splitforms API reference

Endpoint

Authentication

Authentication for the submit endpoint is a single string field named access_key. Each splitforms form gets its own access key — it identifies which form, inbox, and dashboard a submission belongs to. Because the key lives in client-side HTML, it is not a secret in the bearer-token sense; if you want to stop other sites from reusing it, add your domains under Allowed Domains and turn on strict domain protection in the form's settings (available on every plan, including Free).

<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

Read API authentication

For the read API (GET /api/submissions), use the API token from Dashboard → MCP. It's the same bearer token that authenticates the MCP server — one token powers both. It scopes to your account, never appears in client-side code, and can be regenerated or revoked from the dashboard at any time.

curl https://splitforms.com/api/submissions \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Request headers and fields

Request headers

Required body field

Reserved optional body fields

These field names are reserved — they control submission behavior and are stripped from the saved submission data so they don't appear in the email body or dashboard table.

Everything else (your data)

Any other field you POST — name, company, budget, custom selects, hidden tracking params — is included verbatim in the email body and stored on the submission row. There is no schema to declare. Add a field to your form, ship it, and the next submission will have it.

Body limits

• Maximum field count: 100 (MAX_FIELDS). Extra fields are dropped silently.
• Maximum value length per field: 10,000 bytes (MAX_FIELD_BYTES). Longer values are truncated, not rejected.
• File uploads via multipart/form-data are accepted on paid plans when the Storage integration is connected. Maximum 5 files / submission at 5 MB each. A request body larger than that plus about 2 MB of fields returns 413. See the File uploads section below.
• CORS is open: any Origin may POST. Domain restriction is opt-in per form: add your domains under Allowed Domains and turn on strict domain protection.

Responses

What you get back depends on the request shape. JSON requests get JSON. Native HTML form posts that carry a hidden redirect field get a 303; posts to a form with a redirect URL set in its dashboard settings (paid plans) get a 302. Native posts with neither get a built-in success page.

Successful submission (JSON)

Returned when Content-Type or Accept includes application/json, or when a script calls the endpoint without asking for HTML (fetch, curl, Python requests).

HTTP/1.1 200 OK
Content-Type: application/json

{
  "success": true,
  "message": "Submission received"
}

Optional fields in the JSON response

These keys appear only when they apply, so treat unknown keys as forward-compatible.

Successful submission (redirect)

A native HTML form post with a hidden redirect field gets a 303, so the browser follows with a GET and a refresh never resubmits. The URL must be a relative path, the site the form was submitted from, a domain on the form's Allowed Domains list, or splitforms.com; anything else is ignored and the visitor sees the default success page. This works on every plan.

HTTP/1.1 303 See Other
Location: https://yoursite.com/thanks

Without the hidden field, a redirect URL set in the form's dashboard settings (paid plans) is sent as a 302.

HTTP/1.1 302 Found
Location: https://yoursite.com/thanks

Successful submission (default HTML)

Returned for native HTML form submits with no redirect — a small built-in "Submission received" page so the user sees confirmation.

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8

<!doctype html>… built-in success page …

Validation error

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "success": false,
  "message": "Missing access_key. Copy the form access key from your splitforms dashboard and include it as a hidden input named access_key.",
  "code": "missing_access_key"
}

Invalid access key

HTTP/1.1 404 Not Found
Content-Type: application/json

{
  "success": false,
  "message": "Invalid access_key. Copy the form access key from your splitforms dashboard, not your MCP token or account API token.",
  "code": "invalid_access_key"
}

Rate limited

HTTP/1.1 429 Too Many Requests
Content-Type: application/json

{
  "success": false,
  "message": "Too many submissions for this form right now. Wait a minute and try again.",
  "code": "rate_limited"
}

Free allowance used up

The Free plan's 500 submissions are a one-time total, not a monthly allowance.

