OPEN SOURCE · AGPL-3.0
Open-source
OnlyFans API
for OFM.
Self-host the OnlyFans and Fansly CRM and REST API on your own server, under AGPL-3.0. Your data stays yours: own the stack, own the keys, and run creator operations, secure automation and the full API your way — on our cloud or on your own hardware.
- 01Clone repoOne command
- 02Host itAny Docker box
- 03Add proxy+ captcha key
- 04ConnectOF + Fansly
Versioned source snapshot · main at 25c353f · Docker required · not a desktop installer. A signed Windows app is planned and will only be published through the repository's Releases page.
Open source. Real freedom. Built for creators. AGPL-3.0, and not affiliated with, endorsed by, or connected to OnlyFans or Fenix International Limited.
WHY IT MATTERS
Benefits of open source.
The code is free. What you pay for is us running it.
You can read the code
A privacy page is a promise. Code is proof.
Every line that touches a creator login or a fan message is open. Nothing phones home — and you can check that yourself.
Your data stays yours
It sits on your server, in your country, under your rules.
Free to use. Free to leave. The licence cannot be taken back, and there are no limits in the build to raise later.
Customise it to your needs
Add an endpoint, change how often it polls, bolt on your own automations.
You are not filing a feature request and hoping — you are editing the source. Fixes land in public the same day, free for everyone.
Stop paying others to hold your data
Third-party panels bill you every month to keep your own data on their servers.
At 500 accounts that is $7,500 a month flat, against an indicative $20,000–$30,000 on credit pricing. Run it yourself and it is $0.
Launch with
your AI agent.
- Ready in minutes
- Open source friendly
- Works with any LLM
This downloads instructions for your AI agent, not the app. Prefer to work with the code yourself? Download the source ZIP or open it on GitHub. About 30 minutes of your attention is needed for the guided setup once you have a domain, proxies and a captcha account.
Setup prompt for ChatGPT
Paste this into ChatGPT to connect it to The Only API.
You are an AI coding agent. Install and launch The Only API (open-source, self-hosted OnlyFans/Fansly CRM + REST API) on my own server.
Runbook: https://raw.githubusercontent.com/XcelerateManagement/onlyfans-api-open-source/main/AGENT-LAUNCH.md
Repository: https://github.com/XcelerateManagement/onlyfans-api-open-source
API docs: https://docs.theonlyapi.com
OpenAPI spec: https://theonlyapi.com/api/openapi.json
Fetch the runbook and follow it exactly — do not invent commands.
Interview me first; I am not a developer. Recommend a host and tell me what to buy.
Do not skip the step that closes registration once my owner account exists.ChatGPT
Setup guide for OpenAI's ChatGPT, including the hosted MCP connection for Pro, Business and Enterprise.
Download setup fileClaude
Setup guide for Anthropic's Claude — Desktop, Web, and Claude Code with shell access to do the install.
Download setup fileGemini
Setup guide for Google's Gemini, using the same runbook and the same MCP connection URL.
Download setup fileAny AI
Use with Cursor, Windsurf, Codex, Manus or any LLM that can read a file and run a shell.
Download setup fileWhy we opened it
Not because open source is fashionable. Because the single biggest objection to buying any OnlyFans tooling is a good one, and it has no marketing answer.
Your fans' spend is not our asset
Every rival panel stores your creators' DMs, your fans' lifetime spend, and your entire subscriber book on infrastructure you do not control, under a retention policy you did not write and cannot audit. When you self-host this, those rows live in a SQLite file on your disk. Nobody else has a copy, and there is nothing to subpoena, breach or quietly repurpose.
Verifiable, not promised
A privacy page is a promise. Source code is a fact. You can read exactly which requests leave the process, and you can prove it with a packet capture: the open-source build makes zero outbound calls to theonlyapi.com or xcelerator.agency, carries no telemetry and performs no licence check. An unconfigured install fails loudly rather than defaulting to our production API.
Nobody can switch you off
Vendors get acquired, change pricing, ban adult-industry customers, or shut down. A copy of the repository and your database is an exit plan that does not depend on our goodwill. AGPL-3.0 means that copy stays yours, and stays open, whatever happens to us.
