Form backend questions, answered honestly.

splitforms is a form backend API. You point any HTML form's action attribute at https://splitforms.com/api/submit, drop in a hidden access_key field, and submissions arrive in your inbox plus your dashboard. There's no SDK, no PHP, no plugin, no infrastructure to maintain — it's the modern replacement for self-hosted contact-form scripts and PaaS form services.

Developers and indie founders shipping static sites, JAMstack apps, marketing pages, and small SaaS dashboards on stacks like Next.js, Astro, Hugo, Gatsby, Eleventy, Webflow, Carrd, or plain HTML. Anyone who wants 1,000 free submissions a month without setting up Postmark, Resend, or AWS SES themselves. Agencies using one account across many client sites also fit cleanly.

Sign in at splitforms.com/login with email or GitHub, create a form in your dashboard, and copy the access key shown. The whole flow takes under a minute and there's no credit card required. Each access key works on unlimited forms across unlimited domains until you decide to lock it down.

Copy the snippet from your dashboard (or any of our framework guides), paste it into your page, and submit a test message. Within a few seconds you'll see the submission in your inbox and the dashboard. If anything is off, the dashboard's Recent Activity panel shows exact request payloads and error messages.

Yes. The API runs on Vercel + Supabase Postgres with multi-region edge routing. We're in v0 launch, which means we're shipping fast — but the form endpoint is the same code we use ourselves and has been deduplicated, rate-limited, and signed since day one.

Yes. 1,000 form submissions per month, unlimited forms, spam filtering, and webhooks — included on the free plan, no credit card required, ever. The free tier is a real product tier, not a trial that expires after 14 days.

5,000 submissions/month, per-form CC and BCC recipients, allowed-domain access-key locking, custom subjects and intro text, higher email rate limits, priority support under 4 hours, and everything from the Free tier. Cancellable any time from the dashboard with no phone calls.

A one-time $59 payment for 48 months of access at 15,000 submissions/month, with all Pro features included. It's long enough to be a meaningful deal, short enough that we can keep our promises about uptime and feature investment over its lifetime. Renew at the rate at the time when it ends, or move on.

Honest answer: lifetime deals quietly bankrupt indie SaaS, and we want splitforms to still exist in 2030. The 4-year window prices in real cost-of-service over a meaningful horizon without making promises we can't keep. Customers who want predictability for a multi-year project still get it.

Submissions still arrive — they're flagged 'over-quota' in your dashboard but never deleted. We email you a few days before you'll hit the limit so you can upgrade or budget. Two consecutive over-quota months prompt a friendly nudge to upgrade.

Yes — cancel from the dashboard at any time and you keep access until the end of the period. Refunds within 14 days of a Pro charge, no questions asked. The 4-year plan has a 30-day refund window.

No. Submissions blocked by the honeypot or flagged as spam don't count against your monthly quota. Failed deliveries (bad email, bounce) also don't count — only successful, human submissions consume quota.

Pro is billed monthly via Stripe (cancel anytime). The 4-year plan is one charge, no recurring billing. There's no annual Pro tier today; if that's something you want, email us and we'll add you to a waitlist.

Yes. Email hello@splitforms.com from your .edu address, your non-profit domain, or with a public OSS link, and we'll usually give you Pro for free while the project is active.

Stripe Tax handles VAT for EU/UK customers and US sales tax where required. The amount shown at checkout is what you pay; invoices include all tax breakdowns and are downloadable from the dashboard for accounting.

Yes. The integration is just a POST request, so anywhere you can submit a form, splitforms works identically. Server actions in Next.js, fetch() in client components, useState in React, defineComponent in Vue, +page.svelte in SvelteKit — all the same single endpoint with the same JSON response shape.

Yes — Webflow's custom form action setting, Framer's form integration, Carrd's form-to-URL, and WordPress (no plugin) all work. Set the form action to https://splitforms.com/api/submit and add the hidden access_key input. Step-by-step guides for each are linked from the dashboard.

No. There's no SDK to install. The integration is a standard HTML form POST or a fetch() call — exactly what your framework already supports. We deliberately avoid SDKs because they always rot and add a dependency you don't need.

Yes — webhooks are free on every plan including Free. Paste a Slack incoming-webhook URL or Discord webhook URL and we auto-format for that destination. Or send signed JSON to any URL (Zapier, n8n, Make, your own server). Google Sheets works through Zapier today, with native support shipping on Pro.

Yes — via the custom webhook (Zapier, n8n, Make, Pipedream all work great as the middleware). Native HubSpot and Notion integrations are on the Pro roadmap; until they ship, the webhook route is reliable and signed.

Yes — unlimited forms per access key on every tier including Free. Most agencies use one account across many client websites. You can also create separate forms for cleaner per-form analytics, recipients, and notifications.

