Add an OnlyFans or Fansly account once and Fanduit stores the session encrypted, pins a proxy to it, and keeps the request signature fresh. Your code just sends an API key.
# connect once, then call with a bearer key curl https://api.fanduit.co/v1/connected-accounts/onlyfans \ -H "Authorization: Bearer sk_live_…" \ -d '{ "sess": "…", "x_bc": "…", "user_id": "777" }' → 201 Created ● connected { "status": "active" }
You bring a session. Fanduit keeps it working.
Connected-account credentials are encrypted at rest, scoped per tenant, and never written to logs.
Your app authenticates with a bearer key that scopes to your account and every creator you connect.
OnlyFans rotates its request signature. Fanduit re-derives it automatically so calls keep working.
A sticky IP is pinned per creator to keep the session coherent and the account safe.
Disconnecting an account deletes its stored credentials.
A webhook fires when an account needs re-authentication, so you catch expiry before it breaks a flow.
One call, then you are live.
Generate a key in the dashboard.
Send the session for an OnlyFans or Fansly account you operate.
Every endpoint now works against that account, signed and proxied.
The first step for everything else.
Connect every creator you manage and drive them all from one key.
Fanduit holds the encrypted session so your app never stores raw platform credentials.
Signing and proxy upkeep are handled, so sessions stay valid longer.
Get a webhook when an account needs re-auth and fix it before it fails.
Run a whole roster from one API — connect every creator you operate and automate messaging, growth, and reporting at scale.
Neutral infrastructure on accounts you own, with encrypted credentials, per-account proxies, and no screen sharing.
Clean REST + MCP, signed webhooks, idempotency, and transparent credit metering. Build tools that don\'t break by morning.
You supply the session for an account you own or operate. Fanduit stores it encrypted and manages signing and proxying from there.
They are encrypted at rest, scoped per tenant, and never logged. Disconnecting deletes them.
The account status flips to needs-reauth and a webhook fires so you can reconnect it.
One call, and the whole API works against it.