HTTP/1.1 429 Too Many Requests
Content-Type: application/json

{
  "success": false,
  "message": "Free plan limit reached (500 total submissions). The free allowance is one-time, not monthly. Upgrade at https://splitforms.com/#pricing to keep receiving leads.",
  "code": "quota_reached",
  "quota": { "limit": 500, "used": 500, "plan": "free" }
}

Monthly quota exhausted (paid plans)

HTTP/1.1 429 Too Many Requests
Content-Type: application/json

{
  "success": false,
  "message": "Monthly submission limit reached (5000 on the Pro plan). Resets Nov 1. Upgrade at https://splitforms.com/#pricing",
  "code": "quota_reached",
  "quota": { "limit": 5000, "used": 5000, "plan": "pro" }
}

Error codes

For JSON callers, every error response is JSON with { success: false, message: "…" }, and most also carry a machine-readable code such as rate_limited or invalid_access_key. Native HTML form posts get a short error page with the same status. The HTTP status is the canonical signal — branch on it, not on the message string.

Rate limits

Three limits run side-by-side. A burst limit of 6 submissions per rolling 60-second window and a sustained limit of 20 submissions per 15 minutes protect the endpoint from runaway loops and dictionary attacks — both are keyed per IP address, per form, so one throttled visitor never blocks the rest of your traffic. Your plan allowance gates how many submissions count against your plan: 500 in total (one-time) on Free, and a monthly allowance on paid plans. Webhook fan-out and the read API do not count against the submission allowance.

The 429 response does not currently include a Retry-After header. Wait 60 seconds before retrying — by then the rolling burst window will have rotated. If you're tripping the sustained limit, back off for 15 minutes.

Code examples

The same endpoint, called every common way. Replace YOUR_ACCESS_KEY with the key from your dashboard.

cURL

curl -X POST https://splitforms.com/api/submit \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "access_key": "YOUR_ACCESS_KEY",
    "name": "Ada Lovelace",
    "email": "[email protected]",
    "message": "Hello from cURL."
  }'

cURL (urlencoded — same as a browser form)

curl -X POST https://splitforms.com/api/submit \
  --data-urlencode "access_key=YOUR_ACCESS_KEY" \
  --data-urlencode "name=Ada Lovelace" \
  --data-urlencode "[email protected]" \
  --data-urlencode "message=Hello from cURL."

JavaScript fetch (browser or Node)

const res = await fetch("https://splitforms.com/api/submit", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Accept": "application/json",
  },
  body: JSON.stringify({
    access_key: "YOUR_ACCESS_KEY",
    name: "Ada Lovelace",
    email: "[email protected]",
    message: "Hello from JS.",
  }),
});

const data = await res.json();
if (!data.success) throw new Error(data.message);
console.log(data); // { success: true, message: "Submission received" }

Plain HTML form

<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input type="text" name="botcheck" style="display:none" tabindex="-1" autocomplete="off" />

  <input type="text" name="name" required />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>

  <button type="submit">Send</button>
</form>

Python (requests)

import requests

res = requests.post(
    "https://splitforms.com/api/submit",
    json={
        "access_key": "YOUR_ACCESS_KEY",
        "name": "Ada Lovelace",
        "email": "[email protected]",
        "message": "Hello from Python.",
    },
    headers={"Accept": "application/json"},
    timeout=10,
)
res.raise_for_status()
data = res.json()
print(data)  # {'success': True, 'message': 'Submission received'}

Node.js (fetch)

const res = await fetch("https://splitforms.com/api/submit", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    access_key: process.env.SPLITFORMS_KEY,
    name: "Ada Lovelace",
    email: "[email protected]",
    message: "Hello from Node.",
  }),
});

const data = await res.json();
console.log(data); // { success: true, message: "Submission received" }

Server action in Next.js (App Router)

