> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onlyfanskit.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Core concepts

> The core nouns — account, connect attempt, resource and method, API key and scope, and realtime delivery — and how they relate.

Everything in onlyfanskit revolves around one idea: **connect an account once,
then act on it.** These are the nouns you'll use across every surface.

<Steps>
  <Step title="Connect" icon="link">
    A **connect attempt** turns a creator's login into a reusable **account**.
  </Step>

  <Step title="Act" icon="bolt">
    Call any **resource method** on that account — over the SDK or REST.
  </Step>

  <Step title="Listen" icon="satellite-dish">
    Receive activity in **realtime** over SSE, webhooks, or WebSocket.
  </Step>
</Steps>

## Account

A connected OnlyFans creator account. You connect it once on the hosted API —
via [embedded connect](/connect/embed), [email + password](/connect/login), or
[mobile / QR](/connect/mobile) — and from then on reference it by its account
`id`. onlyfanskit stores the session; you never paste browser cookies.

The [REST API](/api-reference/introduction) is how you act on that account.
The TypeScript SDK documents the same methods and types.

## Connect attempt

A connect attempt is the lifecycle of one login. It starts `pending`, may park
on a challenge (a verification code or device approval), and ends
`completed_success` (with an `account_id`) or `completed_failed`. You poll an
attempt until it resolves.

| State                     | Meaning                                             |
| ------------------------- | --------------------------------------------------- |
| `pending`                 | Login is running in the background.                 |
| `awaiting_mobile_session` | Waiting for the creator to approve on their device. |
| `needs_otp`               | SMS code required.                                  |
| `needs_app_otp`           | Authenticator (TOTP) code required.                 |
| `needs_email`             | Email device-verification code required.            |
| `needs_face_otp`          | Selfie / Face ID required.                          |
| `wrong_2fa_code_retry`    | Last code was wrong; resubmit.                      |
| `completed_success`       | Connected — `account_id` is set.                    |
| `completed_failed`        | Could not connect.                                  |

See [Two-factor & challenges](/connect/two-factor).

## Resource & method

The SDK groups the API into **resources** (`users`, `posts`, `messages`,
`earnings`, …) — 38 in total. Each resource has **methods** that map 1:1 to
API calls. The REST API exposes the same surface at
`/v1/accounts/{id}/{resource}/{method}`.

## API key, org & scope

Hosted API calls authenticate with a bearer **API key**. Each key belongs to
an **org** and carries a set of **scopes** that gate what it can do
(`accounts:read`, `sdk:call`, `webhooks:write`, …). See
[Scopes](/platform/scopes).

## Realtime delivery

Account activity — messages, subscriptions, tips, posts — can reach you three
ways:

* **Live stream (SSE)** — subscribe over HTTP ([guide](/realtime/server-sent-events)).
* **Webhooks** — receive signed HTTP callbacks ([guide](/realtime/webhooks)).
* **WebSocket** — connect directly from the SDK ([guide](/realtime/websocket)).