> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ofauth.com/llms.txt
> Use this file to discover all available pages before exploring further.

# V3 Overview

> Integrate OFAuth with OAuth 2.0, per-user bearer tokens, and typed Access operations

V3 is the current way to integrate OFAuth. Your application is an **External Integration**. It asks people to share their OnlyFans accounts through a standard OAuth 2.0 Authorization Code flow with PKCE, receives per-user bearer tokens, and calls typed Access operations with those tokens.

<Info>
  Migrating from API keys and Link? Read the [V2 to V3 migration guide](/guides/migrate-v2-to-v3). V2 stays supported, but new integrations should use V3.
</Info>

## Concepts

| Term | Meaning |
| - | - |
| External Integration | Your OAuth application. Owns one client per environment. |
| Client ID and secret | Per-environment credentials for your backend. The client ID selects the environment. Never ship them to a browser or native app. |
| Linked account | One OnlyFans account. Its owner, a person or an organization, links it to OFAuth and can share it with several apps. |
| Owner | The person or organization a linked account belongs to. Not your application. |
| Authorization | The accounts one owner shared with your app, and the scopes they approved. Identified by `authorization_id`. It can cover several linked accounts. |
| Environment | `sandbox`, `test`, or `live`. Credentials, linked accounts, tokens, and webhooks never cross environments. |

## Endpoints

Browser routes live on `auth.ofauth.com`. Server routes live on `api.ofauth.com`.

| Purpose | Endpoint |
| - | - |
| Discovery (RFC 8414) | `GET https://auth.ofauth.com/.well-known/oauth-authorization-server/link` |
| Authorize | `GET https://auth.ofauth.com/link/authorize` |
| Token | `POST https://api.ofauth.com/v3/link/token` |
| Revoke (RFC 7009) | `POST https://api.ofauth.com/v3/link/revoke` |
| Linked accounts | `https://api.ofauth.com/v3/linked-accounts` |
| Access operations | `https://api.ofauth.com/v3/access/*` |
| Vault+ | `https://api.ofauth.com/v3/vault-plus/*` |

The issuer is `https://auth.ofauth.com/link`.

## Environments come from the client

Each environment has its own client ID: `ofext_sandbox_...`, `ofext_test_...`, or `ofext_live_...`. OFAuth derives the environment from the client ID, so you never send a resource or environment parameter. See [Environments](/v3/environments).

## The whole flow

```mermaid theme={null}
sequenceDiagram
    participant User
    participant App as Your backend
    participant Auth as auth.ofauth.com
    participant API as api.ofauth.com
    participant OF as OnlyFans

    User->>App: "Connect my OnlyFans"
    App->>App: Create state + PKCE verifier
    App-->>User: Redirect to /link/authorize
    User->>Auth: Sign in, link or choose accounts, approve scopes
    Auth-->>User: Redirect to redirect_uri?code&state
    User->>App: GET /callback?code&state
    App->>API: POST /v3/link/token (authorization_code)
    API-->>App: access_token, refresh_token, authorization_id, linked_accounts
    App->>App: Store refresh_token per user, map linked account ids
    App->>API: GET /v3/access/profile (Bearer + x-linked-account-id)
    API->>OF: Signed, proxied request
    OF-->>API: Response
    API-->>App: Typed JSON
    API-->>App: Webhooks: authorization.*, linked_account.*, realtime.*
    App->>API: POST /v3/link/token (refresh_token) when the access token expires
```

1. Your backend builds an authorization URL and sends the user to it in a top-level browser.
2. The user signs in to OFAuth, links or chooses OnlyFans accounts, and approves your scopes.
3. OFAuth redirects to your registered callback with `code` and `state`.
4. Your backend exchanges the code for tokens. The response includes `authorization_id` and the first page of `linked_accounts`.
5. You call `/v3/access/*` with `Authorization: Bearer` and `x-linked-account-id`.
6. Access tokens last 10 minutes. Refresh them with the refresh token when `offline_access` was granted.
7. Webhook destinations deliver lifecycle and Realtime events per environment.

## Access rules

* A token only reaches the linked accounts of its own authorization. There is no API that lists accounts across authorizations.
* The developer dashboard does not list your users' accounts either. It offers a search-by-ID debugger for an authorization or linked account ID you already know.
* The owner can revoke your access at any time, to one account or to the whole authorization.

## Quick start

<Steps>
  <Step title="Create an External Integration">
    In the [dashboard](https://ofauth.com), create your External Integration. Each environment has its own client ID and secret.
  </Step>

  <Step title="Register redirect URIs">
    Add the exact backend callback for each environment. See [redirect URI rules](/v3/authorize#redirect-uri-rules).
  </Step>

  <Step title="Start in Sandbox">
    Use your Sandbox client. Sandbox returns mock data and never touches OnlyFans. See [Environments](/v3/environments).
  </Step>

  <Step title="Implement authorize, callback, and token">
    Follow [Authorize](/v3/authorize) and [Tokens and refresh](/v3/tokens).
  </Step>

  <Step title="Call Access">
    Follow [Linked accounts](/v3/linked-accounts) and [Calling Access](/v3/access).
  </Step>

  <Step title="Add webhooks">
    Configure a destination per environment. See [Webhooks](/v3/webhooks).
  </Step>

  <Step title="Go live">
    Live requires the Developer plan and Live approval of your integration. Request it from the dashboard.
  </Step>
</Steps>

## Pages

<CardGroup cols={2}>
  <Card title="Authorize" icon="right-to-bracket" href="/v3/authorize">
    Authorization request, redirect URI rules, callback handling
  </Card>

  <Card title="Tokens and refresh" icon="key" href="/v3/tokens">
    Token exchange, refresh rotation, revocation, discovery
  </Card>

  <Card title="Linked accounts" icon="plug" href="/v3/linked-accounts">
    List, read, and remove linked accounts, and the x-linked-account-id header
  </Card>

  <Card title="Calling Access" icon="terminal" href="/v3/access">
    Scopes, headers, rate limits, quotas
  </Card>

  <Card title="Webhooks" icon="webhook" href="/v3/webhooks">
    Destinations, envelope, lifecycle and Realtime events
  </Card>

  <Card title="Vault+" icon="database" href="/v3/vault-plus">
    Persistent media cache on V3
  </Card>

  <Card title="Environments" icon="flask" href="/v3/environments">
    Sandbox, Test, and Live
  </Card>

  <Card title="Errors" icon="triangle-exclamation" href="/v3/errors">
    Error envelope, codes, and recovery actions
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.