The objection we could not answer any other way
We kept losing serious agencies over one question: what stops you reading our messages? There is no marketing answer to that. Publishing the code is the only honest one — and if you would still rather we ran the boxes, the cloud is the same software with our operations attached.
The carve-out we will not shorten
We are not going to write “no data leaves your server,” because it would not be true. Nothing goes to Xcelerate — no telemetry, no phone-home, no licence check. But two things do leave the box, and they leave it on our cloud too: your captcha provider receives the Turnstile sitekey and page URL for each solve, and all platform traffic egresses through the proxy you supply for that account. Everything else — messages, fans, transactions, sessions — stays on your disk.
INSPECT IT BEFORE YOU RUN IT
How the self-hosted OnlyFans API works
Three containers share one private Compose network. The browser talks to the Next.js panel, the panel and MCP server talk to the Flask API, and only the API owns the persistent data volume. Stored sessions and credentials are encrypted, and platform traffic uses the proxy configured for that account.
Clients
- Browser dashboard
- Claude, ChatGPT or Cursor
- Your REST API client
Private Docker network
One API process by design: it owns polling, rate limits, SSE and webhook retries so jobs cannot run twice.
Operator-controlled
- Persistent SQLite volume
- Encrypted sessions and credentials
- Per-account platform proxy
- Captcha provider on challenge
- HMAC-signed webhook targets
Quick start — self-host it in three steps
Not one command, and we are not going to claim it is. Four independent secrets are mandatory before the process will start; a funded captcha provider is only needed before an OnlyFans credential login. Everything after that is docker compose up.
Clone the repo and create your env file
One repository holds both the Flask API and the Next.js dashboard. The .env.example covers every variable, grouped required / optional / advanced.
git clone https://github.com/XcelerateManagement/onlyfans-api-open-source.git
cd onlyfans-api-open-source
cp .env.example .envGenerate the four mandatory secrets
SECRET_KEY, ENCRYPTION_KEY, NEXTAUTH_SECRET and INTER_SERVICE_TOKEN must be independent random values. ENCRYPTION_KEY encrypts stored platform sessions, so back it up before connecting an account. The panel boots without a captcha key; add a funded provider before an OnlyFans credential login.
# run once for each required name and paste it into .env
python -c "import secrets; print(secrets.token_urlsafe(48))" # SECRET_KEY
python -c "import secrets; print(secrets.token_urlsafe(48))" # ENCRYPTION_KEY
python -c "import secrets; print(secrets.token_urlsafe(48))" # NEXTAUTH_SECRET
python -c "import secrets; print(secrets.token_urlsafe(48))" # INTER_SERVICE_TOKENBring the stack up and claim the owner account
Python and Node ship in the same image — the request signer is a Node subprocess, so they cannot be split. Open the dashboard, complete the first-run screen to create the owner account, then connect an OnlyFans or Fansly account with its own proxy.
docker compose up -d
# API → http://localhost:5000
# Panel → http://localhost:3000 (first run creates your owner account)Full variable reference in .env.example, the canonical stack definition in docker-compose.yml, and the longer walkthrough in the self-hosting guide. On a bare VPS, install.sh installs Docker, generates the four secrets, writes .env, brings the stack up and fronts it with Caddy for automatic TLS. Add a captcha key before the first OnlyFans credential login.
Deploy it anywhere that runs Docker
Five requirements drive every recommendation below: one long-running process that never sleeps, a persistent disk for the SQLite database, Python and Node in the same container, long-lived HTTP for the SSE stream, and a request tolerance measured in minutes for logins that wait on a captcha or an OTP.
Anything that satisfies those five will run it. Most of the fashionable places to deploy a Next.js app satisfy none of them — see the list further down, it will save you an evening.
Tier 1 — a plain VPS
RecommendedThe best privacy story and the lowest risk of being deplatformed. One box, one disk, your root password.
Hetzner Cloud CX23
from ~€5/mo (indicative)
2 vCPU / 4 GB / 40 GB. Best value on the market. DE, FI and US regions — pick an EU region if data sovereignty is the pitch you are making to creators.
