> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onlyfanskit.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Set the webhook config

> Register or replace the webhook destination for an account. The returned `signingSecret` is used to verify the `X-Webhook-Signature` HMAC on delivered events — store it on write. Requires `webhooks:write`.



## OpenAPI

````yaml /api-reference/openapi.json put /v1/accounts/{id}/webhook
openapi: 3.1.0
info:
  title: onlyfanskit REST API
  description: >-
    Connect OnlyFans accounts and act on them over HTTP. Authenticate with a
    bearer API key, connect a creator account once, then call any method or
    stream realtime events. Not affiliated with OnlyFans or Fenix International
    Limited.
  version: 1.0.0
servers:
  - url: https://api.onlyfanskit.dev
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Account
    description: Identity, keys, and usage for the calling org.
  - name: Connect
    description: Link OnlyFans accounts via cookie, cURL, email/password, or mobile.
  - name: Accounts
    description: Manage connected accounts.
  - name: SDK
    description: Call any SDK method against a connected account.
  - name: Realtime
    description: Server-Sent Events stream of account activity.
  - name: Webhooks
    description: HTTP callbacks for account events.
paths:
  /v1/accounts/{id}/webhook:
    put:
      tags:
        - Webhooks
      summary: Set the webhook config
      description: >-
        Register or replace the webhook destination for an account. The returned
        `signingSecret` is used to verify the `X-Webhook-Signature` HMAC on
        delivered events — store it on write. Requires `webhooks:write`.
      operationId: setWebhook
      parameters:
        - $ref: '#/components/parameters/AccountId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - url
              properties:
                url:
                  type: string
                  format: uri
                events:
                  type: array
                  items:
                    type: string
                  description: Optional allow-list of event names. Omit to receive all.
                signingSecret:
                  type: string
                  minLength: 16
                  description: Optional. A secret is generated if omitted.
      responses:
        '200':
          description: Webhook saved (secret included)
          content:
            application/json:
              schema:
                type: object
                properties:
                  webhook:
                    $ref: '#/components/schemas/WebhookWithSecret'
components:
  parameters:
    AccountId:
      name: id
      in: path
      required: true
      schema:
        type: string
      description: Connected account id.
  schemas:
    WebhookWithSecret:
      type: object
      properties:
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            type: string
          nullable: true
        signingSecret:
          type: string
          description: >-
            HMAC-SHA256 secret for verifying `X-Webhook-Signature`. Shown on
            write only.
        createdAt:
          type: string
        updatedAt:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Your API key, sent as `Authorization: Bearer <key>`.'

````