> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracenow.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Real-time fraud intelligence and device fingerprinting. Stop bad actors before they get in.

tracenow is a fraud intelligence API. It evaluates the signals attached to any user action (IP address, email, phone number, device fingerprint) and returns a verdict: **allow**, **challenge**, or **deny**.

You configure the policies. tracenow does the enrichment and the evaluation in real time, on every request.

## What you get

<Columns cols={2}>
  <Card title="Trace" icon="bolt" href="/api-reference/trace">
    One call. All signals evaluated in parallel. A single verdict your backend can act on immediately.
  </Card>

  <Card title="Device fingerprinting" icon="fingerprint" href="/guides/cloudflare">
    Identifies devices, detects headless browsers and automation, and enforces replay protection. The fingerprint script is **injected automatically by the Cloudflare integration**; you never add it by hand.
  </Card>
</Columns>

## What you can stop

<Columns cols={3}>
  <Card title="Fake accounts" icon="user-xmark" href="/use-cases/fake-accounts">
    Block bots, disposable emails, and mass signups at the `signup` event.
  </Card>

  <Card title="Account takeover" icon="lock" href="/use-cases/account-takeover">
    Stop credential stuffing, brute force, and stolen-password logins at the `login` event.
  </Card>

  <Card title="SMS pumping" icon="comment-sms" href="/use-cases/sms-pumping">
    Stop toll fraud and OTP abuse at the `otp` event.
  </Card>
</Columns>

## How to get started

tracenow integrates **one way: through Cloudflare**. You connect your account and tracenow
deploys a managed Worker on your zone that injects the device script and calls `/trace` for
you. No snippet to embed, no code to write.

<Steps>
  <Step title="Connect Cloudflare">
    In the [dashboard](https://tracenow.io/dashboard) under **Integration**, paste a Cloudflare API token. tracenow validates it and lists your domains. See the [Cloudflare integration](/guides/cloudflare).
  </Step>

  <Step title="Pick your routes and deploy">
    Choose the login, signup, and OTP routes to protect and whether to **monitor** or **enforce**. Click Deploy: the Worker injects `trace.min.js` and calls `/trace` on every attempt. No code.
  </Step>

  <Step title="Add the in-app call for account takeover">
    When you're ready for full per-user protection, make one `/trace` call from your backend with the real user ID. The device token is already on the request for you. See [Server-side integration](/guides/server-side).
  </Step>

  <Step title="Configure your policies">
    Define what `challenge` and `deny` mean for your app. Options include Tor exit nodes, disposable emails, headless browsers, and velocity anomalies. Set them in the [dashboard](https://tracenow.io/dashboard) under **Guard**.
  </Step>
</Steps>

## Learn the concepts

<Columns cols={2}>
  <Card title="How it works" icon="diagram-project" href="/concepts/how-it-works">
    The full architecture: the edge Worker, `/trace`, and the request lifecycle end to end.
  </Card>

  <Card title="Signals" icon="signal" href="/concepts/signals">
    Every signal you can write rules against: IP, email, phone, device, and velocity.
  </Card>

  <Card title="Verdicts" icon="scale-balanced" href="/concepts/verdicts">
    `allow`, `challenge`, `deny`: what each means and how to handle it.
  </Card>

  <Card title="Rules" icon="sliders" href="/guides/rules">
    Create and edit the rules that turn signals into verdicts.
  </Card>
</Columns>

## Authentication

All server-side endpoints require a `Bearer` secret key. The device endpoints use a publishable key that is safe to expose in browser code.

```http theme={null}
Authorization: Bearer tn_live_xxxxxxxxxxxxxxxxxxxx
```

See [Authentication](/authentication) for details.

## Base URL

```
https://api.tracenow.io
```