed Access operations with those tokens.
Migrating from API keys and Link? Read the V2 to V3 migration guide. V2 stays supported, but new integrations should use V3.

​
Concepts

​
Endpoints

Browser routes live on auth.ofauth.com. Server routes live on api.ofauth.com. The issuer is https://auth.ofauth.com/link.

​
Environments come from the client

Each environment has its own client ID: ofext_sandbox_..., ofext_test_..., or ofext_live_.... OFAuth derives the environment from the client ID, so you never send a resource or environment parameter. See Environments.

​
The whole flow

  1. Your backend builds an authorization URL and sends the user to it in a top-level browser.
  2. The user signs in to OFAuth, links or chooses OnlyFans accounts, and approves your scopes.
  3. OFAuth redirects to your registered callback with code and state.
  4. Your backend exchanges the code for tokens. The response includes authorization_id and the first page of linked_accounts.
  5. You call /v3/access/* with Authorization: Bearer and x-linked-account-id.
  6. Access tokens last 10 minutes. Refresh them with the refresh token when offline_access was granted.
  7. Webhook destinations deliver lifecycle and Realtime events per environment.

​
Access rules

  • A token only reaches the linked accounts of its own authorization. There is no API that lists accounts across authorizations.
  • The developer dashboard does not list your users’ accounts either. It offers a search-by-ID debugger for an authorization or linked account ID you already know.
  • The owner can revoke your access at any time, to one account or to the whole authorization.

​
Quick start

1

Create an External Integration

In the dashboard, create your External Integration. Each environment has its own client ID and secret.
2

Register redirect URIs

Add the exact backend callback for each environment. See redirect URI rules.
3

Start in Sandbox

Use your Sandbox client. Sandbox returns mock data and never touches OnlyFans. See Environments.
4

Implement authorize, callback, and token

Follow Authorize and Tokens and refresh.
5

Call Access

Follow Linked accounts and Calling Access.
6

Add webhooks

Configure a destination per environment. See Webhooks.
7

Go live

Live requires the Developer plan and Live approval of your integration. Request it from the dashboard.

​
Pages

Authorize

Authorization request, redirect URI rules, callback handling

Tokens and refresh

Token exchange, refresh rotation, revocation, discovery

Linked accounts

List, read, and remove linked accounts, and the x-linked-account-id header

Calling Access

Scopes, headers, rate limits, quotas

Webhooks

Destinations, envelope, lifecycle and Realtime events

Vault+

Persistent media cache on V3

Environments

Sandbox, Test, and Live

Errors

Error envelope, codes, and recovery actions