Docs

Create a form in the dashboard, copy its endpoint, point your form at it. That's it — everything below is detail.

New to FormDock, or wondering how workspaces and forms fit together? Start with the dashboard guide — concepts, first five minutes, and how-tos for every action.

Plain HTML

<form action="https://formdock.app/f/your-form-key" method="POST">
  <input type="text" name="name" required>
  <input type="email" name="email" required>
  <textarea name="message"></textarea>

  <!-- honeypot: hidden field that bots fill and humans don't -->
  <input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off">

  <button type="submit">Send</button>
</form>

The browser is redirected to your form's redirect URL (or our thanks page) after submitting.

AJAX / fetch (React, Vue, anything)

const res = await fetch("https://formdock.app/f/your-form-key", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ name, email, message }),
});
const data = await res.json(); // { ok: true, id: "…" }

Send JSON (or set Accept: application/json) to get a JSON response instead of a redirect. CORS is enabled — lock it to your domains in form settings.

Framework guides

Step-by-step recipes with copy-paste code:

HTML React Astro Eleventy Framer Webflow Next.js Vue & Nuxt SvelteKit Hugo Jekyll

Special fields

_redirect— override the post-submit redirect URL per submission. For safety it must point to your own site: a domain from the form's allowed domains, the domain of its configured redirect URL, or the page the submission came from.
_subject — set the notification email subject.
_gotcha — the default honeypot field (rename it in form settings). Leave it hidden and empty.
email or _replyto — used as the Reply-To on notification emails and as the autoresponder recipient.

Cloudflare Turnstile

<!-- in <head>: -->
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<!-- inside your form: -->
<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

Enable “Require Turnstile” in form settings and the token is verified server-side on every submission. Using a widget from your own Cloudflare account? Paste that widget's secret key into the form's “Turnstile secret key” setting — tokens can only be verified with the secret of the widget that issued them.

Webhooks

Set a webhook URL in form settings. Every non-spam submission POSTs:

{
  "event": "submission.created",
  "form": { "id": "…", "name": "Contact form", "key": "…" },
  "submission": {
    "id": "…",
    "payload": { "name": "Jane", "email": "jane@example.com" },
    "spamScore": 0,
    "createdAt": "2026-07-28T12:00:00.000Z"
  }
}

If you set a webhook secret, each request carries an X-FormDock-Signature header — the hex HMAC-SHA256 of the raw body. Failed deliveries retry five times with exponential backoff.

Spam handling

Three layers: honeypot, optional Turnstile, and keyword/link heuristics. Flagged submissions are stored, not deleted— check the Spam tab and mark false positives as “Not spam”. Spam never triggers emails or webhooks.

Data retention & GDPR

FormDock acts as a data processor for your form submissions. Set a per-form retention window to auto-delete old submissions, delete individual submissions from the dashboard, and export everything as CSV any time. See the DPA.