Features
Everything quickforms does
Every feature, grouped by what it is for. Each one links to its page in the docs, with the requests, settings and responses.
Endpoint and embed
One URL for every form
Post plain HTML or JSON to the endpoint, or drop in the embed script and let it render the form from its schema.
Submit endpoint
POST /f/{form} takes HTML form posts and JSON. HTML posts get a redirect or a thank-you page, JSON clients get JSON.
Embed widget
One script tag renders every field type, posts with fetch and fires quickforms:success and quickforms:error events.
Iframe embed
Every form has an embed page you can frame instead of using the script.
Public schema
GET /f/{form}/schema.json returns the published fields, so your own code can render the form.
CORS and redirects
Allowed origins per form, and _redirect only to hosts the form trusts.
Hosted forms
No website needed
Every form has its own page. Share it as it is, or send each person their own link.
Hosted form page
Classic, steps or compact layouts, light, dark or automatic, with your accent colour, font, corners, background, intro and logo.
Draft previews
Open the hosted page with ?sandbox= to preview a draft before you publish it.
Personal links
One link per person, or up to 500 at once, with prefilled answers, your own metadata, a use limit and an expiry.
Links-only forms
Only accept submissions through personal links. Used links say so, and custom forms get a 409 link_used.
Schemas and validation
Describe it, pick a template, or write the schema
Every field becomes a server-side validation rule, so bad input never reaches your inbox, webhook or destinations.
AI form builder
Describe a form in plain English and get fields, smart rules, a success message and an autoresponder to review.
Templates
Ready-made starting points such as contact, quote request, newsletter, event RSVP and job application.
Thirteen field types
text, textarea, email, url, tel, number, date, select, radio, checkbox, checkboxes, hidden and file.
Validation
Server-side rules with 422 errors keyed by field, and custom messages shown inline on the hosted page and in the embed.
Drafts and forms as code
Change forms safely
Work on a draft while live submissions keep the published version, or keep your forms in a file next to your code.
Drafts and publishing
Save changes as a draft, test them in sandbox mode, then publish or discard them.
quickforms.json
Describe forms and their destinations in one file, keyed by a stable name, with ${ENV} values for secrets.
CLI
init, validate, deploy and pull, with dry runs, drafts and pruning of destinations that left the file.
GitHub Action
Validate or deploy your forms from a workflow.
Netlify build plugin
Deploy your forms as part of a Netlify build.
Spam and security
Layers between bots and your inbox
Each layer catches what the one before it missed. Anything flagged is stored for review, and its deliveries are held until you release it.
Rate limiting
Submissions are limited per form and IP address, with a clear 429 for anyone sending too many.
Honeypots
A hidden main honeypot plus up to five extra ones with realistic names. Bots that fill them in are dropped.
Cloudflare Turnstile
Require a Turnstile token on live submissions, checked server-side with your own site key and secret key.
Altcha
A proof-of-work challenge served by quickforms itself, with no third-party service.
AI spam classification
Every submission is classified before anything is sent. Spam is kept for review and its deliveries are held.
Smart rules
Plain-English rules per form, such as "Must be about bike fitting". Submissions that break them are held too.
Geo filters
Allow or block countries, and choose what happens when the country is unknown.
Disposable email blocking
Hold submissions that use a throwaway email domain.
Partial submissions
See where people stop
Off by default. When it is on, the embed and the hosted page save answers as people type, and quickforms builds a completion funnel from them.
Partial submissions
Progress is saved while people fill the form in and linked to the submission when they finish. Partials are never validated or delivered.
Completion funnel
Started, completed and abandoned counts, and the field people were on when they stopped.
Partials API
List, read and delete partial submissions over the API, or read the funnel from MCP.
Files and uploads
Files, straight to storage
Post files as multipart, or upload them straight to storage with a pre-signed URL. Type and size rules apply per field.
Multipart uploads
Plain HTML forms post files with the rest of the form.
