Pick your use case
Start with the threat you care about most. Each page lists the exact templates to enable.Fake accounts
Bots and mass signups at the
signup event.Account takeover
Credential stuffing and stolen logins at the
login event.SMS pumping
OTP toll fraud at the
otp event.The five steps
1
Connect Cloudflare and deploy
In the dashboard under Integration, paste a Cloudflare API
token, pick the routes to protect, and click Deploy. Tracenow installs a Worker on your
zone that injects the fingerprint script and calls
/trace on every attempt. No code.
Full walkthrough: Cloudflare integration.2
Enable the policy templates for your use case
Under Guard, open the policy templates and turn on the ones
for your threat (for example, the Fake accounts templates for signups). Enable them in
Monitor mode so they observe without blocking. This replaces writing rules by hand.
3
Watch the event feed
Send a few real logins or signups through your site. Within seconds they appear in the
Events feed with their signals and the verdict each policy produced. Confirm the verdicts
look right for your traffic before you block anything.
4
Switch to Enforce
Once you trust the verdicts, flip the templates (or specific rules) to Enforce. Now a
deny
verdict is enforced at the edge. Configure the blocked response
(status, redirect, or custom body) if you want more than the default 403.5
Add the in-app call (account takeover)
For full per-user protection (new device for a real account, impossible travel, brute force
tied to a known user), add one
/trace call from your backend with the real subject_user_id.
The device token is already on the request for you. See Server-side integration.
Fake accounts and SMS pumping are fully covered at the edge and do not need this step.What’s happening under the hood
How it works
The request lifecycle through the edge Worker and
/trace.Verdicts
allow, challenge, deny: what each means and how to handle it.Prefer to call the API directly?
The Cloudflare Worker calls/trace for you. If you also want to call it from your backend, the
/trace reference documents every request and response field.