> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onlyfanskit.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Handle API keys, connected accounts, and session material safely in production.

Treat OnlyFans session material like passwords. Your integration is only as
safe as how you store credentials, log traffic, and scope API keys.

## API keys

* Issue **separate keys** per environment (development, staging, production).
* Use [scopes](/platform/scopes) so a leaked key cannot do more than its role
  requires.
* Rotate keys on a schedule and immediately after any suspected leak.
* Never embed keys in client-side apps, public repos, or agent prompts.

## Connected accounts

* Store account `id` references server-side; do not expose raw cookies or
  x-bc values to browsers or third parties.
* Prefer [mobile / embed connect](/connect/mobile) when you should not handle
  creator passwords at all.
* Revoke or delete accounts you no longer need via the Accounts API.

## Logging and observability

* Do not log full request or response bodies in production — they contain
  session headers and message content.
* Redact `Authorization`, `Cookie`, and signing headers in debug traces.
* Surface [structured errors](/platform/errors) to operators; avoid dumping
  upstream OnlyFans payloads into user-visible UI.

## Network

* Route OnlyFans traffic through a **stable proxy** per account when using the
  SDK directly. Fingerprint consistency matters more than rotating IPs.
* Terminate TLS at your edge for webhooks; verify webhook signatures before
  processing payloads.

## Compliance

onlyfanskit is unofficial and not affiliated with OnlyFans. You are
responsible for complying with OnlyFans' terms, privacy obligations, and
applicable law in your jurisdiction.