Forms

A form in FormFlow is an endpoint. You create it once in the console, point any <form> tag at it, and FormFlow takes care of storage, notifications, anti-spam and webhooks. There is nothing to deploy on your side.

Creating a form

From the console, click New form and give it a name and one or more notification email addresses. That’s the whole setup.

Every form gets a URL-safe slug, generated from the name (Contact form → contact-form). You can pass your own slug when creating the form; if it’s taken, FormFlow appends a short suffix to keep it unique. The slug is part of your public endpoint:

https://api.formflow.cc/v1/f/<slug>

Point your form at it and you’re live:

<form action="https://api.formflow.cc/v1/f/contact-form" method="POST">
  <input name="email" type="email" required />
  <textarea name="message" rows="4"></textarea>
  <button type="submit">Send</button>
</form>

Statuses

A form is in one of three states:

Status	Meaning
live	Accepting submissions. The default for new forms.
paused	Endpoint stays up but rejects submissions with 403 form-not-live. Existing data is untouched.
draft	Same as paused — useful while you’re still wiring things up.

Only live forms accept submissions. Posting to a paused or draft form returns a 403 with a problem+json body (https://formflow.cc/problems/form-not-live), so your monitoring can tell “paused on purpose” apart from “form deleted” (404).

Configuration

Everything below is editable per form in the console (or via PATCH /v1/forms/:id with a management key):

Setting	Default	What it does
name	—	Display name in the console and in notification emails.
notify_emails	—	Comma-separated list of addresses; each one gets an email notification for every submission.
from_address	FormFlow default	Override the From address on notification emails.
subject_template	New submission — <form name>	Subject line for notification emails; {form} and {id} are replaced with the form name and submission id.
honeypot_enabled	on	Hidden-field spam trap. See Anti-spam.
honeypot_field	_gotcha	Name of the honeypot field your markup includes.
turnstile_enabled	on	Require a valid Cloudflare Turnstile token on every submission — turn it off if you can’t add the widget. See Anti-spam.
rate_limit_per_10m	60	Max submissions per IP per 10 minutes for this form.
retention_days	30	How long submissions are kept before automatic deletion (capped by your plan).

Limits

Your plan caps the number of forms, monthly submissions, attachment sizes and retention. When the monthly submission quota is used up, the endpoint responds 402 quota-exceeded until the calendar month rolls over or you upgrade — see Submission ingest for the exact behaviour.

Next steps

• Anti-spam — honeypot, Turnstile and rate limits in detail.
• Submission ingest — content types, files, idempotency and every response shape.
• Webhooks — fan submissions out to your own services.