Form backend API: receive form submissions without a server

A form backend API eliminates the need for server-side code to handle form submissions. Instead of writing PHP scripts, Node.js routes, or serverless functions, you point your HTML form at a hosted endpoint that receives, validates, and delivers the data.

This guide explains how form backend APIs work and how to integrate them with any website or application.

How a form backend API works

The flow is simple:

1. Your HTML form has an action attribute pointing to the form backend URL
2. The form includes a public access key to identify your form
3. When submitted, the browser sends a POST request to the endpoint
4. The service validates the data, runs spam checks, and delivers the submission

1
Browser → POST /submit → Form Backend → Email / Webhook / Sheets / Slack

Basic integration

Standard HTML form

1
<form action="https://api.formsfort.com/submit" method="POST">
2
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
3
  <input type="email" name="email" required />
4
  <textarea name="message" required></textarea>
5
  <button type="submit">Send</button>
6
</form>

The browser handles everything. No JavaScript required.

AJAX submission

For single-page applications or smoother UX:

1
const response = await fetch("https://api.formsfort.com/submit", {
2
  method: "POST",
3
  body: new FormData(formElement),
4
});
5

6
if (response.ok) {
7
  console.log("Submission received");
8
}

JSON submission

For API-first applications:

1
const response = await fetch("https://api.formsfort.com/submit", {
2
  method: "POST",
3
  headers: { "Content-Type": "application/json" },
4
  body: JSON.stringify({
5
    access_key: "YOUR_ACCESS_KEY",
6
    email: "[email protected]",
7
    message: "Hello from JSON",
8
  }),
9
});

Request format

Content types

Form backend APIs typically accept:

Required fields

All other fields are your form data. Name them whatever you need.

Special fields

Many form backends recognize special field names for configuration:

Response format

Success response

1
{
2
  "success": true,
3
  "requestId": "req_abc123",
4
  "message": "Submission received"
5
}

The requestId is useful for debugging delivery issues. Include it when contacting support.

Error response

1
{
2
  "success": false,
3
  "message": "Invalid access key",
4
  "code": "INVALID_ACCESS_KEY"
5
}

Common error codes:

Security model

Public access keys

The access key is intentionally public. It goes in your HTML source code where anyone can see it. Security is not based on key secrecy but on:

• Domain restriction: Only accept submissions from your website
• Rate limiting: Prevent abuse from a single IP
• Spam detection: Honeypot, CAPTCHA, content filtering
• Field validation: Server-side type and length checks

What to never include in frontend code

• API secrets or admin tokens
• OAuth tokens
• CAPTCHA secret keys
• Database credentials
• Private keys

These belong on a server, never in browser-accessible code.

CORS configuration

Form backend APIs set CORS headers to allow browser submissions. The Access-Control-Allow-Origin header is typically set to * (all origins) or restricted to your configured domains.

If you see CORS errors in the browser console:

1. Check that your domain is in the allowed domains list
2. Ensure the form backend URL is correct (including https://)
3. Check for browser extensions that block cross-origin requests

Webhook forwarding

Configure your form backend to forward submissions to your own endpoints:

1
POST https://your-server.com/webhook
2
{
3
  "name": "Ada Lovelace",
4
  "email": "[email protected]",
5
  "message": "Hello",
6
  "_metadata": {
7
    "requestId": "req_abc123",
8
    "submittedAt": "2026-05-28T14:32:00Z",
9
    "origin": "https://yoursite.com"
10
  }
11
}

Webhooks enable real-time integrations with CRMs, project management tools, custom databases, and automation platforms.

File uploads

For multipart submissions with files:

1
<form action="https://api.formsfort.com/submit" method="POST" enctype="multipart/form-data">
2
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
3
  <input type="file" name="attachment" accept=".pdf,.png,.jpg" />
4
  <button type="submit">Upload</button>
5
</form>

The form backend:

1. Validates the MIME type against allowed types
2. Checks the file size against configured limits
3. Scans the file for malware
4. Stores the file and includes a download link in the delivery

Rate limiting

Form backends enforce rate limits to prevent abuse:

When rate limited, the API returns a 429 Too Many Requests response. Implement retry logic with exponential backoff in AJAX handlers.

Testing your integration

Test with curl

1
curl -X POST https://api.formsfort.com/submit \
2
  -F "access_key=YOUR_ACCESS_KEY" \
3
  -F "[email protected]" \
4
  -F "message=Testing from curl"

Test with a form endpoint tester

Use the FormsFort Form Endpoint Tester to submit test data from the browser and inspect the response.

Verify delivery

After submitting, check:

1. Email inbox (including spam folder)
2. Webhook endpoint logs
3. Google Sheets for new rows
4. Slack/Discord/Telegram for notifications
5. Form backend delivery logs for the request ID

Summary

A form backend API receives HTML form submissions via HTTP POST, validates the data, runs spam checks, and delivers the submission to email, webhooks, spreadsheets, or messaging platforms. Integration requires only setting the form action to the endpoint URL and including a public access key. It works with any framework, any static site generator, and any HTTP client. No server-side code required.