Overview
The OFAuth API implements a sophisticated token bucket rate limiting system
designed to ensure fair usage while allowing burst capacity for real-time
applications. This system protects against abuse while providing flexibility for
legitimate use cases.
Rate Limits by Plan
Rate limits vary based on your subscription plan:
Access API (per connection):
| Plan | Rate Limit | Burst Capacity |
|---|
| Pay as You Go | 60 req/min | 90 requests |
| Starter | 60 req/min | 90 requests |
| Launch | No limit* | No limit* |
| API Category | Default Limit | Burst Capacity |
|---|
| Dynamic Rules | 1 req/min | 3 requests |
| Sign | 10 req/min | 20 requests |
| Link | No limit | - |
| Account | No limit | - |
*Launch plan has no OFAuth rate limits but is still subject to OnlyFans’ native
rate limiting. OFAuth does not bypass OnlyFans’ rate limits.
Managing Rate Limits
OFAuth uses a token bucket system. Tokens replenish continuously, allowing short bursts as long as the bucket has capacity. When the bucket empties, the API responds with 429 Too Many Requests until enough tokens regenerate. Access limits apply per connection ID, while other APIs are scoped to the organization level.
Best Practices
- Space out non-critical requests to avoid draining the burst bucket.
- Implement exponential backoff with jitter whenever the API returns
429 responses.
- Track the
X-RateLimit-* response headers so you can alert before reaching zero remaining tokens.
- Cache results and batch fetches where possible to reduce duplicate calls.
- Distribute traffic across multiple connections if your use case supports parallelism.
Monitoring Tips
- Watch the
X-RateLimit-Reset header to know when full capacity returns.
- Surface rate-limit telemetry alongside your application health dashboards.
- Set alerts when remaining tokens fall below 20% of the current window.
Reduce Calls with Caching
Cache frequently read data and prefer incremental updates over full refreshes. During upstream incidents, extend cache TTLs and serve degraded-but-available experiences while OFAuth restores access.
Custom Rate Limits
Enterprise customers can request custom rate limits based on their use case.
Contact support with:
- Expected request volume
- Usage patterns (bursts vs steady)
- Business requirements
- Current plan details
Next Steps
