API — Attached reconnect
Recovering a platform account from a session already attached and live in the browser, instead of a fresh login — begin, discover, prepare, finalize, status, cancel.
Attached reconnect is a recovery path, not the first-time connect flow — see
Reconnect a lost account
for when to use it. It shares the Browser
runtime's mount point
(/api/browser-runtime/v1) and its proof-envelope auth, and is only mounted
when an attached-reconnect service is configured — build_browser_ attached_reconnect_router() is included conditionally inside
build_browser_runtime_router() (browser_runtime.py:186-192).
Endpoints under /profiles/attached-reconnect/*:
| Endpoint | Purpose |
|---|---|
POST /begin | Starts a reconnect attempt for a connect attempt + external account id, optionally on a saved proxy. |
POST /begin-exclusive-reauth | Same start, for the exclusive re-authentication path. |
POST /discover | Looks for an already-attached, live OnlyFans session on the device to reconnect from. Returns {"outcome": "none"} if there isn't one — not an error. |
POST /prepare | Captures the session bundle, step one. |
POST /finalize-intent | Captures the session bundle, step two — commits the intent. |
POST /status | Reads the state of an in-progress operation by operation_id + operation_epoch. |
POST /cancel | Cancels an in-progress operation. |
begin's response has three possible shapes depending on outcome:
no_attached_source (nothing to reconnect from), source_not_live (found a
source, but it isn't live — includes a source projection with reason), or
a full operation projection when a live source was found and the operation
started.
/profiles/continue
A separate top-level route, POST /profiles/continue, is a single encoded
envelope fallback for prepare and finalize-intent — it decodes the body
and dispatches to whichever action the envelope names. This exists for the
same reason the native-login flow has an encoded /consent/context variant:
a redirect_uri pointing at 127.0.0.1 inside a plain POST body trips
Cloudflare's SSRF rule before the request reaches us; encoding the body
avoids the pattern match. Behavior is otherwise identical to calling
prepare/finalize-intent directly.
Errors
Domain failures (a stale operation epoch, a state conflict, a gateway error from the attached-session check) all route through the same runtime-error mapping as the rest of the browser-runtime family — expect the same small set of conflict-shaped codes, not endpoint-specific ones.
What's next
For the fingerprint-stability rules that make attached reconnect safe to use at all, see Troubleshooting.
API — Fansly sync
The endpoint family the Fansly collection engine itself calls to accept work, claim and report on sync segments, and prove session liveness. Not called by the panel, the extension, or Tease Browser.
API — Account API keys
A creator mints their own Bearer API keys to drive the platform from their own Claude / MCP client — create, list, and revoke, scoped to that creator's tenant only.