How do I cut access off?

Rotate your API key from /dashboard/api-keys. The backend pushes an invalidation to the MCP server, so the old key stops resolving within seconds instead of waiting out a cache window, and any in-flight session is rejected at its next tool call. Turning off the per-account write flag is the narrower option if you want to keep reads working but stop anything from being sent.

INTEGRATIONS · MCP SERVER

Give your AI assistant the keys to your CRM — one URL, 59 tools.

The Only API ships a native MCP server. Point Claude, ChatGPT, Grok, Manus, Cursor — or anything else that speaks the protocol — at a single URL, and it can read earnings, fans, subscribers, transactions and the inbox across every connected OnlyFans and Fansly account, then act on what it finds.

It is a real connection to real data, so we are specific about what it can do: 38 read-only tools, 12 writes that each need an explicit confirmation, and a per-account switch the model cannot flip. Read the access controls before you turn writes on.

Open the MCP page Setup in 4 steps

Connection URL

Streamable HTTP

https://theonlyapi.com/mcp

Tools: 59 across 17 domains
Split: 38 read · 12 confirmed writes · 2 escape hatches
Auth: OAuth 2.1 or API-key bearer
Platforms: OnlyFans + Fansly

THE ARGUMENT

Why it is worth connecting an assistant to this

Not because AI is interesting. Because the questions that actually decide your week — which creator slipped, which whale went quiet, what did last night cost me — are spread across accounts, and answering them by hand is the thing that never gets done. Every claim below maps to a tool that exists in the server.

One question, every account

A panel with twelve creators means twelve dashboards and twelve mental context switches. Over MCP you ask once. of_get_earnings_summary aggregates across every connected account in a single call, and of_list_fans with dedupe_by_fan=true collapses the same person appearing under four creators into one row with summed spend.

Find the fan who went quiet

of_list_fans returns total_spend and last_event_at per fan, sorted by spend. "Who spent over $500 and hasn't touched the account in two weeks" is one tool call and a filter — not an export, a spreadsheet and an afternoon. The model then drafts the message and shows it to you before anything is sent.

The end-of-day summary writes itself

Earnings by category, new subscribers versus renewals, the unread chat backlog and the top spenders are four tools the model chains on its own. Ask for it as a Slack message, a table or a CSV — the shaping happens in the chat, so you are not waiting on a report someone has to build first.

Which creator needs you today

of_get_earnings_summary returns prev_total_to_date — the previous period measured to the same elapsed point — so "am I up or down" is answerable instead of guessable. Loop it per account and the answer to "who slipped this week" arrives before you have opened a single dashboard.

Ops work you can describe instead of click

Webhooks and automations are full CRUD over MCP. "Post every tip over $50 to Discord" becomes a created rule you can inspect, test with of_test_webhook, and audit afterwards with of_list_automation_runs — including the errors.

Nothing is wrapped? Ask anyway

of_crm_request reaches any CRM endpoint that has no dedicated tool yet, and of_proxy_request reads the raw OnlyFans /api2/v2 surface for a connected account. The catalogue is a convenience layer, not a ceiling.

IN PRACTICE

Six things you would actually ask

Each one is a prompt you can paste, with the tools it resolves to underneath. The model chooses the chain itself — this is only here so you can see there is no hand-waving behind it.

Monday morning

“Across every connected account, what did I make last week versus the week before, and which creator dropped the most?”

of_list_accounts → of_get_earnings_summary (period + prev_total_to_date) per account. Live call, so it counts against your monthly quota — the model is told to check of_get_usage first on long loops.

Retention

“Find fans who have spent over $200 but haven't been active in 14 days. Draft a re-engagement DM for each. Don't send anything yet.”

of_list_fans(sort='spend', with_total=true) reads from the local cache — zero OF calls — and carries last_event_at per fan. Drafting costs nothing. Sending is a separate, confirmed step.

Inbox triage

“Show me the unanswered chats across all my accounts, oldest first.”

of_list_chats(order='unread') per account returns unread_count, last_message_at and the last message body. Fan text arrives fenced in <UNTRUSTED> markers so the model reads it as data.

