# Test your form

Test a FormsReach form before go-live - local HTML, staging hosts, domain allowlist, and dashboard verification.

## What you will achieve

A short checklist to prove submit works before you put the form on a production page - and again after every domain or key change.

## Prerequisites

- A form and API key ([Create a form and API key](/docs/getting-started/create-form-api-key/))
- The [Quickstart](/docs/getting-started/quickstart/) HTML (or equivalent) on a page you control

## Why test

- Catch wrong keys and missing `name` attributes before real visitors submit
- Confirm [domain allowlist](/docs/submit-api/domains/) includes every host you actually use
- Avoid noisy WhatsApp traffic while you are still wiring the form

## Steps

### 1. Start with dashboard-only success

1. Disable or skip WhatsApp until the HTML path works (WhatsApp is available on Pro/Agency and costs credits per send).
2. Email is optional for the first tests - a **Submissions** row is the source of truth.
3. Submit once with unique text in `message` (for example `test-2026-07-28-a`).

### 2. Use a simple host you control

Good early hosts:

- A static HTML file on a staging URL
- Your site's preview deploy
- A CMS draft page that still posts from a real browser origin

Open the page over the same kind of URL you will use later (prefer HTTPS for staging and production).

### 3. Watch the network request

1. Open browser DevTools → **Network**.
2. Submit the form.
3. Select the request to `https://api.formsreach.com/submit`.
4. Confirm method `POST` and a non-network-error response.

If the request never leaves the browser, fix the form `action` or page JavaScript before debugging FormsReach.

### 4. Confirm the Submissions row

1. Open the form in [app.formsreach.com](https://app.formsreach.com).
2. Open **Submissions**.
3. Find the unique test message.

No row means the submit was not accepted (or you are on the wrong form). Use [Your first submission](/docs/getting-started/first-submission/).

### 5. Align domain allowlist with real hosts

Your `api_key` is public. When the allowlist is enabled, FormsReach checks the request Origin/Referer host against hosts you configured for that form.

Before go-live:

1. List every production host (include both apex and `www` if both serve the form).
2. List every preview or staging host you intentionally test from.
3. Submit again from each host you listed.
4. Prefer HTTPS sites.

If a host is missing, you get a domain denied style error. Details: [Domain allowlist](/docs/submit-api/domains/).

### 6. Keep spam fields empty for humans

If you added [honeypot / time trap](/docs/submit-api/spam/) fields:

- Leave the honeypot empty (real users never see it)
- Do not bot-fill spam fields in automated tests unless you intend to create a spam classification

### 7. Add channels only after store works

1. Enable [Email](/docs/channels/email/) and send a test submission.
2. On Pro/Agency, add [WhatsApp](/docs/channels/whatsapp/) and verify destination numbers before relying on it.
3. Treat channel delivery as a second checklist after the Submissions row exists.

## Verify matrix

| Result | Meaning | What to do |
|---|---|---|
| Row in Submissions | Submit path accepted | Safe to harden domains/spam and enable channels |
| HTTP error, no row | Rejected or failed request | Read error body; check key, domain, credits |
| Row exists, no email/WhatsApp | Channel not delivering | Fix channel config and credits - form HTML may be fine |
| Works on staging, fails on production | Host allowlist gap | Add production host (and `www` if needed) |

## Common failures

| Symptom | What to check |
|---|---|
| Works in dashboard preview but not on site | Different host - add site host to allowlist |
| Intermittent domain errors | Some pages on `www`, some on apex - allow both |
| Duplicate test noise on WhatsApp | Test with dashboard + email first |
| Spam-looking rows | Honeypot filled or automated fill too fast - see [Spam](/docs/submit-api/spam/) |

## Next

- [Next steps](/docs/getting-started/next-steps/) - production checklist after a green test
- [Domain allowlist](/docs/submit-api/domains/)
- [Spam and honeypot](/docs/submit-api/spam/)
- [Email channel](/docs/channels/email/)