Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.toktra.dev/llms.txt

Use this file to discover all available pages before exploring further.

This guide walks you through getting your first device enrolled and your first usage event visible in the dashboard. The whole process takes under 10 minutes.
This quickstart covers a single test machine. To roll out Toktra across your full fleet, see Agent deployment.
1

Install the agent on one machine

Download and install the Toktra agent for your platform.
Download the Toktra .pkg installer from the Toktra dashboard under Settings → Downloads.Open the installer and follow the prompts. The agent requires macOS 13 (Ventura) or later.After installation, the Toktra icon appears in your system tray. The agent automatically enrolls the device using a device certificate signed by Toktra’s intermediate CA. Enrollment typically completes within 30 seconds.
The installer deploys a Network Extension that requires user approval on first run. You’ll see a system prompt asking you to allow the extension in System Settings → Privacy & Security. In a fleet deployment, you push a .mobileconfig profile via MDM to pre-approve the extension silently.
2

Open the dashboard

Navigate to your Toktra dashboard at https://app.toktra.io and sign in.On the Overview page, you’ll see:
  • Enrolled Devices — the count of devices with active agent connections
  • Active Users — users seen in the last 30 days
  • Total Tokens (30d) — combined input and output token estimates across all providers
  • Protected — confirmation that monitoring is active
Your newly enrolled device appears in Devices within about 60 seconds of installation.
3

Make an LLM request

On the enrolled machine, open any AI tool — chat.openai.com, claude.ai, the Copilot sidebar in VS Code, or any other supported provider — and send a message.The agent detects the outbound TLS connection using SNI inspection, estimates the token count, and transmits the event metadata to Toktra over mutual TLS.
4

See the data appear

Return to the dashboard. Within a few seconds you should see:
  • The Total Tokens (30d) counter increment on the Overview page
  • A new entry on the Usage page showing the provider, model, estimated token counts, and timestamp
The dashboard updates in real time as events arrive.
If you don’t see data after 30 seconds, check that the agent service is running and that the device is enrolled (green Enrolled status in the Devices page). On macOS, confirm the Network Extension is approved in System Settings → Privacy & Security → Extensions.

​
What’s next

Now that you have a working agent, you’re ready to roll out to your full fleet and configure governance.

Deploy at scale

Use MDM, Intune, SCCM, or package managers to deploy agents across hundreds or thousands of devices.

Set up policies

Create rules that alert or block based on usage thresholds, risk events, or department limits.

Configure budgets

Set token or cost budgets at the org and department level with hard cap enforcement.

How it works

Understand the full data flow from device agent to dashboard.