Connect a creator to your app

How a creator connects#

1. Apply for API access. Once approved, your app appears in the key picker every creator sees under Vault → API Connect.

2. Send the creator your connect link:

   https://www.dropfans.io/dashboard/vault?apiConnect=1&app=<your-slug>
   

   It opens the picker with your app preselected — the creator hits Generate and copies the key. The link survives login, so it works for creators who are signed out when they click it.

3. The creator pastes the key into your app.

Agencies connect the same way, once per managed creator — each key is bound to exactly one creator. See Agencies.

Validate and store#

• Validate the pasted key immediately with GET /api/external/me and show the username back, so the creator sees they connected the right account.
• Store the key encrypted at rest. Never log it, never send it to your frontend, never echo it in error messages.
• One key per creator per app is enough — there is no benefit to minting more.

Revocation and suspension#

• The creator revokes the key (same screen it was made on): every request returns 401 from that moment, forever. Handle it by asking the creator to reconnect — do not retry in a loop.
• Dropfans suspends your app: every request with an app-bound key returns 403 { "error": …, "code": "app_suspended" }. Keys are not deleted — when the app is reinstated they work again unchanged. See Apps & approval.

Next: Testing without a sandbox or Authentication & API keys.