"use server";

export async function sendContact(formData: FormData) {
  const res = await fetch("https://splitforms.com/api/submit", {
    method: "POST",
    headers: { "Content-Type": "application/json", Accept: "application/json" },
    body: JSON.stringify({
      access_key: process.env.SPLITFORMS_KEY!,
      name: formData.get("name"),
      email: formData.get("email"),
      message: formData.get("message"),
    }),
    cache: "no-store",
  });
  if (!res.ok) throw new Error("submission failed");
  return { ok: true as const };
}

PHP (cURL)

<?php
$payload = json_encode([
    "access_key" => "YOUR_ACCESS_KEY",
    "name"       => "Ada Lovelace",
    "email"      => "[email protected]",
    "message"    => "Hello from PHP.",
]);

$ch = curl_init("https://splitforms.com/api/submit");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Content-Type: application/json",
    "Accept: application/json",
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($status !== 200) {
    throw new Exception("submit failed: $status $response");
}

$data = json_decode($response, true);
// $data === ['success' => true, 'message' => 'Submission received']

Ruby (Net::HTTP)

require "net/http"
require "uri"
require "json"

uri = URI("https://splitforms.com/api/submit")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

req = Net::HTTP::Post.new(uri.path, {
  "Content-Type" => "application/json",
  "Accept"       => "application/json",
})
req.body = {
  access_key: "YOUR_ACCESS_KEY",
  name:       "Ada Lovelace",
  email:      "[email protected]",
  message:    "Hello from Ruby.",
}.to_json

res = http.request(req)
raise "submit failed: #{res.code} #{res.body}" unless res.code == "200"

data = JSON.parse(res.body)
puts data # => {"success"=>true, "message"=>"Submission received"}

Go (net/http)

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
)

type Submission struct {
	AccessKey string `json:"access_key"`
	Name      string `json:"name"`
	Email     string `json:"email"`
	Message   string `json:"message"`
}

func main() {
	body, _ := json.Marshal(Submission{
		AccessKey: "YOUR_ACCESS_KEY",
		Name:      "Ada Lovelace",
		Email:     "[email protected]",
		Message:   "Hello from Go.",
	})

	req, _ := http.NewRequest("POST",
		"https://splitforms.com/api/submit",
		bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	out, _ := io.ReadAll(resp.Body)
	if resp.StatusCode != 200 {
		panic(fmt.Errorf("submit failed: %d %s", resp.StatusCode, out))
	}
	fmt.Println(string(out)) // {"success":true,"message":"Submission received"}
}

Rust (reqwest)

use reqwest::Client;
use serde_json::json;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = Client::new();
    let res = client
        .post("https://splitforms.com/api/submit")
        .header("Content-Type", "application/json")
        .header("Accept", "application/json")
        .json(&json!({
            "access_key": "YOUR_ACCESS_KEY",
            "name":       "Ada Lovelace",
            "email":      "[email protected]",
            "message":    "Hello from Rust.",
        }))
        .send()
        .await?;

    if !res.status().is_success() {
        let status = res.status();
        let body = res.text().await.unwrap_or_default();
        return Err(format!("submit failed: {status} {body}").into());
    }

    let data: serde_json::Value = res.json().await?;
    println!("{data}"); // {"success": true, "message": "Submission received"}
    Ok(())
}

File uploads

splitforms accepts file attachments via multipart/form-data. Files are stored alongside the submission and linked from the dashboard so recipients can download them. Uploads are a paid-plan feature (Pro and Annual) and are gated behind the Storage integration — connect it once in Dashboard → Integrations → Storage and every form on your account starts accepting attachments.

Limits

Free plan or Storage not connected

If a submission arrives with files on the Free plan, or on a paid plan without Storage connected, the API still saves the text fields. Files are dropped and a note is included in the JSON success response so the caller can surface a warning. If the account's storage is full, the note says so instead.

