Back in 2021, OnlyFans started signing their API requests. I came across some like-minded individuals and shared my method for pulling the keys out of their obfuscated code.
A small war broke out. OnlyFans were willing to break their entire site trying to get ahead. They were blocking legitimate requests, adding infinite loops that broke mobile browsers, etc.
I whipped up some automation that could reverse engineer just as fast as they pushed updates. Been running it ever since.
Ultimately, I think OnlyFans settled on the idea of third-parties using their API and them not having a good way to prevent it. All of the major agencies have shifted to tools that rely on it, so they’re cutting off their own revenue streams if they try to stop it now.
At this point the algorithm’s been stable for nearly 5 years. I don’t see a risk in keeping anything private anymore, so I’m releasing our internal data for free.
It’s crazy to me that people pay for this. I’ve had offers from $20k to $50k for a working method.
Want to get started? Check out the docs for the OnlyFans signing endpoint. It’ll be free forever, all you need is to sign up for an account and get an API key.
Fair warning - I’m not going to hold your hand through this. You still need to know what headers you should be sending, and need to implement the signing logic yourself (see the docs for a partial example). If you want something that’s simple and just works, check out our paid services and stay tuned for the full launch.