# Submit API overview

Public FormsReach submit endpoint - URL, authentication via api_key, content types, and response shape.

## Endpoint

```
POST https://api.formsreach.com/submit
```

This host rewrites to the app’s public submit route (`/api/v1/submit`). Use the public URL above in production snippets.

## Authentication

Include your form API key as field **`api_key`** in the body (JSON, urlencoded, or multipart). No Bearer token is required for public website forms.

## Content types

| Content-Type | Use |
|---|---|
| `application/x-www-form-urlencoded` | Classic HTML forms |
| `multipart/form-data` | HTML forms with [file uploads](/docs/submit-api/file-uploads/) |
| `application/json` | SPAs, mobile, server-to-server |

## Field rules

- **`api_key`** - required
- Any other field names are accepted as submission data (subject to max field limits)
- Reserved spam fields: `_gotcha`, `_ts` - see [Spam protection](/docs/submit-api/spam/)
- File fields use multipart only

## Success and errors

Successful accepts return success envelope (JSON) or redirect/HTML for browsers.

Typical problem codes include validation failures, inactive form, domain denied, rate limits, and insufficient credits.

For the full machine-readable API surface (including authenticated dashboard routes), use the [OpenAPI explorer](https://app.formsreach.com/api/docs).

## Guides in this section

- [HTML form POST](/docs/submit-api/html/)
- [Programmatic submit (JS SDK)](/docs/submit-api/json/)
- [File uploads](/docs/submit-api/file-uploads/)
- [Redirect and thank-you](/docs/submit-api/redirect/)
- [Domain allowlist](/docs/submit-api/domains/)
- [Spam and honeypot](/docs/submit-api/spam/)