API terms & acceptable use

Version 2026-08-19. Applying for API access, or using a key a creator gave you, means agreeing to these terms. They sit on top of the Dropfans platform terms, which always apply.

Keys#

• One key per creator, obtained from that creator. A key comes from the creator (or their agency) generating it in Vault → API Connect for your app — never from anywhere else.
• Store keys encrypted at rest, server-side only. Do not log them, embed them in client code, or expose them in error messages.
• Never resell, share or pool keys. A key connects one creator to one integration; passing it to a third party is a breach.
• Delete a creator's key from your systems when they disconnect or ask you to.

Content and moderation#

• No moderation bypass. Everything created through the API goes through the same review as the dashboard. Attempting to route around review — technically or by misrepresentation — ends the integration.
• You are responsible for what your software submits on a creator's behalf; the creator's own platform obligations still apply.

Data#

• check-status and earnings return buyer data (emails, names). Handle it lawfully — under GDPR or whichever privacy law applies to you — use it only to serve the creator it belongs to, and never sell it or merge it across creators.
• Do not retain buyer data past what serving that creator requires.

Conduct#

• Respect the rate limits and the Retry-After header. Working around limits with key multiplication or IP rotation is a breach.
• Represent your app truthfully in your application and to the creators who connect it.

Enforcement and changes#

Breaching these terms can get your app suspended — every request with an app-bound key then returns 403 with code app_suspended — or removed entirely. Material changes to these terms are announced in the changelog with a new version string; continued use after a change means acceptance.

Questions: [email protected].

Next: Changelog or Apply for API access.