> ## Documentation Index
> Fetch the complete documentation index at: https://www.dropfans.io/developers/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect a creator to your app

> How a third-party app obtains and safely stores a creator’s Dropfans API key.

- Source: https://www.dropfans.io/developers/get-started/connect-a-creator
- Section: Get started
- OpenAPI: https://www.dropfans.io/developers/openapi.json

> [!NOTE] Looking for OAuth?
> There is no OAuth flow. The creator generates a key **for your app** and pastes it into your product — that key is the whole handshake. It never expires and there is nothing to refresh.

## How a creator connects

1. [Apply for API access](https://www.dropfans.io/developers/apply). Once approved, your app appears in the key picker every creator sees under Vault → API Connect.
2. Send the creator your connect link:

   ```
   https://www.dropfans.io/dashboard/vault?apiConnect=1&app=<your-slug>
   ```

   It opens the picker with your app preselected — the creator hits Generate and copies the key. The link survives login, so it works for creators who are signed out when they click it.
3. The creator pastes the key into your app.

Agencies connect the same way, once per managed creator — each key is bound to exactly one creator. See [Agencies](https://www.dropfans.io/developers/concepts/agencies.md).

## Validate and store

- Validate the pasted key immediately with [GET /api/external/me](https://www.dropfans.io/developers/reference/get-me.md) and show the `username` back, so the creator sees they connected the right account.
- Store the key encrypted at rest. Never log it, never send it to your frontend, never echo it in error messages.
- One key per creator per app is enough — there is no benefit to minting more.

## Revocation and suspension

- **The creator revokes the key** (same screen it was made on): every request returns `401` from that moment, forever. Handle it by asking the creator to reconnect — do not retry in a loop.
- **Dropfans suspends your app**: every request with an app-bound key returns `403 { "error": …, "code": "app_suspended" }`. Keys are not deleted — when the app is reinstated they work again unchanged. See [Apps & approval](https://www.dropfans.io/developers/concepts/apps-and-approval.md).

Next: [Testing without a sandbox](https://www.dropfans.io/developers/get-started/testing.md) or [Authentication & API keys](https://www.dropfans.io/developers/concepts/authentication.md).

---

Previous: [Make your first call](https://www.dropfans.io/developers/get-started/first-call.md) · Next: [Testing without a sandbox](https://www.dropfans.io/developers/get-started/testing.md) · All pages: [llms.txt](https://www.dropfans.io/developers/llms.txt)