What is a form endpoint?

The action URL, explained

The form endpoint is the value of the form's action attribute. Here is the smallest form that uses the Static Forms endpoint:

<form action="https://api.staticforms.dev/submit" method="POST">
  <input type="hidden" name="apiKey" value="YOUR_API_KEY">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

action="https://api.staticforms.dev/submit"

The endpoint. It tells the browser where to send the submission when the visitor presses Submit.

method="POST"

Sends the fields in the request body instead of the URL, which is what a form submission needs.

name="apiKey"

Tells Static Forms which form the submission belongs to, and so where to deliver it.

name="email", name="message"

Your own fields. Name them as you like; they arrive with the submission.

An endpoint is one part of a form backend: the address, with the spam checks and delivery behind it. The API reference lists every field and response.

Is it safe to expose the endpoint and API key in HTML?

Yes, with the right expectations. A form that runs in the browser has to include its endpoint, so the endpoint cannot be a secret. What matters is what it lets a stranger do.

The endpoint is public by design

Anyone can read a form's HTML, so the action URL is visible to every visitor. Nothing is hidden by keeping it out of the page.

The apiKey is an address, not a password

On Static Forms the apiKey identifies your form and is meant to sit in public HTML. It can submit to your form and fetch its public form definition, but it cannot read your submissions, sign in to the dashboard or change your settings. Reading and managing a workspace uses separate authenticated access.

What the exposure risks

Someone who copies the key can send submissions to your form, which can fill your inbox and use your submission allowance. On Pro and Agency, overage is optional and off by default; if you turn it on, extra submissions beyond your monthly limit are billed per 1,000. Submissions are also rate limited per API key, and a request over the limit gets a 429 response. That is why spam controls matter more than hiding the key.

What limits that

A honeypot field, a spam filter and a CAPTCHA help reject automated submissions. Domain restriction, available from Starter, rejects submissions whose Origin or Referer header does not match your allowed domains, and requests that send neither header. Browsers set those headers, but other clients can send any value, so treat domain restriction as one layer alongside a CAPTCHA, not a replacement.

What never goes in a form

Keep secrets out of your HTML: tokens, passwords and webhook URLs belong in the service's settings, not in the markup.

Setup steps are in the domain restriction docs and the quick start.

What a form endpoint should handle

• Accept the form's POST. Static Forms takes URL-encoded and multipart form data, or JSON.
• Identify which form the submission is for, here with the apiKey field.
• Filter spam with a honeypot, a spam filter and a CAPTCHA.
• Deliver the submission by email and, depending on the plan, to a webhook or an integration.
• Answer the browser: a redirect to your thank-you page (the redirectTo field), or a JSON response when the request sends an Accept: application/json header.
• Return a clear error when something is wrong, such as a missing key or a rejected submission.

Where to get a form endpoint

There are three routes: a hosted form backend, your host's built-in forms, or an endpoint you write yourself as a serverless function. For a hosted one, these services have a free plan. We make Static Forms, so the other rows quote each service's own site on the day shown, and plans change.

Free plans differ in forms, file uploads, spam tools and history, so compare more than the submission count. The alternatives page has the side-by-side comparison.

Form endpoint FAQ

What is a form endpoint?

A form endpoint is a URL that receives an HTML form's submission. You put it in the form's action attribute, and when a visitor presses Submit, the browser sends the fields there as a POST request. The service behind the endpoint checks the submission for spam and delivers it, by email or to other tools.

What goes in the action attribute of a form?

The form endpoint: a URL that accepts a POST request. With Static Forms it is https://api.staticforms.dev/submit, and the form's apiKey goes in a hidden field.

Is it safe to expose a form endpoint and API key in HTML?

The endpoint is public by design, and a Static Forms apiKey can submit to your form and fetch its public form definition, but it cannot read submissions or change settings. Someone who copies it can still send spam, so use a honeypot, a spam filter and a CAPTCHA, and, from Starter, domain restriction.

Do I need my own server for a form endpoint?

No. A form backend such as Static Forms runs the endpoint for you, so a static site can use a plain HTML form. You can also run your own endpoint as a serverless function; then the spam checks and email delivery are yours to build.

Is there a free form endpoint?

Several form backends have a free plan. The Static Forms Free plan covers 250 submissions every 30 days without a credit card. The page lists other free plans with the day each was checked; check the service's own site before you decide.