Visit provider →Netcup · OVH · Contabo
€5–12/mo (indicative)
European alternatives with a similar shape. Useful if you want a second provider for backups or a standby box.
Visit provider →DigitalOcean · Vultr · Linode
$12–24/mo (indicative)
More expensive for the same specs, but the most familiar tooling and the best-documented incident recovery if you have never run a server.
Visit provider →Tier 2 — a self-hosted PaaS panel on your own VPS
Buttons, without giving up the boxCoolify is open source and runs on your own server. It consumes our docker-compose.yml directly, gives you a Vercel-like UI with git-push deploys, and issues Let's Encrypt certificates automatically — while the disk and the database stay entirely yours.
Coolify
Free + your VPS cost
Point it at the repository, it reads docker-compose.yml, and you get deploy buttons and automatic TLS on hardware you own. This is the recommendation for anyone who wants a UI without handing a vendor their database.
Visit provider →Dokploy · CapRover · Easypanel
Free + your VPS cost
Equivalent alternatives. All three run the same compose file; pick on interface preference rather than capability.
Visit provider →Tier 3 — managed Docker PaaS
Easiest, least ownershipThese work, because each keeps a real process alive with a mounted volume. Be clear-eyed about the trade-off: a third party holds your disk, which partly undoes the reason you are self-hosting in the first place.
Railway · Render · Fly.io · Koyeb
$5–25/mo (indicative)
Render needs a paid tier for a persistent disk; Fly.io needs a volume. All four will run the stack from the committed templates.
Visit provider →Read the acceptable-use policy first
—
Several managed platforms are unfriendly to adult-industry tooling and can terminate an account with little warning, taking the disk with it. A VPS carries far less of that risk. If you deploy here, keep off-box backups.
Will not work — saying so up front saves everyone an evening
- Vercel · Netlify · Cloudflare Workers and Pages · AWS Lambda. No always-on process for the scheduler and event engine, no persistent disk for SQLite, and request timeouts far below a login that waits on a captcha or an OTP — let alone an SSE stream that stays open for hours.
- Heroku. The filesystem is ephemeral. Every restart and every deploy destroys the database.
- Shared and cPanel hosting. Cannot run Docker, and cannot run Python and Node side by side with a long-lived process. The request signer is a Node subprocess and is not optional.
Supporting services you will also need
- A captcha provider. 2captcha, CapSolver or anti-captcha, for the Turnstile challenges that appear during OnlyFans login. The panel boots without it, but an OnlyFans credential login requires a funded key.
- One residential or mobile proxy per OnlyFans account. IPRoyal, Decodo, SOAX or Bright Data. Mandatory for OnlyFans; optional for Fansly. Self-hosting does not remove this OnlyFans cost.
- Somewhere to put backups. Any S3-compatible target — Backblaze B2, Cloudflare R2, a Hetzner Storage Box. Keep
ENCRYPTION_KEYoutside that bucket, or a restored backup is unreadable. - TLS. Caddy or Traefik for automatic certificates, or a Cloudflare Tunnel if you would rather not expose the box to the internet at all.
- Monitoring. Uptime Kuma, self-hosted like everything else. Something has to notice when a session drops at 3 a.m., and on a self-hosted install that something is not us.
What is in the open-source build
The same API and the same dashboard we operate, with our billing and metering layer removed. Not a cut-down demo, and not a community edition with the useful parts held back — there is no per-feature gating anywhere in the codebase.
The full REST API — OnlyFans and Fansly
The Flask app and its endpoint surface — messaging, mass DMs, posts, the vault, fans, subscribers, earnings, payouts, campaigns and exports. Fansly runs through the same normalised API, with a narrower write surface: reads, messaging and exports are there; media upload, payout requests and price changes are OnlyFans-only for now.
The connection layer
Login by email and password with captcha solving, OTP verification, and direct session-cookie connection. Per-account session isolation and browser impersonation included.
The CRM dashboard
The Next.js panel: overview, accounts, fans, inbox, subscribers, earnings, transactions, campaigns, automations, webhooks and settings.
The event engine
The scheduler and per-account poller that turn notifications, balance and subscriber deltas into typed events, with jobs that survive a restart.
