# Fundamentals

> Start here: create your account, add your first site and learn how OpenWAF organizations, zones, roles and API tokens fit together.

OpenWAF is a web application firewall and authoritative DNS service run from the EU. You put a site behind the
OpenWAF edge by proxying its DNS records: visitors reach the edge nodes, which terminate TLS, apply the site's
rules and forward allowed requests to your origin server. Every change to the configuration is versioned, needs a
reason and can be rolled back.

These pages cover what every account shares: signing up, organizations and roles, zones and names, API tokens,
agency features and the limits of the service.

## Get started

- [Create an account](https://developers.openwaf.dev/fundamentals/create-account/): Sign up at dash.openwaf.dev with an email code, Google or GitHub.
- [Organizations, members and roles](https://developers.openwaf.dev/fundamentals/organizations-and-roles/): Who can do what, and how the effective role of a session or token is computed.
- [Add your first site](https://developers.openwaf.dev/fundamentals/add-site/): Add a domain, point it to OpenWAF and protect its first site end to end.
- [Proxied and DNS-only records](https://developers.openwaf.dev/fundamentals/proxied-and-dns-only/): Decide which names go through the edge and which only resolve.


## Concepts

- [How OpenWAF works](https://developers.openwaf.dev/fundamentals/how-openwaf-works/): The path of a request from the nameservers to your origin.
- [Zones, names and sites](https://developers.openwaf.dev/fundamentals/zones-names-and-sites/): The vocabulary used across the dashboard, API, CLI and MCP server.
- [API tokens](https://developers.openwaf.dev/fundamentals/api-tokens/): Roles, scopes, expiry and how tokens are checked on every request.


## For agencies and teams

- [Agencies and clients](https://developers.openwaf.dev/fundamentals/agencies-and-clients/): Group domains by end client and give each client limited access.
- [White-label dashboard](https://developers.openwaf.dev/fundamentals/white-label/): Your brand, your dashboard domain and your own nameservers.
- [Team members](https://developers.openwaf.dev/fundamentals/team-members/): Invite people, change roles and remove access.


## Reference

- [Limits and plans](https://developers.openwaf.dev/fundamentals/limits/): Early-access plan and the limits that apply to every account.
- [Glossary](https://developers.openwaf.dev/fundamentals/glossary/): Short definitions of the terms used in these docs.
- [Trust and security](https://developers.openwaf.dev/fundamentals/trust-and-security/): Where we run, security policy, DPA, sub-processors and how to report a vulnerability.