> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracenow.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Go from zero to protected in five steps, no code required to start.

Tracenow protects your login, signup, and OTP flows through the Cloudflare integration. You
connect your account, enable the policies for your use case, and watch traffic. This page walks
the whole journey end to end.

## Pick your use case

Start with the threat you care about most. Each page lists the exact templates to enable.

<Columns cols={3}>
  <Card title="Fake accounts" icon="user-xmark" href="/use-cases/fake-accounts">
    Bots and mass signups at the `signup` event.
  </Card>

  <Card title="Account takeover" icon="lock" href="/use-cases/account-takeover">
    Credential stuffing and stolen logins at the `login` event.
  </Card>

  <Card title="SMS pumping" icon="comment-sms" href="/use-cases/sms-pumping">
    OTP toll fraud at the `otp` event.
  </Card>
</Columns>

## The five steps

<Steps>
  <Step title="Connect Cloudflare and deploy">
    In the [dashboard](https://tracenow.io/dashboard) under **Integration**, paste a Cloudflare API
    token, pick the routes to protect, and click **Deploy**. Tracenow installs a Worker on your
    zone that injects the fingerprint script and calls `/trace` on every attempt. No code.
    Full walkthrough: [Cloudflare integration](/guides/cloudflare).
  </Step>

  <Step title="Enable the policy templates for your use case">
    Under **Guard**, open the [policy templates](/guides/policy-templates) and turn on the ones
    for your threat (for example, the Fake accounts templates for signups). Enable them in
    **Monitor** mode so they observe without blocking. This replaces writing rules by hand.
  </Step>

  <Step title="Watch the event feed">
    Send a few real logins or signups through your site. Within seconds they appear in the
    **Events** feed with their signals and the verdict each policy produced. Confirm the verdicts
    look right for your traffic before you block anything.
  </Step>

  <Step title="Switch to Enforce">
    Once you trust the verdicts, flip the templates (or specific rules) to **Enforce**. Now a `deny`
    verdict is enforced at the edge. Configure the [blocked response](/guides/cloudflare)
    (status, redirect, or custom body) if you want more than the default `403`.
  </Step>

  <Step title="Add the in-app call (account takeover)">
    For full per-user protection (new device for a real account, impossible travel, brute force
    tied to a known user), add one `/trace` call from your backend with the real `subject_user_id`.
    The device token is already on the request for you. See [Server-side integration](/guides/server-side).
    Fake accounts and SMS pumping are fully covered at the edge and do not need this step.
  </Step>
</Steps>

## What's happening under the hood

<Columns cols={2}>
  <Card title="How it works" icon="diagram-project" href="/concepts/how-it-works">
    The request lifecycle through the edge Worker and `/trace`.
  </Card>

  <Card title="Verdicts" icon="scale-balanced" href="/concepts/verdicts">
    `allow`, `challenge`, `deny`: what each means and how to handle it.
  </Card>
</Columns>

## Prefer to call the API directly?

The Cloudflare Worker calls `/trace` for you. If you also want to call it from your backend, the
[/trace reference](/api-reference/trace) documents every request and response field.