{
  "success": true,
  "message": "Submission received",
  "note": "Files were dropped — connect Storage in your dashboard to receive uploads."
}

Multipart example (cURL)

curl -X POST https://splitforms.com/api/submit \
  -F "access_key=YOUR_ACCESS_KEY" \
  -F "name=Ada Lovelace" \
  -F "[email protected]" \
  -F "message=Resume attached." \
  -F "resume=@/path/to/resume.pdf"

HTML form with file input

<form
  action="https://splitforms.com/api/submit"
  method="POST"
  enctype="multipart/form-data"
>
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input type="text"   name="name"   required />
  <input type="email"  name="email"  required />
  <input type="file"   name="resume" accept=".pdf,.doc,.docx" />
  <button type="submit">Send</button>
</form>

Honeypot (anti-spam)

splitforms ships a built-in honeypot — a hidden form field named botcheck that real users never fill in. When the field comes back non-empty, the API still returns HTTP 200 so the bot thinks it succeeded, but the submission is dropped: nothing is saved, and no email or webhook fires. The bot wastes its budget; you never see the noise.

How to add the honeypot

<input
  type="text"
  name="botcheck"
  tabindex="-1"
  autocomplete="off"
  style="position:absolute;left:-9999px;opacity:0"
/>

Behavior matrix

You can disable the honeypot per form by setting honeypot_mode to none in the dashboard. We recommend leaving it on — false positives are vanishingly rare.

CORS

You can call the submit endpoint with fetch from any site. It is fully cross-origin: any browser, any origin, any framework, no proxy needed. The response always includes:

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Accept
Access-Control-Max-Age: 86400

Browsers send an OPTIONS preflight for non-simple requests (e.g. Content-Type: application/json). splitforms responds 204 No Content with the same CORS headers, so the actual POST goes through without a hitch.

Because access_key lives in the client-side payload, open CORS is the right default. The key is protected from abuse by spam filtering, the per-IP rate limits and your plan's submission allowance. To restrict which sites can post from a browser, add your domains under Allowed Domains and turn on strict domain protection in the form's settings. Leave it off for server, mobile or curl clients, which don't send a browser Origin header.

API versioning policy

The submit endpoint is currently unversioned — the URL is just POST /api/submit. Treat this as v1, stable, additive-only:

• No breaking changes will ship at this URL. If we ever need to break the request or response shape, the new behavior will live at /api/v2/submit and the v1 URL will continue to work.
• New optional fields may be added. Treat unknown keys in responses as forward-compatible — don't parse with a strict schema that throws on unrecognized properties.
• The URL is a permanent part of your integration. You can hardcode it in HTML forms, server actions, mobile apps, and one-off scripts without worrying about a migration deadline.
• Status codes are stable. A 200 today is a 200 tomorrow. Branch on HTTP status, not on the human-readable message string.

Webhook delivery

Signed with HMAC-SHA256 (sha256= signature header); 8-second timeout; one automatic retry after about 2 seconds on network errors, timeouts and 5xx responses (4xx is not retried); delivery log in the dashboard. Paid plans (Pro and Annual).

When a submission is accepted, splitforms POSTs the payload to every active webhook for that form, plus any account-wide webhooks, in parallel. We auto-detect Slack, Discord, Google Chat, Microsoft Teams, Telegram and CallMeBot WhatsApp URLs and reformat for those; everything else gets the generic JSON payload below.

Headers we send

Generic payload shape

{
  "event": "submission.created",
  "submission": {
    "id": "3f9a2b7e-4c1d-4e9a-9b2f-7a6c1d3e4f5a",
    "form_name": "Contact",
    "data": {
      "name": "Ada Lovelace",
      "email": "[email protected]",
      "message": "Hello."
    },
    "ip_address": "203.0.113.7",
    "referer": "https://yoursite.com/contact",
    "created_at": "2026-05-04T14:31:04.123Z",
    "files": [
      {
        "field": "resume",
        "name": "ada-lovelace-resume.pdf",
        "size_bytes": 184320,
        "content_type": "application/pdf",
        "download_url": "https://…signed URL, valid ~7 days…"
      }
    ]
  }
}

files is present only when the submission carried stored uploads. Each download_url is a pre-signed direct link (no login required, expires after ~7 days) — fetch it from your endpoint or automation (Make, Zapier, n8n) to copy the file into your own storage, e.g. Google Drive or S3, before it expires.