Accounting

“Export every transaction over $100 from last quarter as a CSV, and tell me what chargebacks cost me.”

of_list_transactions_cached(since=…) reads the cached ledger, filters client-side, and the model serialises the CSV in the chat. No quota burn on the cached path.

Growth

“Which tracking link brought in the most revenue, and who were the top spenders that came through it?”

of_list_campaigns → of_get_campaign_earnings → of_list_campaign_claimers, then cross-referenced against of_list_fans for lifetime spend.

Alerting

“Post every tip over $50 to my Discord, and show me anything that failed to deliver yesterday.”

of_create_webhook (or of_create_automation with a condition on the new_tip event), then of_list_webhook_deliveries for the delivery log and of_list_automation_runs for rule errors.

SUPPORTED CLIENTS

One server, every client

There is no per-client build. The differences below are entirely about how each client wants the URL handed to it, and whether it can run an OAuth flow for you.

Client	How it connects	Auth	Best for
Claude	Connectors UI (web + desktop), or claude mcp add for Claude Code	OAuth 2.1, or bearer API key in a config file	Long analysis sessions and building reports you iterate on
ChatGPT	Custom connector (Business / Enterprise / Edu), desktop MCP config, or the Responses API	OAuth 2.1, or bearer API key	Team workspaces, and calling the tools from code
Grok	console.x.ai → Grok Business → Connectors → Add Connector → Other	Bearer API key, entered when the connector is created	Fast ad-hoc questions and agents running on the xAI side
Manus	Settings → Connectors → Custom MCP → Add Custom MCP, transport HTTP	Bearer API key in the connector headers	Long autonomous runs that end in a deliverable
Cursor	~/.cursor/mcp.json	Bearer API key, or OAuth on the first tool call if you omit the header	Building on top of the REST API without leaving the editor
Anything else	POST the URL directly — Streamable HTTP MCP, JSON-RPC over POST with SSE responses	Bearer API key	Custom agents, scheduled jobs, curl smoke tests

SETUP

Four steps, then ask it something

Nothing to install, no SDK, no separate MCP account. The client-specific detail is in the guides below.

Have a panel with an account connected

The tools are scoped to one CRM panel. If no OnlyFans or Fansly account is connected yet, every account-scoped tool has nothing to talk about. The free plan covers one account and 1,000 API calls a month.

Decide OAuth or bearer

If your client has a Connectors UI, use it and let OAuth 2.1 run — nothing is written to a file. If your client wants a config file, copy your CRM API key from /dashboard/api-keys and send it as Authorization: Bearer.

Paste the URL

One URL for every client: https://theonlyapi.com/mcp. There is no per-client endpoint, no SDK to install, and no separate MCP account to create.

Ask it what your quota is

"What's my plan and remaining API quota?" calls of_whoami and of_get_usage. It is the cheapest possible proof the connection works, and it tells the model how much budget it has before you set it loose on anything bigger.

The server URL

https://theonlyapi.com/mcp

Claude Code, in one line

claude mcp add --transport http theonlyapi https://theonlyapi.com/mcp

PER-CLIENT GUIDES

Pick your assistant

Same URL in every case. What changes is where you paste it and whether the client handles the credential for you.

Claude — web, desktop and Claude Code

OAuth 2.1 or bearer

Claude holds a long thread well, so it suits the work that takes more than one question: pulling a week of earnings apart, walking a fan cohort, drafting twenty different DMs and revising them with you before a single one is sent.

01Web or desktop: Settings → Connectors → Add custom connector.
02Paste https://theonlyapi.com/mcp and approve the OAuth consent screen.
03Claude Code instead: run the command below, then type /mcp in a session to confirm the tools loaded.
04The connector then appears in the tools menu of any chat.

Claude Code

claude mcp add --transport http theonlyapi https://theonlyapi.com/mcp

--transport http is required. Without it the CLI defaults to stdio and tries to execute the URL as a local command.

