Two-factor & challenges

When an account has two-factor enabled — or OnlyFans raises a device-trust gate for an unfamiliar login — the attempt parks on a challenge state and next_actions tells you what to send.

Two-factor channels

OnlyFans offers three two-factor channels:

Poll `state`	Channel	How to resolve	Status
`needs_otp`	SMS code	`PUT /v1/connect/login/{id}` `{ "code": "123456" }`	Supported
`needs_app_otp`	Authenticator app (TOTP)	`PUT /v1/connect/login/{id}` `{ "code": "123456" }`	Supported
`needs_face_otp`	Selfie / Face ID	Open `face_verification_url`, then `PUT … { "selfie_verification_completed": true }`	Upcoming

curl -X PUT https://api.onlyfanskit.dev/v1/connect/login/$ATTEMPT_ID \
  -H "Authorization: Bearer $OFK_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "code": "123456" }'

A wrong code parks the attempt on wrong_2fa_code_retry so the creator can try again. The poll includes otp_channel and (for email) email_mask to drive your UI.

Email device verification

Separately from 2FA, OnlyFans may require a one-time email verification code to establish device trust for an unfamiliar login context (new device/region) or before sensitive actions. This is not a channel you configure — it’s a gate the API raises. When it triggers, the attempt parks on needs_email:

Trigger the email

curl -X POST \
  https://api.onlyfanskit.dev/v1/connect/login/$ATTEMPT_ID/send-email-to-creator \
  -H "Authorization: Bearer $OFK_KEY"

Submit the code

curl -X PUT https://api.onlyfanskit.dev/v1/connect/login/$ATTEMPT_ID \
  -H "Authorization: Bearer $OFK_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "code": "123456" }'

Reauthentication

If an account was connected with remember_credentials: true, you can re-acquire a fresh session from the stored credentials without a full login:

curl -X POST https://api.onlyfanskit.dev/v1/accounts/$ACCOUNT_ID/reauthenticate \
  -H "Authorization: Bearer $OFK_KEY"

This returns an attempt. It completes in one trip when no 2FA is required, or parks on needs_app_otp so you can submit a code via the same PUT. Without stored credentials you get 412 and must re-link.

Overview

Guides

Two-factor & challenges

Two-factor channels

Email device verification

Reauthentication

​Two-factor channels

​Email device verification

​Reauthentication

Two-factor channels

Email device verification

Reauthentication