Documentation

Getting started

1. Create an account

   Sign up with your email address and sign in. No credit card is needed for the Free plan.

2. Create a form

   In the dashboard, create a form and set the notification email, the address that receives each submission.

3. Copy the endpoint

   The form's detail page shows its endpoint URL and a ready-made HTML snippet. Every form has its own key, so you can use different forms for different pages or sites.

4. Add the HTML form

   Paste the snippet into your page (see the example below), or point an existing form's action attribute at the endpoint.

5. Submit a test

   Send a test submission from your live page. It appears under Submissions in the dashboard and arrives in your notification inbox.

Your endpoint

Each form accepts submissions at one URL:

Replace YOUR_FORM_KEY with your form's public key from the dashboard. Three content types are accepted:

• application/x-www-form-urlencoded, what a normal HTML form sends
• multipart/form-data, also what a normal HTML form sends (file parts are ignored, see below)
• application/json, for JavaScript fetch calls

The endpoint sends CORS headers (Access-Control-Allow-Origin: *), so forms on any domain can post to it.

Copy-paste HTML example

A complete, working contact form. Replace YOUR_FORM_KEY with your own key and drop it into any HTML page:

<form action="https://form-backend-tool.vercel.app/api/forms/YOUR_FORM_KEY" method="POST">
  <label>Your name <input type="text" name="name" required></label>
  <label>Your email <input type="email" name="email" required></label>
  <label>Message <textarea name="message" required></textarea></label>

  <!-- Optional: after a successful submit, send the visitor to your own page.
       Must be an absolute http:// or https:// URL. -->
  <input type="hidden" name="_redirect" value="https://your-site.example/thanks">

  <!-- Honeypot: leave this empty and hidden. People never see it;
       bots fill it in, and those submissions are flagged as spam. -->
  <input type="text" name="_honey" style="display:none" tabindex="-1" autocomplete="off">

  <button type="submit">Send</button>
</form>

Using another stack

HTML is the simplest route, not the only one. The endpoint accepts standard form posts and JSON from any technology that can send an HTTP POST request, React, Next.js, Vue, PHP, Python, WordPress, Laravel, Django, Flask, Node.js, and others. There is no SDK to install and nothing stack-specific to configure: every stack posts the same fields to the same endpoint.

From JavaScript (React, Next.js, Vue, or a plain page):

await fetch("https://form-backend-tool.vercel.app/api/forms/YOUR_FORM_KEY", {
  method: "POST",
  headers: { "Content-Type": "application/json", Accept: "application/json" },
  body: JSON.stringify({
    name: "Ada",
    email: "ada@example.com",
    message: "Hello from my app",
  }),
});

From a server or a CMS (PHP, Python, Laravel, Django, Flask, WordPress): send the same fields as a form post (application/x-www-form-urlencoded) or JSON, from your form handler, a webhook setting, or your form tool's POST action, using whatever your stack already uses to make an HTTP request.

Fields

• Any field names work. Whatever you name your inputs (name, email, phone, company, …) is stored exactly as named and shown in the dashboard and the notification email. There is no required schema, a form with only a message field is fine.
• Repeated names (e.g. several checkboxes with the same name) are stored as a list of values.
• Up to 50 fields per submission; field names up to 100 characters; values up to 5,000 characters each. Longer values are truncated.
• Empty fields are dropped. A submission where every field is empty is rejected with a 400 error.
• Two control fields are recognised and never stored as submission data: _honey (honeypot) and _redirect (success redirect).

Spam protection (honeypot)

Include the _honey input from the example, hidden with display:none. Real visitors never see or fill it; automated bots typically fill every field. When _honey arrives filled in:

• The submitter still sees a normal success response, bots are not tipped off.
• The submission is stored flagged as spam (visible under the Spam filter in the dashboard, for audit).
• No notification email is sent.
• Spam does not count against your monthly quota.

On top of the honeypot, each form is rate-limited per visitor, which slows down submission floods (see Limits).

