Quickstart
NestJS quickstart
Package @camada/node, on npm.
1. Install
npm i @camada/node2. Environment
The key is printed once when you create a project in the app. Set these as environment variables: export them in the shell that starts your app, or keep them in .env and start it with node --env-file=.env (Node 20.6+). Node reads no .env file on its own.
export CAMADA_KEY=<ingest_token>.<snap_token>
export CAMADA_INGEST_URL=http://localhost:8787 # dev only; defaults to production ingest3. Wire it in
import { CamadaModule } from '@camada/node/nest';
@Module({ imports: [CamadaModule.forRoot()] }) // Nest ≤10: CamadaModule.forRoot({ routes: '*' })
export class AppModule {}- Default Express platform. On the Fastify platform register the Fastify plugin instead.
4. Add the beacon to HTML pages
Optional but recommended. The beacon cuts false positives by showing which sessions are real browsers. Use the helper, or <CamadaBeacon/> from @camada/react.
import camada from '@camada/node';
res.send(`<head>${camada.scriptTag(req)}</head>…`);5. Send app outcomes
Login failures, signups and checkout declines are the signals no edge position sees. The identifier is HMAC-hashed in your process. How they catch credential stuffing.
import camada from '@camada/node';
camada.track(req, 'login_failed', { user: email });Runtime
What it does per request
- Refreshes the blocklist snapshot off-path (30 s poll with ETag). A cold start fails open.
- Resolves the client IP per your trusted-proxy setting. Raw X-Forwarded-For is never trusted without it.
- A blocked IP or path gets a 403 with x-block-reason before your app runs. The event still ships.
- Serves /_cam/b.js (the beacon, first-party) and relays /_cam/fp posts to ingest with the resolved client IP.
- Sets x-rid and the _sfp session cookie, and on response finish ships one batched, redacted event.
Limits
Caveats at this position
- Enforcement at this position covers IP and path entries. ASN and TLS-fingerprint entries fail open in-app.
- Memory: about 5 MB per loaded snapshot.
- CAMADA_SERVERLESS=1 switches to lazy refresh with no interval timer.
Kill switch: CAMADA_DISABLED=1, checked per request. All other variables are listed in the docs index.