The REST API authenticates with a bearer API key.
Create and manage keys in the dashboard,
or mint additional keys programmatically:
The plaintext key is shown once, on creation. Store it securely. A key
can never be issued with more scopes than the caller that mints it.
Identity
GET /v1/me returns who you are — your org, plan, scopes, and resolved
limits. Use it to confirm a key works and to discover what it can do.
Scopes
Every key carries a set of scopes. The everyday set
(accounts:read, accounts:write, sdk:call, webhooks:read,
webhooks:write, me:read, me:write, usage:read) is granted by default;
mint narrower keys for least-privilege automations. Full list in
Scopes.
Connecting vs. calling
Two distinct steps on the hosted platform:
- Connect an OnlyFans account once — onlyfanskit captures and stores the
session on our infrastructure. See Connect an account.
- Call methods or stream events against that account using your API
key and the account
id.
You do not ship session cookies or host your own login pages.
TypeScript SDK
The SDK documents method signatures and types. Execute calls through the REST
API unless you run on onlyfanskit internal infrastructure. See
TypeScript SDK and Connecting the client. 
