Is a Public Form Access Key Safe? What to Keep Secret

Which key belongs in a public form?

A working browser form must reveal its destination. Moving an access_key from a hidden input into JavaScript, or putting it in a frontend environment variable, does not make it secret. Visitors can inspect the generated page and its network requests. That is expected for a submission-only form endpoint.

The important question is what the credential permits. A public form key selects where an incoming message goes. An account token may authorize reading records or managing resources. Copy the form key from the form’s setup screen, and use the documented authentication mechanism for any separate account integration.

References: SplitForms API reference · SplitForms MCP authentication

Why hiding a key or enabling CORS is not enough

CORS controls whether browser JavaScript can read a cross-origin response. It does not stop arbitrary HTTP clients from sending requests. A script running outside a browser can send requests directly, so a public key plus an origin policy is not the same as authenticating a trusted sender.

Allowed Domains is useful for catching unintended deployments and restricting the browser sites that use a form. Combine it with server-side abuse controls. Do not treat a Referer or Origin header as proof of a visitor’s identity, and do not fix a CORS error by switching fetch to no-cors: you would lose access to the response details your success UI needs.

References: MDN: CORS · SplitForms origin and submission errors

A practical protection checklist for SplitForms

Start with one form per workflow so you can inspect submissions and settings separately. Keep the honeypot empty for legitimate visitors, preserve any timing field generated by the integration, and configure the real production hostname before enabling strict origin protection. Check both the root domain and the www hostname you actually use.

For persistent abuse, enable a supported verification provider and complete both browser and server configuration. A widget rendered on the page is only half the integration. Review spam outcomes after a change so a stricter rule does not quietly reject your genuine customers.

• Use the public form key, never an account or MCP token, in the submitted request.
• Keep recipient addresses and integration credentials in the dashboard settings.
• Use honeypot, rate limiting and spam filtering together; no individual signal catches every bot.
• Check the dashboard and Spam view during a controlled test.
• Keep logs useful without copying full visitor messages or secrets into analytics.

References: SplitForms spam controls · SplitForms security

What to do when a key appears in a repository

First identify the credential. Finding the intended form access key in frontend source is different from discovering a privileged token. If a management credential was exposed, revoke or rotate it through the relevant account controls, update the service that uses it and review the actions it could authorize. Deleting a line from the latest commit does not remove older copies.

If a public form key is attracting spam, inspect the affected form and strengthen its controls. Changing the key without fixing an exposed privileged token would address the wrong problem. Equally, building a proxy solely to hide a submission endpoint adds maintenance without making the public contact form private.

References: Authentication and form setup

Where a hosted form backend helps

SplitForms is useful when you want a public website form without maintaining a custom email route, database and spam pipeline. The dashboard gives you a place to inspect accepted submissions before investigating email delivery, and a separate authenticated API or MCP connection can support authorized operations.

Choose a custom authenticated workflow when the submission represents a privileged action, such as changing an account or approving a payment. A public contact-form endpoint is intended to collect messages. Keep authorization for business actions in the application that owns those actions.

References: SplitForms API reference · Submission lifecycle

Frequently asked questions