Account

API Key

In v3, every form has its own API key. Open the form's General tab to copy it.

Each form, its own key

v2 had a single account-level API key shared across all forms. v3 gives each form a unique key, which lives in that form's General tab. Workspace owners and admins can rotate that key independently when it needs to change.

Where to find it

Open Forms from the sidebar.
Click the form you want the key for.
You'll land on the General tab. The API key is shown read-only with a copy button.

Where to use it

The API key is used in two places:

URL suffix — POST submissions to https://api.staticforms.dev/submit/<API_KEY>.
accessKey field — include a hidden form field named accessKey if you're using the legacy https://api.staticforms.dev/submit endpoint without the suffix.

The key is a public identifier, not a secret

Every embed snippet contains the API key — so the key appears in your page's HTML and is publicly visible. Static Forms uses domain restriction and captcha to prevent abuse, not the key itself. Don't try to keep the key secret; do configure security.

Connecting an agent

Your public submission key cannot read submissions or manage your form. For ChatGPT, Claude or another compatible MCP client, open Agent access from the main sidebar below Account, choose a workspace and follow the OAuth setup guide. OAuth never asks you to select forms. Agent access is available on paid Starter, Pro and Agency workspaces. Free and trial tiers cannot use agent access.

Rotating a key

Rotate a form's key from its General settings, or ask an agent connected through workspace OAuth as an owner or admin with Manage forms to prepare the rotation. Form-scoped manual credentials cannot rotate keys. Review and confirm the exact form before applying it. The replacement key is returned in the successful result and remains visible in authorized form reads. The old key stops accepting submissions immediately. The safe workflow is:

Prepare the rotation and verify the form name and current key preview.
Confirm the rotation and copy the replacement key.
Update every deployed form or embed to use the replacement before accepting new traffic.

Rotation invalidates the old key

Requests using the previous key fail as soon as rotation succeeds. Keep the confirmation and deployment close together so visitors do not submit through stale HTML.