OnlyFans Automation API — Mass DMs, Events & Webhooks for Agencies

DEFINITION

What is OnlyFans automation?

OnlyFans automation is the practice of using software to perform repetitive creator-account work — sending welcome DMs, blasting PPV campaigns, tagging fans by spend, replying to tips, and exporting earnings — without a human having to log in and click through the OnlyFans web app for each action. In an agency context, it is what makes managing 50, 100, or 500 accounts financially viable: one chatter operates a roster of creators while the automation layer handles the predictable work in the background. The same model applies to Fansly, which The Only API supports through the same normalized interface.

In practice, OnlyFans automation runs through an OnlyFans API that wraps the same endpoints the official site uses, signed with realistic browser headers and routed through per-account proxies so the platform sees ordinary, human-paced traffic. On top of that API sits a rules engine that listens for events (a new subscriber, a tip, a renewal, a lapse) and dispatches actions (send a DM, tag a fan, fire a webhook, post to Discord). That is what an OnlyFans automation API delivers — and it is what this page covers in detail.

Done well, automation is invisible to the fan and transformative for the operator. Done badly, it gets accounts banned. The difference is engineering. The Only API was built by agency operators specifically to make the first outcome the default and the second outcome impossible-by-default.

Example: create an automation

curl -X POST https://theonlyapi.com/api/crm/$CRM_ID/automations \
  -H "X-API-Key: $OF_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Welcome new VIPs",
    "trigger_event": "new_subscriber",
    "conditions": [
      { "field": "payload.amount", "op": "gt", "value": 25 }
    ],
    "action_type": "send_dm",
    "action_params": {
      "message": "Hey {payload.fan.username} — thanks for subscribing!",
      "to_fan_id": "{payload.fan.id}"
    }
  }'

That single POST creates a persisted rule. Every time a fan subscribes for more than $25, they receive a templated welcome DM. Template tokens are dot-paths into the event, so {payload.fan.username} and {payload.fan.id} resolve at dispatch time. The account must have allow_of_write_actions enabled, or the run is logged as failed.

You do not have to use automations to consume events. GET /api/crm/{crm_id}/events returns the persisted event log, filterable by types, of_user_id, since, until, and limit — the backfill path. GET /api/crm/{crm_id}/events/stream is a Server-Sent Events feed with optional ?types= server-side filtering — the live path. To debug a rule that is not firing, read GET /api/crm/{crm_id}/automations/{id}/runs.

SAFETY & RATE LIMITS

Responsible automation, by default

OnlyFans is a real platform with real rate limits and real terms of service. Any provider promising a "ban-proof" or "undetectable" automation is selling a fantasy. What an honest OnlyFans automation API can deliver is engineering that minimises risk: conservative polling defaults, browser-grade header signing, isolated per-account sessions, optional residential proxies, and exponential back-off on every retry.

Polling runs on a per-account interval you control. It defaults to 120 seconds and is configurable between 60 and 3,600 seconds, so you can dial an active account tighter and let idle ones idle. We sign requests with the same Chrome 136 fingerprint a logged-in browser uses, and every account gets its own isolated session, stored per-account under saved_sessions/. We have not seen an account banned as a direct consequence of using the API. We will not promise that record holds forever — what we will promise is that we treat the upstream platform with respect, and we ship fixes within hours when something changes.

Writes are opt-in per account: DM automations and mass sends alike require allow_of_write_actions=1, which is off by default. Mass DM defaults to dry_run and caps a single call at 5,000 recipients. New webhook endpoints on non-allowlisted domains land in a pending state until an admin approves the domain, so a misconfigured URL cannot quietly leak events. Webhook deliveries retry on a [5s, 30s, 5m, 30m, 2h] back-off and auto-deactivate after sustained failure. If you want to push beyond the defaults, you can — but the defaults are deliberately conservative because the cost of a banned creator account is always higher than the value of an extra DM per minute.

Looking for a deeper dive? Our companion guide to OnlyFans auto DM walks through mass-message audiences, PPV blasts, and welcome flows step by step. If you are evaluating alternatives, the Only API vs Infloww comparison breaks down endpoint coverage, per-seat versus per-account pricing, and which workflows each platform actually handles end to end.