The FanOptik API

Read the money and connection health of every creator in your agency workspace — the same figures the app shows — over a clean REST API with signed webhooks.

Base URL  https://app.fanoptik.com

Authentication

Every request carries an API key as a Bearer token. Create and revoke keys in the app under Settings → Integrations (owner only). A key is shown in full exactly once, at creation — store it then. A key can only ever read the one workspace it was minted in.

Authorization: Bearer fo_live_xxxxxxxxxxxxxxxxxxxxxxxx

Requests are rate-limited per key, per minute (over the limit returns 429); a missing or invalid key returns 401.

Endpoints

{
  "creators": [
    { "id": "cl_...", "name": "Creator Name", "status": "active", "lastSyncAt": "2026-09-16T03:12:00Z" }
  ]
}

{
  "creatorId": "cl_...",
  "windowDays": 30,
  "totals": { "count": 194, "gross": 3666.04, "net": 2932.64 },
  "byType": {
    "subscription": { "count": 126, "gross": 2519.74, "net": 2015.79 },
    "custom": { "count": 61, "gross": 1100.30, "net": 880.24 },
    "tip": { "count": 1, "gross": 46.00, "net": 36.61 }
  }
}

Webhooks

Register https:// endpoints under Settings → Integrations. FanOptik POSTs a JSON body for each event:

Every delivery is signed. The raw body is HMAC-SHA256’d under the webhook’s signing secret (shown once, at creation) and sent as:

X-FanOptik-Signature: sha256=<hex digest of the raw request body>

Verify by recomputing the HMAC over the raw body and comparing in constant time. Reject any request whose signature does not match.

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody, header, secret) {
  const expected = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header || ""); const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Notes

© 2026 FanOptik. All rights reserved. · Built for people who pay their team from records, not memory.