Account
API Key
In v3, every form has its own API key. Open the form's General tab to copy it.
Each form, its own key
v2 had a single account-level API key shared across all forms. v3 gives each form a unique key, which lives in that form's General tab. The key cannot be rotated independently — deleting and recreating a form is the way to rotate.
Where to find it
- Open Forms from the sidebar.
- Click the form you want the key for.
- You'll land on the General tab. The API key is shown read-only with a copy button.
Where to use it
The API key is used in two places:
- URL suffix — POST submissions to
https://api.staticforms.dev/submit/<API_KEY>. - accessKey field — include a hidden form field named
accessKeyif you're using the legacyhttps://api.staticforms.dev/submitendpoint without the suffix.
The key is a public identifier, not a secret
Every embed snippet contains the API key — so the key appears in your page's HTML and is publicly visible. Static Forms uses domain restriction and captcha to prevent abuse, not the key itself. Don't try to keep the key secret; do configure security.
Rotating a key
Keys are immutable — there's no rotate button. If a key is exposed to abuse or you need a fresh key for any reason, the workflow is:
- Create a new form with the same settings.
- Update your HTML to use the new form's key.
- Delete the old form (its submissions go with it — export first if needed).
Related
- Forms → General — where the key is displayed.
- API Reference — full endpoint documentation.
- Forms → Security — protect the key with domain restriction and captcha.