Frequently Asked Questions

Formhook is built for indie developers, freelancers, and studios who need a reliable form backend without writing server-side code. The Studio tier adds multi-client provisioning — perfect for agencies building sites for clients who need to own their own form data.

Sign in to your dashboard, click + New form, give it a name, and set the allowed origin (the domain your form lives on). You'll get an API key and a POST URL to use in your HTML form's action attribute.

Point your HTML form's action to your Formhook POST URL and set method="POST". That's it — no JavaScript required. For JS-based submissions, use fetch() with a JSON body. Check the docs and framework-specific guides for detailed examples.

Yes. The free tier gives you 5 forms and 250 submissions per month with no credit card required. You get push notifications, email alerts, Turnstile bot protection, and CORS allowlisting — all included. Submissions are kept forever.

Go to your form's Settings page and add one origin per line in the Allowed origins field (e.g. https://example.com). Browser-based submissions from unlisted origins will be rejected. Server-side submissions (cURL, fetch from a backend) are not affected by CORS.

Two built-in options: Honeypot — add a hidden field named _gotcha to your form. Bots fill it in; humans don't see it. Any submission with that field filled is silently discarded. Cloudflare Turnstile — enable it in your form settings, add the Turnstile widget to your HTML, and Formhook verifies the token server-side. Both can be used together.

Forever. Unlike some competitors that archive after 30 days, Formhook keeps all your submissions indefinitely. You can also export everything as JSON from your account page.

Formhook keeps accepting submissions on a soft cap so you never lose a lead. You'll see a warning in your dashboard when you hit 80% and again at 100%. Sustained overage is your cue to upgrade.

Yes, on Pro and Studio plans. Use enctype="multipart/form-data" on your form. The per-file cap is 10 MB, and total storage is 1 GB (Pro) or 10 GB (Studio). Files are stored securely and accessed via short-lived signed URLs — never publicly accessible.

No, but they are available on all plans including the free tier. Enable them per form in the form's Settings page.

Go to your form's Settings page and toggle Email on new submission. You'll receive an email at your account address every time someone submits the form. Available on all plans.

Open formhook.app in your browser. On iOS (16.4+): tap Share → Add to Home Screen. On Android: tap the menu → Install app. On desktop (Chrome/Edge): click the install icon in the address bar. The PWA gives you an app-like experience with push notifications.

Go to your account page and toggle Push notifications on. Your browser will ask for permission — allow it. You can also choose whether to include a preview of the submission in the notification. Push works on all major platforms (iOS 16.4+, Android, macOS, Windows, Linux).

Go to your form's Settings page and scroll to the Webhook section. Enter the URL you want to receive submissions at. Formhook sends a POST request with a JSON payload for every new submission, signed with HMAC-SHA256 so you can verify authenticity. Requires a Pro or Studio plan.

Yes. When you add a webhook URL, Formhook auto-detects Discord, Slack, and Teams webhook URLs and formats the payload accordingly — no extra configuration needed. Just paste the webhook URL from your channel's settings.

Google Sheets integration is coming soon. Once available, you'll be able to append new submissions as rows to a spreadsheet automatically.

Yes. Server-to-server requests don't send an Origin header, so they authenticate with a token instead. Open your form's Settings, generate an X-Auth-Token under Server request authentication, and send it as the X-Auth-Token header on every request. Until you generate a token, server and curl submissions are rejected — browser submissions are never affected.

Click on any submission in your dashboard and hit Reply. If the submission contains an email field, it's auto-filled as the recipient. Replies are sent from your verified domain or via Formhook's fallback address. You need a Pro or Studio plan and a configured reply-from address.

Go to Settings → Domains and add your domain (e.g. example.com). You'll see DNS records (SPF, DKIM, MX) to publish at your DNS provider. Once all records are verified, set the reply-from address in your form's settings. Replies will then come from your own domain instead of a Formhook address.

Studio is designed for agencies and freelancers who build websites for clients. It lets you provision forms on behalf of clients and then transfer ownership to them — a clean GDPR handoff where the client owns their own submission data. You also get a multi-client console to monitor all sponsored forms.

When creating a form, enter the client's email address. They'll receive an invite to claim the form. The form stays live and accepts submissions during the 7-day acceptance window. Once claimed, the client owns the form and its data. You can monitor status from the Clients page.

Go to the Team page and enter their email address. Choose a role (Editor or Admin) and send the invite. They have 7 days to accept. Your tier's seat limit determines how many collaborators you can have.

Editor — read-only access to forms and submissions. Admin — can also edit form settings, manage webhooks, and configure integrations. Only the account owner can manage billing, team members, and delete forms.

Go to the pricing page and choose a plan, or visit Dashboard → Billing to change your current plan. You can switch between monthly and yearly billing. Plan changes are prorated.

Yes, cancel anytime from the Billing page. You keep access until the end of your current billing period. No questions asked.

All prices are in EUR (€). VAT and invoicing are handled automatically by our payment processor, Polar.

All submission data is stored on a Hetzner VPS in Germany (EU). Data never leaves the EU. Cloudflare provides TLS and DDoS protection at the edge, but submissions are not persisted there.

Yes. EU-only data storage, a published Data Processing Agreement, and the Studio tier's clean ownership transfer are all designed with GDPR in mind. See our Privacy Policy for full details.