A form backend receives what a visitor types in a form on your website. It saves the text. It sends you an email. You do not need a server. You do not write code.
What it is
You make a form backend in the dashboard. You get an access key. You paste the key into an HTML form on your site.
A visitor fills in the form and presses Send. The text goes to our server. We save it as a response in your account. We send you an email.
Open the dashboard to make one. It counts as one of your open forms.
The HTML to add
Add these 4 lines to a form on your site.
<form action="https://aiformapi.com/submit" method="POST">
<input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
<input type="text" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">
...your own fields...
</form>Replace YOUR_ACCESS_KEY with the key from the dashboard. Put your own fields in place of the dots. This is a full form:
<form action="https://aiformapi.com/submit" method="POST">
<input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
<input type="text" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">
<input type="text" name="name" required>
<input type="email" name="email" required>
<textarea name="message" required></textarea>
<button type="submit">Send</button>
</form>The name of each field can be any word. We save every field you send. The dashboard shows the names as columns.
What happens to a submission
- We check the access key.
- We check the size and the field names.
- We save the submission as a response in your account.
- We send you an email with the fields as plain text. The email goes to the address you used to sign in. It goes only to that address.
- The visitor sees a thank-you page that we host.
You can turn the email off in the form's settings. You can read every submission in the dashboard. You can also get them as JSON or CSV, or by webhook. See Responses.
A script can send JSON instead of a form. It gets a JSON answer. See the form backend reference.
Limits of the free plan
| Limit | Free plan |
|---|---|
| Open forms in your account | 3 (a form backend counts as one) |
| Responses a month, all forms together | 100 |
| Submissions from one visitor | 5 a minute and 30 an hour |
| Submissions to one form | 60 a minute |
| Size of one submission | 64 KB |
| Fields in one submission | 50 |
| Length of a field name | 100 characters |
| Length of a field value | 5,000 characters |
| Files | None. Text only |
A submission that is stored counts as a response. A submission that is refused does not count. After 100 responses in a calendar month (UTC), new submissions are refused until the next month. See rate limits and quotas.
What it never accepts
A form backend refuses a submission when a field name asks for a secret. We read the name of the field. We do not read what the visitor types.
These names are blocked: password, passcode, PIN, CVV, CVC, card number, credit card, IBAN, seed phrase, recovery phrase, private key, 2FA, one-time code, OTP, social security number, SSN, passport, national ID number, Aadhaar, NIN, and the German words Passwort, Kreditkarte, Reisepass, Personalausweis and Steuer-ID.
Do not ask a visitor for a password, a card number or an ID number. See acceptable use.
How spam is handled
The field botcheck is a trap. A person cannot see it. A bot often fills in every field. When botcheck has a value, we drop the message. We answer as if it worked, so the bot learns nothing.
We also limit how often one visitor can send. No tool stops all spam.
Questions
Is the access key a secret?
No. It sits in the HTML of your page, so anyone can see it. It can only add submissions. Each submission goes to your own email and your own dashboard. It cannot read anything.
Can I send the email to another address?
No. The email goes only to the address you used to sign in. A website cannot change it. A visitor cannot change it. You cannot set another address.
Where does the visitor go after pressing Send?
To a thank-you page that we host. The free plan has no redirect to another page. A script that sends JSON gets a JSON answer.
Can a visitor upload a file?
No. The form backend takes text only. A file is refused.
What happens after 100 submissions in a month?
New submissions are refused with 403 quota_exceeded until the next calendar month (UTC). The 100 responses are shared by all your forms. Old submissions stay readable.
What stops spam?
A hidden field named botcheck. A bot fills it in and we drop the message. Limits on how often one visitor can send also apply. No tool stops all spam.