Documentation
Authentication
Public GETs, admin bearer token, and webhook HMAC.
Three layers
| Layer | Mechanism | Used by |
|---|---|---|
| Public read | None (rate-limited) | GET /api/health, sessions, floor, alerts list, scorecard… |
| Admin | Authorization: Bearer $ADMIN_TOKEN | Accounts connect, intelligence run, backfill, alert ack, replay |
| Webhook | Header Signature = HMAC-SHA256 hex of raw body | POST /webhooks/onlyfans |
Admin example
curl -sS -X POST https://api.chatalyze.co/api/admin/intelligence/run \
-H "Authorization: Bearer $ADMIN_TOKEN" \
-H "content-type: application/json" \
-d '{"limit":3}'Missing or wrong token → 401Never log or commit
ADMIN_TOKEN. Rotate viawrangler secret put ADMIN_TOKEN.Webhook Signature
Matches OnlyFansAPI:Protecting your webhooks.
- Header name:
Signature - Algorithm: HMAC-SHA256 over raw request body
- Encoding: hex
- Secret: Worker
ONLYFANSAPI_WEBHOOK_SECRET(same value in OFAPI console)
Unsigned or invalid signature → 401 invalid_signature when secret is configured.