ChatGPT

OAuth 2.1 or bearer

Best when the panel is shared with a team on a Business or Enterprise workspace, or when you want the tools available from code — the Responses API accepts this server as a remote MCP tool source with no wrapper.

01Settings → Connectors → Add custom connector, then paste the URL.
02Custom connectors are gated to Business, Enterprise and Edu plans — on Plus or Free, use the desktop app's MCP config or the API instead.
03In code, pass the server to the Responses API as shown below.

OpenAI Responses API

tools=[{
  "type": "mcp",
  "server_url": "https://theonlyapi.com/mcp",
  "server_label": "the-only-api",
  "authorization": "Bearer YOUR_API_KEY"
}]

There is a dedicated ChatGPT walkthrough with all three paths on the ChatGPT integration page. Read the ChatGPT guide →

Grok

Bearer

Grok is the fastest route to a one-off answer — quota check, today's earnings, who tipped the most this week — without opening a dashboard or a chat you intend to keep.

01Go to console.x.ai, select your team, and open Grok Business → Connectors.
02Click Add Connector and choose Other (the custom MCP option).
03Enter https://theonlyapi.com/mcp as the server URL and complete authentication with your CRM API key.
04Adding connectors needs Team Read-Write permission on the xAI team.

The xAI API exposes the same thing as a remote MCP tool — pass the server URL and an Authorization bearer alongside your other tools.

Manus

Bearer

Manus runs long and unattended, which fits the jobs nobody wants to babysit: a quarterly transaction export, a full re-engagement list built creator by creator, a weekly briefing assembled while you are asleep.

01Open Settings → Connectors → Custom MCP → Add Custom MCP.
02Choose Direct Configuration, name the server, and set Transport Type to HTTP.
03Enter https://theonlyapi.com/mcp as the server URL and add Authorization: Bearer YOUR_API_KEY as a header.
04Importing the JSON config below does the same thing in one paste.

JSON config

{
  "mcpServers": {
    "the-only-api": {
      "url": "https://theonlyapi.com/mcp",
      "type": "http",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Manus executes in its own cloud, so the server has to be reachable on the public internet — which theonlyapi.com is.

Cursor

Bearer or OAuth

For anyone building against the REST API: the tools answer schema questions with live data from your own panel, so you can check what an endpoint really returns before you write the client code.

01Open ~/.cursor/mcp.json (create it if missing), or Settings → Cursor Settings → MCP.
02Paste the block below and restart Cursor.
03Drop the headers object entirely if you would rather run OAuth — it triggers on the first tool call.

~/.cursor/mcp.json

{
  "mcpServers": {
    "the-only-api": {
      "url": "https://theonlyapi.com/mcp",
      "type": "http",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Everything else

The endpoint is standard Streamable HTTP MCP — JSON-RPC over POST, server-initiated SSE on GET, DELETE to end a session. Any client or agent framework that implements the transport can connect with an Authorization: Bearer header and no further setup. If a client supports OAuth discovery, it will find our authorization server from the 401 challenge and the protected-resource metadata document; there is nothing to configure by hand.

TOOL CATALOGUE

59 tools, grouped by what you are trying to do

17 domains, folded into seven jobs. You never call these by name — the model picks and chains them from your question. The names are here so you can see exactly how far the connection reaches.

Money

12 tools

Earnings net of fees, the transaction ledger, payouts, and PPV conversion. Cached transaction reads cost nothing against your quota.

Earnings & payouts · 6

of_get_earnings_summary, of_get_earnings_chart, of_get_balances, of_get_payout_account, of_list_payout_requests, of_create_payout_request

Transactions · 5

of_list_transactions_cached, of_list_purchases, of_refresh_transactions, of_get_refresh_status, of_list_active_refreshes

PPV analytics · 1

of_get_ppv_stats

People

8 tools

Lifetime spend, tags, activity recency and the subscriber book — including cross-creator dedup so one person counts once.

