Base URL & panels

https://theonlyapi.com/api/crm/{crm_id}

{crm_id} is your panel ID — a string like crm_0123456789abcdef, shown in Dashboard → Settings. If you only have an API key, resolve it:

curl "https://api.theonlyapi.com/api/whoami" -H "X-API-Key: $KEY"

The panel is the tenant boundary

A panel owns:

its API keys (one primary, any number of secondary)
its connected creator accounts — one slot per account, each with its own persisted session and proxy
its events, webhooks, automations, exports and cached data

Nothing crosses panels. A key for panel A cannot read panel B, and {of_user_id} must belong to the panel in the path.

Unscoped routes use a different host

Seven routes are not panel-scoped. They live on the API host, not the marketing host:

https://api.theonlyapi.com/health
https://api.theonlyapi.com/api/whoami
https://api.theonlyapi.com/api/auth/register
https://api.theonlyapi.com/api/auth/login
https://api.theonlyapi.com/api/auth/start-email-verification
https://api.theonlyapi.com/api/auth/verify-email
https://api.theonlyapi.com/api/crm/register

These do not work on theonlyapi.com

theonlyapi.com is a Next.js app that proxies /api/crm/{crm_id}/… through to the API. It does not route the unscoped paths, and two of them collide with its own routes:

Route on `theonlyapi.com`	What you actually get
`GET /health`	`404`
`GET /api/whoami`	`404`
`POST /api/crm/register`	`{"error": "Unauthorized"}`
`POST /api/auth/*`	`Error: This action with HTTP POST is not supported by NextAuth.js` — the site's own auth handler answers first

Use api.theonlyapi.com for all seven.

In this reference those endpoints are documented with their full path, and their "Test it" server is api.theonlyapi.com rather than the panel-scoped base URL.

Path anatomy

https://theonlyapi.com/api/crm/crm_abc123/accounts/482687148/chats
└──────── origin ────┘└─ panel scope ──┘└──── resource ─────────┘

Most resources hang off a connected account:

/accounts/{of_user_id}/balances
/accounts/{of_user_id}/subscribers/cached
/accounts/{of_user_id}/chats/{with_user_id}/messages

A few are panel-wide, aggregating across every connected account:

/fans
/balances/summary
/earnings/summary
/events
/webhooks
/automations

And the passthrough mirrors OnlyFans' own paths verbatim after the prefix:

/api2/v2/users/me
/api2/v2/subscriptions/subscribers?limit=10&type=active

of_user_id is platform-neutral

Despite the name, of_user_id identifies a connected account on either platform. A Fansly account's ID is returned and used as of_user_id too. Get the list from GET /accounts.

Which host to use

Routes	Host
Everything panel-scoped — `/api/crm/{crm_id}/…`	`https://theonlyapi.com`
The seven unscoped routes above	`https://api.theonlyapi.com`

api.theonlyapi.com reaches the API directly and serves the panel-scoped routes too, so it works for both if you would rather use one host everywhere. The panel-scoped examples in these docs use theonlyapi.com because that is the documented product base URL.

The panel is the tenant boundary

Unscoped routes use a different host

Path anatomy

Which host to use

On this page