Webhooks
HMAC-SHA256 signed delivery with a [5s, 30s, 5m, 30m, 2h] retry ladder and auto-deactivation of endpoints that stay dead.
Automations
The rule evaluator — trigger, conditions, templated action — plus the Discord, Slack, Telegram and OnlyFans-DM connectors.
Live streams and exports
The SSE hub for real-time dashboard updates, and the export queue that writes messages, tips, subscribers and earnings to CSV or JSON by date range.
Multi-tenant isolation
The per-panel crm_id model, API-key auth, rate limiting and security headers — so one install can serve several teams if you want it to.
The install story
Dockerfile, docker-compose.yml, a .env.example covering every variable, deploy templates for Render and Fly.io, and install.sh for a bare VPS with Caddy TLS.
Hosted cloud vs self-hosted
Same software, different operator. The table is written so you can talk yourself out of the cloud where that is the right answer — the column that wins depends entirely on how many accounts you run and how much of your own time is free.
| Feature | The Only API | Self-hosted (AGPL-3.0) |
|---|---|---|
| Where your data lives | On our servers, in an isolated per-panel tenancy, under our retention policy. Encrypted at rest, and never used to train anything or sold to anyone — but it is our disk. | On your disk. Your creators' messages, your fans' spend and your subscriber book never leave the machine you control. This is the whole reason to self-host. |
| Setup time | Minutes. Sign up, generate a key, connect an account with its proxy. Nothing to install. | An hour or two if you are comfortable with Docker and DNS, longer if this is your first server. Four mandatory secrets, then docker compose up. |
| Upgrades | Continuous, and invisible to you. Platform changes that break a login flow are our problem and are usually fixed before you notice. | Yours. git pull, read the changelog, rebuild, restart, verify. OnlyFans changes things without warning, so plan to do this regularly rather than annually. |
| Account and call limits | $20 per connected account slot per month, dropping to $15 at 15 or more slots. Unlimited API calls on every paid slot. The free plan is 1 account and 1,000 calls a month. | None. The metering layer is removed from the open-source build entirely, so there is nothing to raise and nothing that can silently re-enable itself. Your ceiling is hardware and proxies. |
| Proxies | Required for OnlyFans: one dedicated residential or mobile proxy per connected account, supplied by you. Optional for Fansly. | Required, identically. Self-hosting does not avoid this cost — it is usually the largest line item either way. |
| Captcha solving | Included in the slot price. The provider still receives the Turnstile sitekey and page URL for each solve. | Your own provider account and your own credits. Same carve-out: the provider sees the sitekey and page URL per solve. |
| Support when something breaks at 3 a.m. | Us. A support channel, a status page, and people whose job it is to notice before you do. | You, plus GitHub issues and the community Telegram. Best effort from volunteers and from us, with no response-time commitment. |
| Backups and disaster recovery | Ours to run and ours to restore. | Yours to design, run and — the part people skip — test. An untested backup of an encrypted session store is not a backup. Keep ENCRYPTION_KEY somewhere separate from the database. |
| MCP server for ChatGPT and Claude | Hosted and maintained at a single URL, with OAuth 2.1 and bearer auth. | Self-hosted alongside the API, pointed at your own base URL. You run the OAuth surface and the TLS that goes with it. |
| Licence and obligations | A commercial service. Nothing to comply with beyond the terms. | AGPL-3.0. Free for your own agency and your own clients; if you offer a modified version to other people as a network service, you must offer them your source under the same licence. |
Both columns describe the same codebase. The self-hosted build is the hosted one with billing, metering and our multi-customer operations layer removed.
What self-hosting actually costs
Six lines, written the way a competent ops person would write them rather than the way a sales page would. All figures are indicative — provider pricing moves, and proxy pricing moves a lot. Price your own before you decide.
The short version: below roughly five connected accounts, self-hosting does not pay. The server is cheap, but proxies, captcha credits and your own hours are not, and at that scale a handful of slots on the cloud costs less than the evening you will spend on DNS. Above five, the server cost stays flat while slot cost scales linearly, and self-hosting starts to win on money as well as on control.
