Current signing parameters required for OnlyFans API authentication
Most integrations don’t need Dynamic Rules. If you’re using the Access API or TypeScript SDK, request signing is handled automatically. Only read this guide if you’re making direct requests to OnlyFans APIs.
The Dynamic Rules API (/v2/dynamic-rules) provides the current signing parameters required to generate valid signatures for OnlyFans API requests. OnlyFans requires cryptographically signed requests and changes their signing requirements very frequently - sometimes multiple times per day.
Direct API calls require vigilance. OnlyFans rotates signing requirements
frequently—hardcoded values stop working within hours, leading to 401/403
errors. Because dynamic rules depend on OnlyFans behaviour, plan for sudden
changes and have fallbacks (circuit breakers, retries, status messaging) ready
for temporary outages.
Direct OnlyFans API Integration: Making requests directly to onlyfans.com APIs
Custom Proxy Solutions: Building your own request proxy system
Advanced Use Cases: Specific requirements that can’t use OFAuth’s Access API
Update Detection: Set up webhooks for proactive notifications, or watch for 400 “Please refresh the page” errors when making direct OnlyFans API requests.
Access to dynamic rules is available in two forms:
Current Rules (Paid): Real-time signing payloads delivered via API and webhooks. This is the
add-on sold with OFAuth and includes 24/7 monitoring and SLA-backed uptime.
Do NOT poll for rules updates. Only fetch new rules when you receive a 400 “Please refresh the page” error from OnlyFans APIs, or when you receive a webhook notification. Polling wastes resources and is not the intended usage pattern.
There are two proper ways to detect when rules need updating:
Error-Driven (Reactive): Monitor for 400 “Please refresh the page” errors from OnlyFans APIs
Webhook-Driven (Proactive): Set up a webhook endpoint to receive rules updates with the new rules included in the payload
Copy
class RequestSigner { constructor(rulesManager) { this.rulesManager = rulesManager } async makeSignedRequest(endpoint, userId = null, options = {}) { try { const signedData = await this.signRequest(endpoint, userId) const headers = { ...signedData.signed, "user-agent": "Mozilla ...", accept: "application/json", ...options.headers } const response = await fetch(`https://onlyfans.com${endpoint}`, { ...options, headers }) // ONLY refresh rules on 400 error from OnlyFans if (response.status === 400) { const body = await response.json() if (body?.error?.code === 401 && body?.error?.message?.includes("Please refresh the page")) { console.log("Rules outdated, fetching new rules...") await this.rulesManager.fetchRules() // Retry the request with new rules return this.makeSignedRequest(endpoint, userId, options) } } return response } catch (error) { console.error("Request failed:", error) throw error } }}
No API Call Required: The webhook includes the complete rules object in the payload, so you don’t need to make a separate API request to /v2/dynamic-rules when you receive the webhook.
When making requests to OnlyFans APIs with signed headers, you may receive:
Copy
HTTP 400 Bad Request{ "error": { "code": 401, "message": "Please refresh the page" }}
Solution: This indicates your rules are outdated. Fetch new rules and retry the request.
Copy
// Check OnlyFans API responses for this signalif (response.status === 400) { const body = await response.json() if (body?.error?.code === 401 && body?.error?.message?.includes("Please refresh the page")) { await rulesManager.fetchRules() // Retry your request with new rules }}
This is one of two proper ways to detect rules updates. The other is setting up a webhook endpoint to receive proactive notifications.
Insufficient Access (403)
Copy
{ "error": "You don't have access to the latest rules, please upgrade your plan.", "is_current": true, "is_public": false, "is_early_access": true}
Solution: Upgrade your subscription plan to access the latest rules tier.
Rules Not Current (503)
Copy
{ "error": "The rules are not up to date. Please try again later, or contact '[email protected]' if this issue persists.", "is_current": false, "is_public": true, "is_early_access": false,}
Solution: Wait 30-60 seconds and retry. This typically happens during OnlyFans maintenance windows.
Invalid Method (405)
Copy
{ "error": "Invalid method"}
Solution: Ensure you’re using the correct HTTP method for each endpoint (GET for /, POST for /sign, GET for /status).