> ## Documentation Index
> Fetch the complete documentation index at: https://docs.toktra.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Install the agent on one machine, open the dashboard, and see your first LLM usage event in under 10 minutes.

This guide walks you through getting your first device enrolled and your first usage event visible in the dashboard. The whole process takes under 10 minutes.

<Info>
  This quickstart covers a single test machine. To roll out Toktra across your full fleet, see [Agent deployment](/agent-deployment).
</Info>

<Steps>
  <Step title="Install the agent on one machine">
    Download and install the Toktra agent for your platform.

    <Tabs>
      <Tab title="macOS">
        Download the Toktra `.pkg` installer from the Toktra dashboard under **Settings → Downloads**.

        Open the installer and follow the prompts. The agent requires macOS 13 (Ventura) or later.

        After installation, the Toktra icon appears in your system tray. The agent automatically enrolls the device using a device certificate signed by Toktra's intermediate CA. Enrollment typically completes within 30 seconds.

        <Note>
          The installer deploys a Network Extension that requires user approval on first run. You'll see a system prompt asking you to allow the extension in **System Settings → Privacy & Security**. In a fleet deployment, you push a `.mobileconfig` profile via MDM to pre-approve the extension silently.
        </Note>
      </Tab>

      <Tab title="Windows">
        Download the Toktra `.msi` installer from the dashboard under **Settings → Downloads**.

        Run the installer as an administrator. It installs the WFP callout driver, the Toktra Windows Service, and the Edge browser extension. Windows 10 or later is required.

        The service starts automatically and enrolls the device on first run.

        <Note>
          The WFP driver is observation-only — it never blocks traffic. It observes outbound TLS connections to detect LLM provider hostnames.
        </Note>
      </Tab>

      <Tab title="Linux">
        Install the Toktra daemon using your distribution's package manager.

        ```bash theme={null}
        # Debian/Ubuntu
        sudo apt install toktra-agent

        # RHEL/CentOS/Fedora
        sudo dnf install toktra-agent
        ```

        The package installs and enables a systemd service. The daemon requires Linux kernel 5.10 or later with BTF (BPF Type Format) enabled.

        ```bash theme={null}
        # Verify the service is running
        systemctl status toktra-agent
        ```
      </Tab>
    </Tabs>
  </Step>

  <Step title="Open the dashboard">
    Navigate to your Toktra dashboard at `https://app.toktra.io` and sign in.

    On the **Overview** page, you'll see:

    * **Enrolled Devices** — the count of devices with active agent connections
    * **Active Users** — users seen in the last 30 days
    * **Total Tokens (30d)** — combined input and output token estimates across all providers
    * **Protected** — confirmation that monitoring is active

    Your newly enrolled device appears in **Devices** within about 60 seconds of installation.
  </Step>

  <Step title="Make an LLM request">
    On the enrolled machine, open any AI tool — `chat.openai.com`, `claude.ai`, the Copilot sidebar in VS Code, or any other supported provider — and send a message.

    The agent detects the outbound TLS connection using SNI inspection, estimates the token count, and transmits the event metadata to Toktra over mutual TLS.
  </Step>

  <Step title="See the data appear">
    Return to the dashboard. Within a few seconds you should see:

    * The **Total Tokens (30d)** counter increment on the Overview page
    * A new entry on the **Usage** page showing the provider, model, estimated token counts, and timestamp

    The dashboard updates in real time as events arrive.

    <Tip>
      If you don't see data after 30 seconds, check that the agent service is running and that the device is enrolled (green **Enrolled** status in the **Devices** page). On macOS, confirm the Network Extension is approved in **System Settings → Privacy & Security → Extensions**.
    </Tip>
  </Step>
</Steps>

## What's next

Now that you have a working agent, you're ready to roll out to your full fleet and configure governance.

<CardGroup cols={2}>
  <Card title="Deploy at scale" icon="server" href="/agent-deployment">
    Use MDM, Intune, SCCM, or package managers to deploy agents across hundreds or thousands of devices.
  </Card>

  <Card title="Set up policies" icon="shield" href="/concepts/policies-and-budgets">
    Create rules that alert or block based on usage thresholds, risk events, or department limits.
  </Card>

  <Card title="Configure budgets" icon="wallet" href="/concepts/policies-and-budgets">
    Set token or cost budgets at the org and department level with hard cap enforcement.
  </Card>

  <Card title="How it works" icon="workflow" href="/concepts/how-it-works">
    Understand the full data flow from device agent to dashboard.
  </Card>
</CardGroup>