Forms API security: what we do and what we do not claim

We store API keys, fill tokens, sign-in links and IP addresses only as hashes. We block forms that ask for secrets. We limit every public endpoint. We fail closed when a limit check breaks. We sign webhooks. We claim no audits or certifications. This page lists what is true today.

Accounts and sign-in

• No passwords. You sign in with an email link. It works once, for 15 minutes.
• Hashed tokens. Link tokens and session ids are stored as hashes.
• Sessions use a signed cookie that page scripts cannot read. A session lasts 30 days.
• Cross-site writes are refused for cookie sessions. Scripts use an API key.
• Bad keys are throttled. Repeated failed key checks from one address are rate limited.

API keys

• A key is afk_ plus 32 characters.
• We store a SHA-256 hash and the first 8 characters. We cannot show the key again.
• Rotate a key in the dashboard settings.
• Send it only in the Authorization header. See Authentication.

Forms and abuse

• Blocked fields. We reject field ids, labels and help text that mention passwords, passcodes, PINs, CVV or CVC, card numbers, IBANs, seed or recovery phrases, private keys, 2FA, one-time codes, OTP, social security, SSN, passports or national ID numbers (including Personalausweis, Aadhaar, Steuer-ID and NIN). See Forms and fields.
• No custom code. Forms cannot hold HTML or JavaScript.
• No redirect after submit on the free plan.
• Report abuse. Every public form has a report link. See Acceptable use.
• Spam protection. Cloudflare Turnstile checks sign-up, form submits, fill code creation and the abuse report form.

Agent fill

• A fill token is the only credential an agent gets. It is for one form.
• It lasts 60 minutes and one successful submit. It allows 5 POST attempts. It is stored as a hash.
• Token creation is limited per IP address and per form. See Rate limits and quotas.
• The paste-back path never submits for the person.
• Agent answers pass the same checks as human answers.

Webhooks

• Each call carries an HMAC-SHA256 signature over the timestamp and the raw body. See Webhooks.
• URLs must use https:// and point to a public host. Private and reserved addresses are refused.
• We do not follow redirects. A call times out after 5 seconds and is tried once more.
• We show the signing secret once. The API never returns it again.

Limits fail closed

Every public endpoint has a limit. If we cannot check a limit in production, we refuse the request with 503 rate_limiter_unavailable.

Data we keep

Backups follow our database host's retention. Deleted data can stay in a backup until the host removes it. See the privacy policy.

Where the data lives

We serve the site over HTTPS. We add no field-level encryption of our own to forms, responses or webhook secrets. The database host protects stored data under its own terms.

What we do not claim, and how to report

We claim no audit, penetration test, certification, uptime promise or compliance regime. If that changes, we will say so here with evidence. Email hello@aiformapi.com for security reports, abuse reports and support.