Yes. Add a hidden redirect field to the form pointing to your thank-you URL. Without it, the API returns JSON — perfect for fetch-based forms that show in-page success states. The redirect URL must be on a domain you own (allow-listed in settings).

splitforms accepts whatever your front-end POSTs, so multi-step is just a matter of submitting on the final step (or batching steps into a single POST). Native multi-step UI helpers are on the Pro roadmap.

Every template ships a hidden honeypot field called botcheck. Bots auto-fill every form field they see; humans don't see this one because it's display:none with tabindex=-1. If a submission has botcheck filled, we silently drop it and mark it spam in your dashboard so you can audit false-positive rates.

No. The honeypot blocks the vast majority of bots without showing a CAPTCHA to your real users. CAPTCHAs add friction and hurt conversion. If you want stricter checks (rate-limiting per IP, fingerprint heuristics, AI classifier) you can enable them in Settings → Security.

Open the dashboard — flagged submissions are stored, not deleted, so you can see false positives and one-click restore them. The most common cause is the botcheck field becoming visible to humans (a CSS override). Make sure it has both display:none and tabindex='-1'.

Yes. In Settings → Security → Allowed domains, list the domains allowed to submit using this key (e.g. example.com, www.example.com). Submissions from any other origin return HTTP 403. This is the right answer when a key gets leaked or you're worried about someone copying your form.

Yes — splitforms keys are designed to be public. They're an identifier, not a secret. To prevent abuse from other origins, lock the key to your domain(s). For server-side use cases (reading submissions back) you use a Bearer API token, which IS secret.

Rate limits on the public endpoint kick in at ~60 requests/minute per IP. Combined with the honeypot, the AI classifier on Pro, and domain allow-listing, automated abuse is rare. If you do see a flood, contact us — we can block specific IP ranges or rotate the key for you.

All traffic to splitforms.com/api/submit is HTTPS-only with HSTS preload. We never accept plain HTTP and we never log full request bodies in plaintext outside the database (which has row-level security so only your account can read your rows).

Notification emails are sent through a high-reputation transactional provider (Resend / Postmark-class) with proper SPF, DKIM, and DMARC alignment on the splitforms.com sending domain. We're not relying on your Gmail SMTP — that means deliverability is consistent across every recipient.

Most of the time it's because your inbox sees splitforms.com as a new sender. Mark one notification as 'Not spam' or move it to Primary, and Gmail/Outlook learn within a few messages. Adding noreply@splitforms.com to your contacts also helps.

Yes — custom sending domain (e.g. forms@yourcompany.com) is a Pro feature. You add a couple of DNS records (SPF/DKIM), we verify, and notifications start sending as you. Recipients see your brand, not splitforms.

Yes. Per-form custom subjects, intro text, and reply-to address are available on Pro. The Free tier uses a clean default subject like 'New submission from <form name>' which works for most cases.

Bounces are tracked per recipient. After repeated hard bounces we pause sending to that address and surface it in the dashboard so you can fix it. The submission itself is always saved to the dashboard regardless of email status — email is a notification, not the source of truth.

Yes, on Pro. Per-form CC and BCC lists, plus the option to send to a single distribution alias. The Free tier supports a single primary recipient per form, which covers most solo and small-team setups.

Yes. We're a data processor; you're the controller. Submissions live in Postgres with row-level security so only your account can read your rows — even our staff can't read them via the API. We honor data-subject access and erasure requests within 30 days.

Today the primary database is in the US-East region (Vercel + Supabase). EU data residency (Frankfurt region) is on the roadmap for organizations that need data to stay in the EU. If that's a hard requirement for you, email hello@splitforms.com and we'll prioritize.

Yes. A standard DPA (with SCCs for international transfers) is published at /dpa and is auto-accepted as part of our Terms. Custom DPA negotiation is available for enterprise customers — email us.

Indefinitely on paid tiers (you own the data). On the Free tier, submissions are kept for 12 months minimum. You can delete any submission or your entire account from the dashboard at any time, and we hard-delete within 30 days.

No. We never sell, share, or train any model on customer submissions. The optional AI spam classifier processes submission metadata (not full content) and does not retain it. This is in writing in the Privacy Policy and the DPA.

Yes. CCPA opt-out and a do-not-sell flag are wired into the dashboard (we don't sell, but the flag is honored downstream regardless). PIPEDA-style access and correction requests are handled the same way as GDPR DSARs — email privacy@splitforms.com.

Yes. CSV export from the dashboard on every tier including Free, plus a JSON export endpoint on Pro. No proprietary lock-in — you can leave with all your data at any time. Account deletion wipes the data within 30 days and we'll send a confirmation.

Email hello@splitforms.com — we read every message. Free-tier replies usually arrive within one business day; Pro and 4-year customers get priority replies under 4 business hours. For urgent production issues, write 'URGENT' in the subject and we'll page on-call.

The dashboard's Recent Activity panel shows every request to your forms — including blocked, spam-flagged, and rate-limited attempts — with timestamps, IPs, and full payloads. It's the first place to look when something doesn't behave as expected.

