---
title: "NestJS security middleware: quickstart · camada"
description: "Keep credential stuffers, scrapers and exploit scanners out of your NestJS app: npm i @camada/node, two lines and one env var."
url: https://www.camada.app/docs/quickstart/nest
last_updated: 2026-10-30
---

Quickstart

# NestJS quickstart

Package `@camada/node`, on npm.

## 1. Install

```sh
npm i @camada/node
```

## 2. Environment

The key is printed once when you create a project in the app. Set these as environment variables: export them in the shell that starts your app, or keep them in .env and start it with node --env-file=.env (Node 20.6+). Node reads no .env file on its own.

shell

```sh
export CAMADA_KEY=<ingest_token>.<snap_token>
export CAMADA_INGEST_URL=http://localhost:8787   # dev only; defaults to production ingest
```

## 3. Wire it in

```ts
import { CamadaModule } from '@camada/node/nest';

@Module({ imports: [CamadaModule.forRoot()] })   // Nest ≤10: CamadaModule.forRoot({ routes: '*' })
export class AppModule {}
```

- Default Express platform. On the Fastify platform register the Fastify plugin instead.

## 4. Add the beacon to HTML pages

Optional but recommended. The beacon cuts false positives by showing which sessions are real browsers. Use the helper, or `<CamadaBeacon/>` from @camada/react.

```ts
import camada from '@camada/node';
res.send(`<head>${camada.scriptTag(req)}</head>…`);
```

## 5. Send app outcomes

Login failures, signups and checkout declines are the signals no edge position sees. The identifier is HMAC-hashed in your process. How they catch [credential stuffing](https://www.camada.app/use-cases/credential-stuffing).

```ts
import camada from '@camada/node';
camada.track(req, 'login_failed', { user: email });
```

Runtime

## What it does per request

1. Refreshes the blocklist snapshot off-path (30 s poll with ETag). A cold start fails open.
2. Resolves the client IP per your trusted-proxy setting. Raw X-Forwarded-For is never trusted without it.
3. A blocked IP or path gets a 403 with x-block-reason before your app runs. The event still ships.
4. Serves /_cam/b.js (the beacon, first-party) and relays /_cam/fp posts to ingest with the resolved client IP.
5. Sets x-rid and the _sfp session cookie, and on response finish ships one batched, redacted event.

Limits

## Caveats at this position

- Enforcement at this position covers IP and path entries. ASN and TLS-fingerprint entries fail open in-app.
- Memory: about 5 MB per loaded snapshot.
- CAMADA_SERVERLESS=1 switches to lazy refresh with no interval timer.

Kill switch: `CAMADA_DISABLED=1`, checked per request. All other variables are listed in the [docs index](https://www.camada.app/docs).

## Sitemap

[Every page on this site](https://www.camada.app/sitemap.md)