Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.onlyfanskit.dev/llms.txt

Use this file to discover all available pages before exploring further.

Every API key carries a set of scopes. A key can only ever be minted with a subset of the scopes its creator holds, so you can build least-privilege keys for automations.

​
Runtime scopes

ScopeGrants
accounts:readList and fetch your own connected accounts.
accounts:writeConnect and disconnect accounts.
sdk:callInvoke any SDK method against an owned account.
webhooks:readRead webhook configuration.
webhooks:writeSet, delete, and test webhooks.

​
Self-service scopes

ScopeGrants
me:readRead your org and list your keys.
me:writeUpdate org contact info, mint and revoke keys.
usage:readRead usage counters and rate-limit windows.

​
Default set

Customer keys without an explicit scope list get the everyday set: 
accounts:read  accounts:write  sdk:call
webhooks:read  webhooks:write
me:read        me:write        usage:read
Mint a narrower key by passing scopes when creating it: 
curl -X POST https://api.onlyfanskit.dev/v1/me/keys \
  -H "Authorization: Bearer $OFK_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "label": "read-only metrics", "scopes": ["accounts:read", "sdk:call", "usage:read"] }'
Admin scopes (admin:*) are only ever granted on internal tokens, never on customer keys.

​
Checking your scopes

GET /v1/me returns the scopes on the calling key. A call that needs a scope you don’t hold returns 403 with a problem body naming the missing scope.