OnlyFans header generator (c) Luma

of_gen.js

const APP_TOKEN = "33d57ade8c02dbc5a333db99ff9ae26a";
const SECRET = "j6CYtfx3q9o7TCjVxWKKgUekVUj3L0q3";
const USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36";


(async () => {
    const uri = "/api2/v2/init";

    const signHeader = await getSignHeader(uri);
    const bcHeader = await getBcToken();

    console.log(`sign: ${signHeader.sign}`);
    console.log(`time: ${signHeader.ts}`);
    console.log(`x-bc: ${bcHeader}`);
    console.log(`app-token: ${APP_TOKEN}`);

    const initResp = await fetch(`https://onlyfans.com${uri}`, {
        method: "GET",
        headers: {
            "accept": "application/json",
            "app-token": APP_TOKEN,
            "sign": signHeader.sign,
            "time": signHeader.ts,
            "user-agent": USER_AGENT,
            "x-bc": bcHeader,
        }
    });
    const content = await initResp.json();
    console.log(content);
})();


async function getSignHeader(uri, params = 0) {
    const now = Date.now();
    const hash = await sha1([SECRET, now, uri, params].join("\n"));

    const part3 = Math.abs(
        hash[9483 % hash.length].charCodeAt(0) + 113 +
        hash[8874 % hash.length].charCodeAt(0) + 94 +
        hash[9097 % hash.length].charCodeAt(0) - 66 +
        hash[8929 % hash.length].charCodeAt(0) - 56 +
        hash[7607 % hash.length].charCodeAt(0) + 129 +
        hash[7778 % hash.length].charCodeAt(0) + 88 +
        hash[8531 % hash.length].charCodeAt(0) + 139 +
        hash[7326 % hash.length].charCodeAt(0) - 143 +
        hash[9809 % hash.length].charCodeAt(0) + 71 +
        hash[8790 % hash.length].charCodeAt(0) - 89 +
        hash[8324 % hash.length].charCodeAt(0) - 79 +
        hash[7692 % hash.length].charCodeAt(0) - 97 +
        hash[9755 % hash.length].charCodeAt(0) - 94 +
        hash[7885 % hash.length].charCodeAt(0) - 120 +
        hash[8071 % hash.length].charCodeAt(0) - 92 +
        hash[9040 % hash.length].charCodeAt(0) - 127 +
        hash[9599 % hash.length].charCodeAt(0) + 147 +
        hash[8249 % hash.length].charCodeAt(0) - 100 +
        hash[7501 % hash.length].charCodeAt(0) - 64 +
        hash[9688 % hash.length].charCodeAt(0) - 113 +
        hash[9210 % hash.length].charCodeAt(0) - 139 +
        hash[8617 % hash.length].charCodeAt(0) + 95 +
        hash[9261 % hash.length].charCodeAt(0) - 64 +
        hash[9915 % hash.length].charCodeAt(0) + 133 +
        hash[8411 % hash.length].charCodeAt(0) - 114 +
        hash[7450 % hash.length].charCodeAt(0) + 102 +
        hash[7986 % hash.length].charCodeAt(0) - 119 +
        hash[8174 % hash.length].charCodeAt(0) - 117 +
        hash[8723 % hash.length].charCodeAt(0) + 125 +
        hash[7213 % hash.length].charCodeAt(0) - 64 +
        hash[9381 % hash.length].charCodeAt(0) + 125 +
        hash[7374 % hash.length].charCodeAt(0) + 62
    ).toString(16);

    return {
        ts: now,
        sign: ["7162", hash, part3, "63f8dc75"].join(":"),
    };
}

async function getBcToken() {
    const random = () => 1000000000000 * Math.random()
    return sha1([Date.now(), random(), random(), USER_AGENT].map(btoa).join("."));
}

async function sha1(message) {
    const data = new TextEncoder().encode(message);
    const hash = await crypto.subtle.digest("SHA-1", data);

    return Array.from(new Uint8Array(hash))
        .map((b) => b.toString(16).padStart(2, '0'))
        .join('');
}