Almost always one of: (1) the access_key is missing or wrong, (2) the request origin isn't in your allowed-domains list, or (3) the key has been revoked. Check Settings → Security in your dashboard. The response body includes a 'reason' field that points at the exact cause.

Too many requests in a short window. The default limit is generous for organic traffic; if you're legitimately bursting (e.g. a launch on Hacker News), email us with the time window and we'll raise the limit. Otherwise, check whether a script or webhook is hammering the endpoint.

Three usual suspects: notification email is in spam (check there first), your recipient address bounced (the dashboard will flag this), or notifications are paused for the form. Settings → Notifications shows current delivery status and lets you re-enable.

Yes — status.splitforms.com publishes incidents and uptime. Subscribe to the RSS feed or email updates from there. We post-mortem every customer-impacting incident publicly.

Full developer docs live at /docs with copy-paste recipes for every major framework, the full API reference, webhook signing examples, and migration guides. The README in the dashboard also has a quick-start tailored to your account.

POST https://splitforms.com/api/submit. Accepts application/json, application/x-www-form-urlencoded, and multipart/form-data. The only required field is access_key. Returns 200 with { success: true } on success, or 400/403/429 with { success: false, message } on error.

Yes. Every webhook request body is signed with HMAC-SHA256 using a per-webhook shared secret, sent in the X-Splitforms-Signature header as 'sha256=<hex>'. Verify on your server using crypto.timingSafeEqual. Code samples in /docs#webhooks for Node, Python, Ruby, Go, and PHP.

We retry with exponential backoff (1m, 5m, 30m, 2h, 12h, 24h) for up to seven attempts. The submission still lands in your inbox and dashboard regardless — webhooks are an additional delivery channel, not the source of truth.

Yes — GET /api/submissions with a Bearer token (generate in Dashboard → API). Returns paginated JSON with cursor-based pagination. Filter by form, date range, and spam status. Rate-limited generously per token.

File upload support is on the near-term roadmap and will land on Pro and 4-Year tiers, with per-file size and per-month storage caps. Today we handle text, email, dropdowns, dates, numbers, checkboxes, radios, and textareas.

splitforms ships a Model Context Protocol server so AI coding agents like Claude Code, Cursor, and Windsurf can read your forms, list submissions, and generate template HTML directly without you copy-pasting credentials. Setup is one command and is documented at /docs#mcp.

No, deliberately. The endpoint is a standard POST with a 3-line integration — adding an SDK would create a dependency you'd have to update. If you want a typed wrapper, the docs include 30-line snippets in TypeScript, Python, Go, Ruby, and PHP that you can paste straight into your codebase.

Swap the form's action URL to https://splitforms.com/api/submit and replace the access key. Existing field names (name, email, message, anything custom) work as-is, so you don't need to rewrite the form. Migration usually takes under five minutes per form.

Same idea: swap the action URL and the access_key. Web3Forms' field naming conventions map 1:1 to splitforms. The honeypot field name (botcheck) is identical, so existing spam protection keeps working without any markup change.

Swap the action URL to https://splitforms.com/api/submit and add the splitforms access_key as a hidden input. Field names are arbitrary on splitforms — whatever your existing form sends, we'll capture and email. Step-by-step guides for each are at /vs.

Submissions stored in your previous provider stay there until you delete them — splitforms doesn't touch them. If you want history in one place, most providers let you export to CSV; we can ingest that into your dashboard via support if you ask.

Yes — point one staging form at splitforms while production stays on the old provider. Or use a feature flag in your front-end to A/B the two endpoints. Once you trust the new setup, swap the production action URL and you're done.

splitforms speaks the same shapes most form services do (Slack incoming-webhook URLs, Discord webhook URLs, signed JSON to a custom endpoint), so most integrations are a settings paste, not a rebuild. The signature header name is X-Splitforms-Signature — update your verify code to read that.

Magic-link email or GitHub OAuth at splitforms.com/login. We don't ask for a password — magic links are more secure for low-frequency apps like this and there's nothing to forget. Sessions last 30 days; you can sign out from any device in Settings → Sessions.

Multi-seat teams are on the Pro roadmap. Today, agencies typically share a single login (or use one account per client) — both work fine. If team seats are a hard requirement, email hello@splitforms.com so we can prioritize correctly.

Yes — contact support with the form ID and the destination email and we'll move it (and all its submissions) over. Self-serve transfer is on the roadmap.

Settings → Account → Delete account. We hard-delete all submissions, webhooks, and account data within 30 days and send a confirmation email. If you only want to pause, you can downgrade to Free instead and keep your forms intact.

Honest answer: every submission is exportable as CSV/JSON at any time, so worst-case you keep the data. The codebase is also public — self-hosting is a real fallback. We have no plans to shut down, but we plan our customer-experience contract for the case where we did.