Fans · 5

of_list_fans, of_list_fan_transactions, of_refresh_fan_profile, of_add_fan_tag, of_remove_fan_tag

Subscribers · 3

of_list_subscribers, of_list_subscribers_cached, of_refresh_subscribers

Conversations

3 tools

Read the inbox, read one thread, send one text DM. Sending is gated twice — see the access controls below.

Inbox & DMs · 3

of_list_chats, of_list_messages, of_send_message

Growth

5 tools

Tracking-link campaigns: create them, see who claimed them, and attribute revenue back to the source.

Campaigns · 5

of_list_campaigns, of_create_campaign, of_list_campaign_claimers, of_get_campaign_earnings, of_refresh_campaigns

Operations

25 tools

Everything that keeps the panel running: connecting accounts, polling and proxies, automation rules and outbound webhooks, with full run and delivery history.

Accounts · 7

of_list_accounts, of_get_polling, of_set_polling, of_get_proxy, of_set_proxy, of_set_subscription_price, of_delete_account

Automations · 7

of_list_automations, of_get_automation, of_create_automation, of_update_automation, of_delete_automation, of_run_automation_now, of_list_automation_runs

Webhooks · 7

of_list_webhooks, of_get_webhook, of_create_webhook, of_update_webhook, of_delete_webhook, of_test_webhook, of_list_webhook_deliveries

of_login_account, of_login_with_cookies, of_verify_login_otp

Integrations · 1

of_list_telegram_groups

Awareness

4 tools

Who am I, what is left of my quota, what has happened lately. The model is instructed to check usage before any expensive loop.

Identity · 1

of_whoami

Usage & quota · 1

of_get_usage

Events · 1

of_list_events

Notifications · 1

of_list_notifications

Escape hatches

2 tools

For anything the catalogue has not wrapped yet. of_crm_request reaches any CRM endpoint under your panel; of_proxy_request reaches the raw OnlyFans /api2/v2 surface for one account.

Escape hatches · 2

of_crm_request, of_proxy_request

ACCESS CONTROL

It can take real actions. Here is what stops it.

Handing an assistant a connection to your creators' messages and your fans' spending history is a real decision, so we would rather describe the mechanisms than reassure you. Each of these is enforced in code, not policy.

Two auth schemes, side by side

A bearer that looks like a JWT is verified as an OAuth 2.1 access token: signature against our JWKS, issuer, audience and the of:read scope all checked, and access tokens are short-lived. Anything else is treated as a CRM API key and resolved through the backend's whoami endpoint. Either way the session is pinned to exactly one CRM panel.

Writes need an explicit confirm

The 12 write tools take confirm=false first and return a dry-run showing what would happen — the recipient and the exact message text for a DM, the call that would be made for an escape-hatch mutation. Only a second call with confirm=true performs it.

A second gate the AI cannot open

Underneath confirm, the backend enforces a per-account allow_of_write_actions flag that is off by default. Until you turn it on for that specific account in the dashboard, DMs and other OnlyFans writes are refused no matter what any model or prompt asks for.

Raw proxy writes are off by default

of_proxy_request will happily GET the OnlyFans API. Non-GET methods through it require both confirm=true and a per-panel mcp_unsafe_proxy flag that ships disabled — you enable it deliberately on the dashboard MCP page or it stays shut.

Fan text is fenced as data

Usernames, display names, bios and message bodies come back wrapped in <UNTRUSTED> markers, unicode-normalised and stripped of control characters, with the model instructed never to follow instructions found inside them. A fan cannot talk your assistant into anything by typing at it.

Quota and burst limits apply

The same monthly API quota as the REST API, plus per-panel token buckets on the expensive tools — sends, refreshes, PPV stats, payout requests and escape-hatch calls each have their own ceiling. A runaway prompt hits a limit long before it hits your budget.

Sessions are bound to their bearer

An MCP session id presented with a different bearer is rejected and the session destroyed. Rotating your API key from the dashboard pushes an invalidation to the MCP server, so a leaked key stops working within seconds rather than at the end of a cache window.