The server
~€5–30/moA Hetzner CX23 (2 vCPU, 4 GB) handles a handful of accounts comfortably. Hetzner repriced in June 2026 and their rates vary by region, so check the console rather than trusting any figure here. Scale up as you add accounts — the poller and the SSE hub hold state in one process, so you grow the box rather than adding workers. Cheapest line on this list and the one people wrongly focus on.
Proxies
The big oneOne dedicated residential or mobile proxy per OnlyFans account, required on self-hosted and on the cloud alike. Fansly can connect without one. At ten OnlyFans accounts this will comfortably exceed every other cost on this page combined. Price it from your own provider before you decide anything — it is the number that actually moves the comparison.
Captcha credits
Cents per solveA 2captcha, CapSolver or anti-captcha balance, spent whenever a login or a re-login hits a Turnstile challenge. Small in normal operation, spiky when the platform tightens up and sessions start dropping and re-authenticating.
Engineering time
The real costInitial deploy, DNS and TLS, proxy wiring, a backup job, and monitoring that actually pages someone. Then the ongoing hours. If nobody on your team is comfortable reading a Docker log at midnight, this cost is much higher than it looks on paper.
Upgrades
Recurring, unpredictableOnlyFans and Fansly change without notice. When a login flow or a signing scheme shifts, we ship a fix — but on a self-hosted install, pulling it, rebuilding and verifying is your job, on your schedule, while your accounts are disconnected.
Support
YoursGitHub issues and the community Telegram, answered on a best-effort basis by volunteers and by us. No SLA, no guaranteed response time, no one on call for your deployment. Below about five accounts, this is where self-hosting stops paying.
Cost figures on this page are indicative list prices at the time of writing, not quotes, and exclude your own time. Proxy pricing in particular varies by an order of magnitude between providers and between residential and mobile pools.
AGPL-3.0 in plain English
Seven bullets that cover what almost everyone needs to know. They are a summary, not legal advice, and the licence text is what actually binds.
- Run it for anything, including making money. Your agency, your creators, your paying clients. Commercial use is explicitly allowed and costs nothing.
- Read it, change it, fork it. The source is the whole point. Modify it to fit your workflow; you owe no permission and no notice.
- Redistribute it, under the same licence. If you hand the software to someone else, it goes with the AGPL attached — you cannot relicense it as closed source.
- The network clause is the part that matters. If you offer a modified version to other people over a network as a service, you must offer those users the source of your modified version. This is the difference between AGPL and GPL.
- Internal changes stay internal. Modifications used only by you, your staff and your own creators are never triggered by the network clause. Running the unmodified project as a service is fine too.
- No warranty, no liability. Standard for copyleft licences. If a self-hosted install loses data or gets an account restricted, that is on your deployment — the software comes as-is.
- Why AGPL and not MIT. Partly principle: it keeps every improvement in the open. Partly obligation: parts of the platform connection layer descend from GPL-licensed upstream work, so copyleft is not ours to opt out of.
Two places to find us
GitHub for anything with a reproduction or a diff attached. Telegram for everything else — deployment questions, proxy providers, what broke this week.
Contribute
CONTRIBUTING.md →
Pull requests carry a Signed-off-by line (DCO). No CLA, no copyright assignment — your commits stay yours.
The roadmap lives in GitHub Issues rather than on a slide — read the open milestones in the README to see what is being worked on before you plan around it.
JOIN THE COMMUNITY
The people running this in production
OnlyFans and Fansly change things without announcing them. A signing header rotates, a challenge gets stricter, a payload grows a field — and whoever hits it first usually knows before we do.
- Early warning when a platform change starts breaking logins, hours before a release note exists.
- Proxy and captcha providers that are actually working right now, from operators paying for them.
- Deployment help from people who have already made the mistake you are about to make.
- Direct influence on what gets built next — issues raised here become roadmap items.
Free, no account needed beyond the platform itself. We read both, but neither carries a support SLA — that is what the hosted plans are for.
Open-source OnlyFans API — FAQ
The questions people ask before they clone it, answered with the caveats left in.
Own the box, or let us run it
Clone it under AGPL-3.0 and your data never leaves your disk. Or start on the hosted cloud — same software, and we carry the upgrades, the proxy pool and the 3 a.m. pager.