Detection, Mitigation & Response

Detect and mitigate DDoS attacks in under 1 second, respond automatically, and keep your users informed.

All features →
Docs
Documentation Quick Start API Reference Agent Setup Integrations 18
Learn
Free Tools 37 Free Certifications State of DDoS 2026 REPORT DDoS Protection Landscape Buyer's Guide PDF Hackathon Sponsorships DDoS Protection Facts
Company
About Us Become a Consultant 30% Partners White Label Managed Protection Contact Us System Status
Open Source
ftagent-lite MIT NetHawk MIT
Legal
Security Trust Center Terms & Privacy
Who Uses Flowtriq

From indie hosts to ISPs, see how teams like yours use Flowtriq to detect and stop DDoS attacks.

All use cases →

Mass Deployment

Provision hundreds of nodes with a single command

Overview

The Deploy Token lets you provision Flowtriq nodes programmatically without logging into the dashboard. Generate a workspace deploy token, then use it in your automation (Ansible, Terraform, cloud-init, bash scripts) to register nodes and receive API keys in one step.

Each node created via the deploy token is billed instantly on your workspace's current billing term. If you're on a trial, nodes are free until the trial ends. Any active promo codes or discounts on your subscription apply automatically to new nodes.

Step 1: Generate a Deploy Token

Go to Settings → Workspace and find the Mass Deployment Token card. Click Generate Deploy Token.

Your token is a 64-character hex string. Treat it like a password. Anyone with the token can create nodes in your workspace and increase your bill.

Security: Store your deploy token in environment variables or a secrets manager. Never commit it to version control. Revoke it immediately from Settings if compromised.

Step 2: Deploy Nodes via API

Send a POST request to /api/deploy with your token in the Authorization header:

curl -s https://flowtriq.com/api/deploy \ -H "Authorization: Bearer YOUR_DEPLOY_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "name": "web-prod-3", "ip": "203.0.113.10", "location": "US-East", "os": "Ubuntu 24.04", "interface": "eth0" }'

Request fields

FieldRequiredDescription
nameYesUnique node name within your workspace
ipYesIPv4 or IPv6 address of the server
locationNoData center or region label
osNoOperating system
interfaceNoNetwork interface to monitor (default: eth0)

Response

{ "ok": true, "node_uuid": "a1b2c3d4-...", "api_key": "64-char-hex-api-key-for-this-node", "name": "web-prod-3", "ip": "203.0.113.10" }

The api_key in the response is the node's unique API key for sending data to Flowtriq. Use it to configure the agent on that server.

Step 3: One-Liner Auto-Deploy

Run this single command as root on any Linux server. It registers the node, installs ftagent, writes the config file, enables the systemd service, and starts monitoring, all in one shot:

# Full deploy: register + install + configure + enable + start bash -c 'R=$(curl -sf https://flowtriq.com/api/deploy \ -H "Authorization: Bearer $FLOWTRIQ_DEPLOY_TOKEN" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$(hostname)\",\"ip\":\"$(curl -s ifconfig.me)\"}") \ && eval $(echo "$R" | python3 -c "import sys,json;d=json.load(sys.stdin);print(\"API_KEY=\"+d[\"api_key\"]+\" NODE_UUID=\"+d[\"node_uuid\"])") \ && curl -sSL https://flowtriq.com/install.sh | bash -s -- --api-key "$API_KEY" --node-uuid "$NODE_UUID" -q \ && echo "Done - node registered and ftagent running"'

What this does, step by step:

  1. Calls the deploy API with the server's hostname and public IP to register the node
  2. Extracts the api_key and node_uuid from the API response
  3. Runs the install script, which installs ftagent, writes the config, installs the systemd service, and starts monitoring
Note: The install script handles PEP 668 (--break-system-packages) automatically on newer distros (Ubuntu 23.04+, Debian 12+, Fedora 38+). No manual flags needed.
Custom interface? If your server's primary interface isn't eth0, edit /etc/ftagent/config.json after deployment and restart: systemctl restart ftagent

Ansible Playbook

Deploy across your entire fleet with Ansible:

