> ## Documentation Index
> Fetch the complete documentation index at: https://www.dropfans.io/developers/llms.txt
> Use this file to discover all available pages before exploring further.

# API terms & acceptable use

> What you may and may not do with a creator’s API key.

- Source: https://www.dropfans.io/developers/api-terms
- Section: Resources
- OpenAPI: https://www.dropfans.io/developers/openapi.json

Version 2026-08-19. Applying for API access, or using a key a creator gave you, means agreeing to these terms. They sit on top of the [Dropfans platform terms](https://terms.dropfans.io), which always apply.

## Keys

- **One key per creator, obtained from that creator.** A key comes from the creator (or their agency) generating it in Vault → API Connect for your app — never from anywhere else.
- **Store keys encrypted at rest**, server-side only. Do not log them, embed them in client code, or expose them in error messages.
- **Never resell, share or pool keys.** A key connects one creator to one integration; passing it to a third party is a breach.
- Delete a creator's key from your systems when they disconnect or ask you to.

## Content and moderation

- **No moderation bypass.** Everything created through the API goes through the same review as the dashboard. Attempting to route around review — technically or by misrepresentation — ends the integration.
- You are responsible for what your software submits on a creator's behalf; the creator's own platform obligations still apply.

## Data

- `check-status` and `earnings` return buyer data (emails, names). **Handle it lawfully** — under GDPR or whichever privacy law applies to you — use it only to serve the creator it belongs to, and never sell it or merge it across creators.
- Do not retain buyer data past what serving that creator requires.

## Conduct

- **Respect the rate limits** and the `Retry-After` header. Working around limits with key multiplication or IP rotation is a breach.
- Represent your app truthfully in your application and to the creators who connect it.

## Enforcement and changes

Breaching these terms can get your app suspended — every request with an app-bound key then returns `403` with code `app_suspended` — or removed entirely. Material changes to these terms are announced in the [changelog](https://www.dropfans.io/developers/changelog.md) with a new version string; continued use after a change means acceptance.

Questions: support@dropfans.io.

Next: [Changelog](https://www.dropfans.io/developers/changelog.md) or [Apply for API access](https://www.dropfans.io/developers/apply).

---

Previous: [Changelog](https://www.dropfans.io/developers/changelog.md) · All pages: [llms.txt](https://www.dropfans.io/developers/llms.txt)