Redirects & success behaviour

• Add a hidden _redirect field with an absolute http:// or https:// URL, and a successful submit answers with a 303 redirect to that page, ideal for your own thank-you page. Invalid or relative values are ignored.
• Without _redirect: if the request accepts JSON (e.g. a fetch call with Accept: application/json), the response is { "ok": true, "message": "Submission received." }. A plain browser form post gets a simple built-in thank-you page with status 200.
• Errors follow the same split: JSON { "ok": false, "error": "…" } for JSON callers, a small HTML error page for browser posts. Status codes are listed in the error reference.

Dashboard & CSV export

Every stored submission is listed in the dashboard, grouped by form, with All / Unread / Spam filters. You can open a submission to see every field, mark it read or unread, and delete it. Each form's submissions can be downloaded as a CSV (from the form's page) for use in a spreadsheet. The overview shows this month's usage against your plan limit.

Limits

• Monthly quota: 250 non-spam submissions per form per calendar month on the Free plan. Beyond that, submissions are rejected with 429 until the next month.
• Rate limit: 10 submissions per 60 seconds per form per visitor (by default). Beyond that: 429, retry after a short wait.
• Payload size: at most 25 KB per submission (by default). Beyond that: 413.
• Fields: at most 50 fields, names ≤ 100 characters, values ≤ 5,000 characters.

Error reference

• 400Invalid submission data. / Submission is empty.

  The body could not be parsed, or every field was empty after cleaning.

• 403This form is not accepting submissions.

  The form exists but is paused/disabled in the dashboard.

• 404Form not found.

  The key in the URL is invalid or no form has that key. Check for typos.

• 405Method not allowed. Use POST.

  The endpoint was called with GET or another method instead of POST.

• 413Submission is too large.

  The submission exceeded the payload limit (25 KB by default).

• 415Unsupported content type.

  Use application/x-www-form-urlencoded, multipart/form-data or application/json.

• 429Too many submissions. Please try again later.

  Rate limit hit: too many submissions from one visitor in a short window (10 per 60 seconds by default).

• 429This form has reached its monthly submission limit.

  The form's monthly quota (250 on the Free plan) is used up. It resets on the 1st of the next month.

• 500Could not process submission. / Could not store submission.

  A server-side problem on our side. The submission was not stored; ask the visitor to retry.

• 503Form service is not configured yet.

  This deployment's backend is not fully configured. (You should not see this on the hosted service.)

Security guidance

• Your form key is public by design. It appears in your page's HTML, like any form action URL. It only lets people submit to that one form, it cannot read submissions or change settings.
• Reading submissions always requires your account. The dashboard and API check your sign-in session, and one account can never see another account's forms or submissions.
• Never put account credentials in a web page. You do not need any API key or password in your site's code, the form key is the only thing a page needs.
• Visitor privacy: raw IP addresses are never stored, only a one-way hash used for rate limiting and abuse checks.

WhatsApp notifications (optional)

• What it is: in addition to email, a form can send each new submission as a WhatsApp template message via the official Meta WhatsApp Cloud API. It is an optional extra channel, email and the dashboard always keep working, and a WhatsApp failure never affects a submission.
• Per-form setting: in the dashboard, open your form's Settings, tick “Also send new submissions to my WhatsApp” and save your number in international format (country code + number, digits only). Spam submissions never trigger a WhatsApp message.
• Operator setup required: WhatsApp delivery is configured by the service operator with their own Meta WhatsApp Cloud API setup, a Meta developer app, a WhatsApp Business account and number, a permanent access token, and an approved message template. Until the operator completes that setup, the channel stays off (the dashboard form view shows its status) and nothing is sent over WhatsApp. It is not a self-serve feature you can switch on from your account alone.

Not supported in this version

• File uploads, file inputs are ignored; only text values are stored.
• Webhooks, submissions are delivered by email and the dashboard (plus WhatsApp where the operator has configured it, see above).
• Autoresponder emails, submitters do not receive an automatic reply email.
• Paid plans / billing, paid plans are bought from the Billing page in the dashboard; payments are processed by Paddle as merchant of record; see pricing.

Still need help?

If this page does not answer your question, visit the support page for the contact channels. The founder answers support himself.