# deploy-flowtriq.yml - hosts: all vars: flowtriq_token: "{{ lookup('env', 'FLOWTRIQ_DEPLOY_TOKEN') }}" tasks: - name: Register node with Flowtriq uri: url: https://flowtriq.com/api/deploy method: POST headers: Authorization: "Bearer {{ flowtriq_token }}" Content-Type: application/json body_format: json body: name: "{{ inventory_hostname }}" ip: "{{ ansible_default_ipv4.address }}" os: "{{ ansible_distribution }} {{ ansible_distribution_version }}" location: "{{ datacenter | default('') }}" status_code: 200 register: flowtriq_result - name: Install ftagent # or use: shell: curl -sSL https://flowtriq.com/install.sh | bash pip: name: ftagent extra_args: --break-system-packages - name: Create config directory file: path: "{{ item }}" state: directory mode: '0755' loop: - /etc/ftagent - /var/lib/ftagent/pcaps - name: Write ftagent config copy: content: | {"api_key":"{{ flowtriq_result.json.api_key }}","api_base":"https://flowtriq.com/api/v1","node_uuid":"{{ flowtriq_result.json.node_uuid }}","interface":"eth0","pcap_path":"/var/lib/ftagent/pcaps"} dest: /etc/ftagent/config.json mode: '0600' - name: Install systemd service command: ftagent --install-service - name: Enable and start ftagent systemd: name: ftagent enabled: true state: started daemon_reload: true

Cloud-Init / User Data

Add this to your cloud-init or EC2/GCP user data to auto-register on boot:

#!/bin/bash # cloud-init / user-data script DEPLOY_TOKEN="your-deploy-token-here" # Register with Flowtriq and capture API key RESULT=$(curl -sf https://flowtriq.com/api/deploy \ -H "Authorization: Bearer $DEPLOY_TOKEN" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$(hostname)\",\"ip\":\"$(curl -s ifconfig.me)\",\"os\":\"$(lsb_release -ds 2>/dev/null || cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2 | tr -d '\"')\"}") API_KEY=$(echo "$RESULT" | python3 -c "import sys,json;print(json.load(sys.stdin)['api_key'])") NODE_UUID=$(echo "$RESULT" | python3 -c "import sys,json;print(json.load(sys.stdin)['node_uuid'])") # Install agent and write config (install.sh handles PEP 668 automatically) curl -sSL https://flowtriq.com/install.sh | bash -s -- -q mkdir -p /etc/ftagent /var/lib/ftagent/pcaps echo "{\"api_key\":\"$API_KEY\",\"api_base\":\"https://flowtriq.com/api/v1\",\"node_uuid\":\"$NODE_UUID\",\"interface\":\"eth0\",\"pcap_path\":\"/var/lib/ftagent/pcaps\"}" > /etc/ftagent/config.json chmod 600 /etc/ftagent/config.json # Install service, enable on boot, and start ftagent --install-service systemctl enable ftagent systemctl start ftagent

Bash Loop (Bulk Register)

Register multiple servers from a CSV or list:

#!/bin/bash # servers.txt: name,ip # web-prod-1,203.0.113.10 # web-prod-2,203.0.113.11 while IFS=, read -r name ip; do echo "Registering $name ($ip)..." curl -s https://flowtriq.com/api/deploy \ -H "Authorization: Bearer $FLOWTRIQ_DEPLOY_TOKEN" \ -H "Content-Type: application/json" \ -d "{\"name\":\"$name\",\"ip\":\"$ip\"}" | jq '{name:.name, api_key:.api_key}' done < servers.txt

Error Codes

HTTPErrorMeaning
401Invalid deploy tokenToken is wrong, revoked, or missing
400Node name / IP requiredMissing required fields
402Payment failedNo active subscription or payment issue
409Duplicate nameA node with that name already exists

Billing

  • During trial: Nodes created via deploy token are free. Billing starts when your trial ends and you subscribe.
  • Active subscription: Each new node is prorated and added to your current billing cycle immediately. If you're on monthly billing at $9.99/node, that's what each new node costs. If you're on annual at $7.99/node/month, the annual rate applies. Flow sources (sFlow/NetFlow/IPFIX) are billed separately from $19/source/month with volume discounts (1-2 sources $49, 3-10 $39, 11-20 $29, 20+ $19).
  • Promo codes: Any active discount on your Stripe subscription applies automatically to new nodes.
  • Removing nodes: Delete nodes from the dashboard to reduce your next invoice. Removals are prorated.

Terraform Provider

For infrastructure-as-code workflows, Flowtriq has an official Terraform provider. Manage nodes and notification channels declaratively:

# main.tf terraform { required_providers { flowtriq = { source = "flowtriq/flowtriq" version = "~> 0.1" } } } provider "flowtriq" { api_token = var.flowtriq_token } resource "flowtriq_node" "web" { name = "web-prod-01" ip_address = "203.0.113.10" location = "US-East" interface = "eth0" } resource "flowtriq_channel" "slack" { name = "NOC Slack" type = "slack" config = { webhook_url = var.slack_url } severity = ["high", "critical"] }

Available resources: flowtriq_node, flowtriq_channel. Data sources: flowtriq_nodes, flowtriq_workspace. Authentication uses the same deploy token as the REST API.

Revoking the Token

Go to Settings → Workspace and click Revoke. The token stops working immediately. You can generate a new one at any time. Revoking a token does not affect nodes that were already created with it.