FormBastion

Quickstart

Connect your first form.

Create a workspace, publish your rules, and give your existing form an endpoint.

1Create a customer workspace

Create a customer account and give your workspace a recognizable name. Save the recovery information shown during account setup.

2Create and publish your form

Open Forms, create a form, and review its draft configuration. Add the field rules you need, check the honeypot and attachment settings, then publish. Copy the source endpoint from the form’s source settings.

3Connect your existing HTML

Replace YOUR_SOURCE_PUBLIC_KEY with the source key from your workspace. Every field you want to submit needs a name. Make sure these names match any published validation rules.

HTML form
<form action="https://submit.formbastion.com/f/YOUR_SOURCE_PUBLIC_KEY"
      method="POST" enctype="multipart/form-data">
  <label for="contact-name">Your name</label>
  <input id="contact-name" name="name" maxlength="100" required>

  <label for="contact-email">Your email</label>
  <input id="contact-email" name="email" type="email" required>

  <label for="contact-message">Your message</label>
  <textarea id="contact-message" name="message" required></textarea>

  <input name="_gotcha" type="text" tabindex="-1"
         autocomplete="off" hidden>
  <button type="submit">Send message</button>
</form>

The honeypot above matches the default _gotcha field; update it if you change the published setting. A non-empty honeypot is held in quarantine.

4Send a submission and review it

Send a test using information you control. After storage, a normal HTML request receives a 303 redirect to the configured success URL or a generic receipt page. Open Inbox in your workspace to inspect the saved fields and the version that received them.

Do not place management API keys, source secrets, webhook secrets, or destination addresses in browser form fields. A source’s public key is an identifier, not a secret.

Prefer a JSON response?

Send Accept: application/json. Successful ingestion returns 202 Accepted and a receipt. Use an Idempotency-Key for a retry of the same logical submission. A changed payload needs a new key; reusing a key with different content returns 409.

For browser JavaScript, configure the source’s allowed origins and do not manually set a multipart Content-Type when using FormData. The browser supplies its boundary.

Continue to the API reference