# Create a form and API key

What a FormsReach form is, where to copy the public API key, how to rotate it, and when to use multiple forms.

## What you will achieve

Understand what a **form** is in FormsReach, copy the correct **API key**, and know how to keep that key safer in production.

## Prerequisites

- A [FormsReach account](https://app.formsreach.com)

## What a form is

A **form** is one FormsReach endpoint configuration you own. Each form has:

- A unique public **API key** used on every submit
- Optional [allowed domains](/docs/submit-api/domains/)
- Optional [redirect URL](/docs/submit-api/redirect/) after success
- Channel settings (email, WhatsApp, Telegram, Discord, webhooks, Google Sheets)
- [Workflow rules](/docs/dashboard/workflow-rules/) and [submission history](/docs/dashboard/submissions/)

Create a new form when you need a separate endpoint, separate channels, or separate submission history (for example one form per client site).

## Steps

### 1. Create a form

1. Sign in at [app.formsreach.com](https://app.formsreach.com).
2. Create a form from the dashboard home or form switcher.
3. Open the new form so you see its overview.

### 2. Find the API key

Look for the key on:

- The form overview
- The integration / snippet panel (HTML, JavaScript, React, Vue snippets are pre-filled with this form's key)

Copy the key exactly. You will paste it into `api_key` (HTML) or your SDK init config.

### 3. Use the key on your site

For the HTML path, the key goes in a hidden field:

```html
<input type="hidden" name="api_key" value="YOUR_ACCESS_KEY" />
```

Full paste example: [Quickstart](/docs/getting-started/quickstart/).

## How to think about the API key

The API key is a **public form identifier** (similar to a publishable form ID). Anyone who can view your site HTML can see it. That is expected for browser-based contact forms.

Treat it like a publishable key, not a secret server password:

- Turn on a [domain allowlist](/docs/submit-api/domains/) for production hosts
- Add [spam protection](/docs/submit-api/spam/) so bots are less likely to burn credits
- Prefer separate forms for separate public sites so you can disable or rotate one without affecting others

## Rotate or replace a key

If a key is embedded somewhere you no longer control (old site, public gist, abandoned deploy):

1. Open the form in the dashboard.
2. Use the product control to **rotate** or regenerate the API key (wording may be Rotate / Regenerate in the UI).
3. Update every live form embed and snippet with the new key.
4. Re-test with [Test your form](/docs/getting-started/test-your-form/).

Until you update embeds, old HTML still posts with the previous key and will fail once that key is invalidated.

## Multiple forms

Use more than one form when:

- You run several websites or brands
- Different teams need different WhatsApp or email destinations
- You want separate analytics or submission lists

Do not reuse one key across unrelated production sites if you can avoid it - domain allowlists and channel settings are per form.

## Verify

You should be able to:

- Point to one form in the dashboard
- Copy one API key from that form
- Paste it into the Quickstart HTML and get a [first submission](/docs/getting-started/first-submission/)

## Common failures

| Symptom | What to check |
|---|---|
| Snippets work in docs but not on your site | You still have `YOUR_ACCESS_KEY` placeholder text |
| Submissions go to the wrong form | Key copied from a different form than the one you are viewing |
| Old site still submits after rotate | Deploy still has the previous key |

## Next

- [Quickstart](/docs/getting-started/quickstart/) - paste HTML and submit
- [Your first submission](/docs/getting-started/first-submission/) - confirm the dashboard row
- [Submit API overview](/docs/submit-api/overview/) - endpoint reference