Direct uploads
Ask for a pre-signed URL, PUT the file to storage, then submit the upload ID. The embed and hosted page do it for you when storage supports it.
Signed download links
Files are shared in emails, webhooks, the API and exports through signed links that expire.
Email through the provider you already use
Notify your team, reply to the sender and confirm addresses, through your own provider or the platform mailer.
Notification email
Every answer, to the addresses you choose or the team owner.
Bring your own provider
Resend, Postmark, Mailgun, Amazon SES, SMTP or Mailchimp Transactional. Credentials are encrypted at rest.
Subject variables
Put answers and submission details in the notification subject with placeholders.
Reply-to
Choose which field replies go to, or turn reply-to off.
Autoresponder
An optional reply to the person who submitted, with {{field}} placeholders.
Routing rules
Send the notification to different people, or redirect to a different page, based on the answers.
Double opt-in
Send a confirmation email first and hold every other email and webhook until the person confirms.
Webhooks and destinations
Send every submission where it needs to go
Signed webhooks, ready-made destinations and REST hooks, each retried and logged.
Signed webhooks
A timestamped HMAC SHA-256 signature on every webhook, so you can prove it came from quickforms.
Retries and delivery log
Retries after 10s, 1m, 5m, 30m, 2h and 6h, with every attempt logged and redelivery on demand.
Destinations
Slack, Discord, any HTTP endpoint, HubSpot, Attio, Customer.io and Google Sheets.
Mapping and conditions
Map fields with placeholders, and only send when conditions on the answers match.
Destination preview
See what a destination would send, with secrets redacted, without sending anything.
Google Sheets
Add a row to a spreadsheet for every submission, with a service account.
Zapier and n8n hooks
REST hook subscriptions and a sample event endpoint, plus a Zapier app in the repository.
Exports
Download submissions as CSV, JSON or NDJSON, from the dashboard or the API, with filters.
Private address protection
Webhook and destination URLs that resolve to private or reserved addresses are refused.
Tracking and analytics
Know where submissions come from
Attribution is stored with each submission, and form analytics are counted without cookies.
UTM and ad click IDs
UTM parameters, gclid, gbraid, wbraid, fbclid, msclkid, ttclid, twclid, li_fat_id, rdt_cid, the referrer and the landing page.
Tracking script
quickforms-track.js keeps first and last touch attribution across pages in localStorage. No cookies.
Server-side proxy mode
Post from your own server with a team API key and pass the visitor's IP, user agent and country.
Cookie-free analytics
Views, unique visitors, starts, submissions, conversion rate and top sources, without cookies or stored IP addresses.
Payments
Take payment before you accept the submission
Payments go to your own Stripe account. quickforms checks each one with Stripe on the server before it stores the submission.
Stripe, your keys
Your own publishable and secret keys per form. The secret key is write-only.
Fixed or answer-based prices
A fixed amount, or a price worked out from the answers.
Card errors on the form
The hosted page and embed show Stripe's Payment Element above the submit button, so card errors show before anything is sent.
Checked before it is stored
The PaymentIntent must belong to the form, have gone through, and match the amount and currency. Each one pays for one submission.
Sandbox skips payment
Sandbox submissions skip the payment step, so you can test a paid form without paying.
Sandbox, API and teams
Same powers in the dashboard, the API and your agent
Test without sending anything, then drive everything from the dashboard, the REST API or an MCP client.
Sandbox mode
Submissions are validated and stored, nothing is sent, and you see exactly what would have gone out.
REST API
Forms, links, submissions, deliveries, destinations, partials, analytics, exports, hooks and mail providers over /api/v1.
MCP server
The same API key connects an MCP client, with tools for forms, links, submissions, deliveries, destinations, partials and analytics.
Teams
Forms, mail providers and API keys belong to a team. Invite people to work on them with you.
API keys
Team-scoped API keys, shown once, with last used times and revoke.
Try it in sandbox mode
Create a form, send a test with the X-Quickforms-Sandbox header, and see what would have been delivered.