---
title: "Update Authentication Credentials"
method: PUT
path: "/api/authenticate/{account_id}/credentials"
tags: ["Connect OnlyFans Account"]
---

# Update Authentication Credentials

`PUT /api/authenticate/{account_id}/credentials`

## Request

- Base URL: `https://app.onlyfansapi.com`
- URL: `https://app.onlyfansapi.com/api/authenticate/{account_id}/credentials`
- Auth: HTTP bearer

Replace the authentication credentials of an existing connected account and trigger a re-authentication. Supports the same three methods as Start Authentication: email/password (default), cookies & headers (raw_data), or FansAPI Auth+ mobile app (mobile_app). You can also switch an account from one method to another (e.g. from email_password to raw_data). The new credentials are stored securely and encrypted at rest, and re-authentication is started immediately regardless of the account's current session state — running workflows are stopped and API requests return 503 until re-authentication completes. For mobile_app, the response includes a `mobile_auth_session_deeplink` that the creator opens on their phone to complete authentication.

## Request body

- object
  - `auth_type` 'email_password' | 'raw_data' | 'mobile_app': The authentication method to use. Defaults to `email_password` if omitted.
  - `email` string: The email address of the OnlyFans account. Required when auth_type is `email_password`.
  - `password` string: The password of the OnlyFans account. Required when auth_type is `email_password`.
  - `auth_id` string: The auth_id from OnlyFans session cookies. Required when auth_type is `raw_data`.
  - `cookies` string: The full cookie string (semicolon-separated). Required when auth_type is `raw_data`.
  - `xbc` string: The X-BC token from request headers. Required when auth_type is `raw_data`.
  - `user_agent` string: The browser User-Agent string. Required when auth_type is `raw_data`.

## Response `200`

- union
  - object: For email_password or raw_data auth types
    - `attempt_id` string
    - `message` string
    - `polling_url` string
  - object: For mobile_app auth type — includes the session code to scan with the FansAPI Auth+ app
    - `attempt_id` string
    - `message` string
    - `polling_url` string
    - `mobile_auth_session_deeplink` string

## Changes

- **2026-10-17** `b3968f1bc1f0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/onlyfansapi/apis/onlyfans-api/changes/api/authenticate/:account_id/credentials/put.md)

---

[API](https://skmtc.dev/onlyfansapi/apis/onlyfans-api.md) - [All operations](https://skmtc.dev/onlyfansapi/apis/onlyfans-api/llms.txt) - [OpenAPI document](https://skmtc.dev/onlyfansapi/apis/onlyfans-api/revisions/122c36386896?raw)