Getting started

Create a form and API key

What a FormsReach form is, where to copy the public API key, how to rotate it, and when to use multiple forms.

What you will achieve

Understand what a form is in FormsReach, copy the correct API key, and know how to keep that key safer in production.

Prerequisites

What a form is

A form is one FormsReach endpoint configuration you own. Each form has:

Create a new form when you need a separate endpoint, separate channels, or separate submission history (for example one form per client site).

Steps

1. Create a form

  1. Sign in at app.formsreach.com.
  2. Create a form from the dashboard home or form switcher.
  3. Open the new form so you see its overview.

2. Find the API key

Look for the key on:

  • The form overview
  • The integration / snippet panel (HTML, JavaScript, React, Vue snippets are pre-filled with this form’s key)

Copy the key exactly. You will paste it into api_key (HTML) or your SDK init config.

3. Use the key on your site

For the HTML path, the key goes in a hidden field:

<input type="hidden" name="api_key" value="YOUR_ACCESS_KEY" />

Full paste example: Quickstart.

How to think about the API key

The API key is a public form identifier (similar to a publishable form ID). Anyone who can view your site HTML can see it. That is expected for browser-based contact forms.

Treat it like a publishable key, not a secret server password:

  • Turn on a domain allowlist for production hosts
  • Add spam protection so bots are less likely to burn credits
  • Prefer separate forms for separate public sites so you can disable or rotate one without affecting others

Rotate or replace a key

If a key is embedded somewhere you no longer control (old site, public gist, abandoned deploy):

  1. Open the form in the dashboard.
  2. Use the product control to rotate or regenerate the API key (wording may be Rotate / Regenerate in the UI).
  3. Update every live form embed and snippet with the new key.
  4. Re-test with Test your form.

Until you update embeds, old HTML still posts with the previous key and will fail once that key is invalidated.

Multiple forms

Use more than one form when:

  • You run several websites or brands
  • Different teams need different WhatsApp or email destinations
  • You want separate analytics or submission lists

Do not reuse one key across unrelated production sites if you can avoid it - domain allowlists and channel settings are per form.

Verify

You should be able to:

  • Point to one form in the dashboard
  • Copy one API key from that form
  • Paste it into the Quickstart HTML and get a first submission

Common failures

Symptom What to check
Snippets work in docs but not on your site You still have YOUR_ACCESS_KEY placeholder text
Submissions go to the wrong form Key copied from a different form than the one you are viewing
Old site still submits after rotate Deploy still has the previous key

Next

Previous
Next