Proxies

OnlyFans ties a session to the network it was created from. If requests for that session start arriving from a different IP, the session gets invalidated. So every OnlyFans account is bound to a proxy at connect time, and we route all of its subsequent traffic through the same one.

Platform	`X-Proxy` on connect	On later requests
OnlyFans	not enforced, but strongly recommended	optional — overrides the saved proxy
Fansly	optional	optional

Supplying one

Pass it as a header on the connection routes:

curl -X POST "$BASE/api/crm/$CRM/accounts/login/cookies" \
  -H "X-API-Key: $KEY" \
  -H "X-Proxy: http://user:pass@host:port" \
  …

It is saved with the account. You do not send it again unless you want to override it for a single request.

Accepted formats

http://user:pass@host:port
https://user:pass@host:port
http://host:port
socks5://user:pass@host:port
socks5h://user:pass@host:port    # DNS resolved proxy-side
host:port:user:pass             # compact form, converted to http://

The compact form splits on the first three colons, so a password containing a colon survives.

socks5h:// resolves hostnames at the proxy rather than locally, which is usually what you want with SOCKS.

Test before you connect

curl -X POST "$BASE/api/crm/$CRM/proxy/test" \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"proxy": "http://user:pass@host:port"}'

Worth doing first — a bad proxy during login looks like a login failure, and login routes are limited to 100 requests/minute.

Loopback and private proxies are refused

/proxy/test blocks loopback, private and link-local addresses as an SSRF guard, so a proxy on your own machine reports as a failure rather than a pass.

Changing an account's proxy

curl -X PATCH "$BASE/api/crm/$CRM/accounts/$OFUID/proxy" \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{"proxy": "http://user:pass@newhost:port"}'

GET the same path to read the current one.

Keep the exit location stable

Swapping to a proxy that exits from a noticeably different city or country tends to invalidate the session, because it looks exactly like an account takeover. Expect to reconnect the account. Rotate within the same region if you must rotate.

Choosing proxies

One proxy per account. Sharing an IP across many creator accounts is a reliable way to get all of them flagged together.
Residential or ISP proxies behave better than datacenter ranges, which OnlyFans is more aggressive about.
Sticky sessions, not per-request rotation. A rotating proxy that changes IP mid-session defeats the entire point.

Credentials in logs

Proxy URLs contain credentials. They are stored server-side with the account and never reflected back except through GET /accounts?include_session=true and GET /accounts/{of_user_id}/proxy, both of which need your API key. Server errors are deliberately opaque so a proxy URL cannot leak through a stack trace — see Responses & errors.