Skip to main content
tracenow is a fraud intelligence API. It evaluates the signals attached to any user action (IP address, email, phone number, device fingerprint) and returns a verdict: allow, challenge, or deny. You configure the policies. tracenow does the enrichment and the evaluation in real time, on every request.

​
What you get

Trace

One call. All signals evaluated in parallel. A single verdict your backend can act on immediately.

Device fingerprinting

Identifies devices, detects headless browsers and automation, and enforces replay protection. The fingerprint script is injected automatically by the Cloudflare integration; you never add it by hand.

​
What you can stop

Fake accounts

Block bots, disposable emails, and mass signups at the signup event.

Account takeover

Stop credential stuffing, brute force, and stolen-password logins at the login event.

SMS pumping

Stop toll fraud and OTP abuse at the otp event.

​
How to get started

tracenow integrates one way: through Cloudflare. You connect your account and tracenow deploys a managed Worker on your zone that injects the device script and calls /trace for you. No snippet to embed, no code to write.
1

Connect Cloudflare

In the dashboard under Integration, paste a Cloudflare API token. tracenow validates it and lists your domains. See the Cloudflare integration.
2

Pick your routes and deploy

Choose the login, signup, and OTP routes to protect and whether to monitor or enforce. Click Deploy: the Worker injects trace.min.js and calls /trace on every attempt. No code.
3

Add the in-app call for account takeover

When you’re ready for full per-user protection, make one /trace call from your backend with the real user ID. The device token is already on the request for you. See Server-side integration.
4

Configure your policies

Define what challenge and deny mean for your app. Options include Tor exit nodes, disposable emails, headless browsers, and velocity anomalies. Set them in the dashboard under Guard.

​
Learn the concepts

How it works

The full architecture: the edge Worker, /trace, and the request lifecycle end to end.

Signals

Every signal you can write rules against: IP, email, phone, device, and velocity.

Verdicts

allow, challenge, deny: what each means and how to handle it.

Rules

Create and edit the rules that turn signals into verdicts.

​
Authentication

All server-side endpoints require a Bearer secret key. The device endpoints use a publishable key that is safe to expose in browser code.
See Authentication for details.

​
Base URL