REST API
Authentication and permissions
The Authorization Bearer fc_sk_ header, what a key sees, and the list of permissions.
Every request carries the key in the Authorization: Bearer fc_sk_… header. A key:
- belongs to one person in the organization, who must be an admin;
- only sees the creators chosen when it was created (any other answers
404, as if she did not exist); - only has the permissions chosen (a missing permission answers
403and names it); - expires (7, 30 or 90 days) and can be revoked at any time in Settings › API & MCP: revocation applies from the next request;
- is the same as the MCP server's: one key system.
Keys created before 7 November 2026 start with fc_pat_: they are still accepted.
REST API permissions
| Permission | What it opens |
|---|---|
creators:read | creators |
conversations:read | MYM and OnlyFans conversations and messages |
telegram:read | Telegram conversations and messages |
fans:read | a fan's labels and team note |
chatting:read | who answers a fan (AI, a person, paused) |
sales:read | sales |
statistics:read | statistics per creator |
scripts:read · media:read | sales scripts, media library |
notifications:read | emergencies |
fans:write | write the team note and add/remove a label (with fans:read) |
chatting:write | pause the AI on a fan, or hand the fan back (with chatting:read) |
webhooks:read · webhooks:write | list and create webhooks |
No permission allows sending a message to a fan.
Personal data
The API only returns what the dashboard already shows an admin: fan names, messages, notes. Treat them as personal data: minimal storage, restricted access, deletion when you no longer need them.
Last updated on