What is deliberately not exposed

No mass-DM tool. of_send_message sends one text message to one fan — there is no recipient list, no price, no media attachment and no schedule parameter.
No media upload and no vault access. Content stays out of the MCP surface entirely.
No message scheduling. Recurring sends belong in automations, which you can create over MCP and then inspect.
No cross-tenant reach. A session resolves to exactly one CRM panel and every path is built from that panel's id — there is no tool that can see another customer's data.
Connecting a Fansly account is REST-API-only today. Once connected, Fansly data surfaces through the same normalized read tools as OnlyFans.

In the dashboard

/dashboard/mcp →

Copy-paste configs with your real key filled in, a connection tester, the write-proxy toggle, and the full prompt library.

ChatGPT specifics

/integrations/chatgpt →

All three ChatGPT paths — custom connector, desktop config and the Responses API — in one place.

Pricing

/pricing →

MCP is not a separate product or a separate bill. Same plans, same quota as the REST API.

FAQ

Before you connect it

The questions worth asking about handing an assistant live access to a creator business — answered with the limits left in.

MCP — the Model Context Protocol — is a standard way for an AI assistant to call tools on a server you own. Instead of copying numbers out of a dashboard and pasting them into a chat, you point the assistant at one URL and it can fetch your earnings, your fans, your subscribers and your inbox itself. The Only API runs an MCP server at https://theonlyapi.com/mcp. You do not install anything, and there is no separate account to create — your existing CRM panel is the account.

59 tools across 17 domains: accounts, login, fans, subscribers, inbox, earnings and payouts, transactions, campaigns, automations, webhooks, events, notifications, PPV analytics, Telegram integrations, identity, usage, and two escape hatches. 38 are read-only, 12 are writes that require an explicit confirmation, and 2 are the escape hatches that reach endpoints the catalogue has not wrapped yet. That count is taken from the server source, not from a brochure.

It can send a direct message and it can submit a payout request — so yes, be deliberate about it. Three things stand in the way. Every write tool returns a dry-run preview first and only acts when it is called again with confirm=true. The backend enforces a per-account allow_of_write_actions flag that is off by default, so OnlyFans writes are refused until you enable them for that specific account. And there is no mass-send tool at all: one message, one fan, one confirmation, each time. If you never enable the per-account write flag, the connection is effectively read-only.

Claude on web, desktop and in Claude Code; ChatGPT through a custom connector, the desktop app's MCP config, or the Responses API; Grok through a custom connector in the xAI console; Manus through Settings → Connectors → Custom MCP; and Cursor through ~/.cursor/mcp.json. Beyond those, any client that speaks Streamable HTTP MCP can connect to the same URL with a bearer token — including your own agents, scheduled jobs and curl.

Either works, and both are accepted at the same time. Clients with a Connectors UI usually run OAuth 2.1 with PKCE and dynamic client registration, which means no credential ever sits in a config file. Clients that read a JSON config send your CRM API key as an Authorization: Bearer header instead. The server checks whether the bearer looks like a JWT and routes it to the right verifier — you do not have to configure which scheme you are using.

Only the calls that actually reach OnlyFans or Fansly do. Anything served from the local cache — cached transactions, cached subscribers, the fan list, the event stream, automation and webhook records — costs nothing. Live calls such as earnings summaries, balances, live subscriber lists, chats and PPV stats count against the same monthly quota as the REST API. The model is instructed to call of_get_usage before long loops, so you can just ask it what is left.

That is the exact attack MCP servers have to defend against, and it is handled at the shaping layer rather than left to the model's judgement. Every piece of fan-controlled text — usernames, display names, bios, message bodies, campaign names — is unicode-normalised, stripped of control and ANSI characters, truncated, and wrapped in <UNTRUSTED> markers before the model ever sees it, with a standing instruction to treat anything inside those markers as data and never as instructions.

Stop clicking through dashboards

Connect Claude, ChatGPT, Grok, Manus or Cursor to your panel and ask the question instead. Free plan included — one account, 1,000 calls a month, the same 59 tools.

Start free▶

Open the MCP page