Verifying the signature

Compute HMAC-SHA256 of the raw request body (don't parse and re-stringify) using your webhook secret. Compare in constant time to the value after sha256=.

import crypto from "node:crypto";

function verify(rawBody, header, secret) {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
  if (!header || header.length !== expected.length) return false;
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(header),
  );
}

Delivery semantics

• Timeout: 8 seconds per delivery attempt.
• Retries: one automatic retry after about 2 seconds when the attempt times out, can't connect or gets a 5xx. A 4xx response is not retried. If the retry also fails, the delivery is marked failed; the dashboard shows the last status and last error per webhook. After fixing an endpoint, send a new test submission to verify delivery.
• Ordering: not guaranteed. Multiple webhooks fire in parallel; if you need ordering, use a queue downstream.
• Idempotency: each submission has a unique submission.id — use it as your dedupe key. A retry after a timeout can deliver a submission your endpoint already processed.

Read submissions API

For dashboards, exports, or syncing leads into your own database, splitforms exposes a read-only endpoint over the submissions you already see in your inbox. It's authenticated with the same API token as the MCP server — generate it once at Dashboard → MCP.

Query parameters

Rows are always ordered newest first (created_at descending). The endpoint excludes recycle-bin (deleted) and spam-flagged submissions — the same baseline your dashboard inbox shows. Archived submissions are included: archiving hides a row from the inbox view, it doesn't delete it.

cURL

curl "https://splitforms.com/api/submissions?limit=50" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Example response:

{
  "submissions": [
    {
      "id": "b6d1f9de-8a3f-4b7e-9c2a-1f4e6d8b2c31",
      "form_id": "a1b2c3d4e5f647a89b0c1d2e3f4a5b6c",
      "created_at": "2026-07-08T14:31:04.123Z",
      "data": {
        "name": "Ada Lovelace",
        "email": "[email protected]",
        "message": "Hello."
      },
      "is_spam": false
    },
    {
      "id": "7c2e4a1b-9f3d-4c8a-b1e6-2d5f8a9c3b47",
      "form_id": "a1b2c3d4e5f647a89b0c1d2e3f4a5b6c",
      "created_at": "2026-07-08T13:02:11.045Z",
      "data": {
        "name": "Grace Hopper",
        "email": "[email protected]",
        "message": "Bug found."
      },
      "is_spam": false
    }
  ],
  "has_more": true
}

Paging through results

There's no page-number or offset counting — pass the created_at of the oldest row you received as before to fetch the next batch, and stop once has_more comes back false.

curl "https://splitforms.com/api/submissions?limit=50&before=2026-07-08T13:02:11.045Z" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Filter to one form

curl "https://splitforms.com/api/submissions?form=a1b2c3d4e5f647a89b0c1d2e3f4a5b6c" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

form also accepts the form's access_key (the same value used with POST /api/submit), so you don't need to look up the internal form id separately.

Errors

Every error response is JSON with { "error": "…" } — branch on the HTTP status, not the message text.

Rate limit

60 requests per minute per API token — independent of the POST /api/submit limits above. Responses always send Cache-Control: no-store, so cache the result on your end if you're polling on an interval.

SDKs and libraries

TypeScript and JavaScript — use fetch

There is no SDK to install. The endpoint takes standard FormData or JSON, so fetch is the whole integration — this snippet is complete and typed, with no dependency to add or keep up to date.

type SubmitResult =
  | {
      success: true;
      message: string;
      redirect?: string; // hidden redirect field, validated
      note?: string; // files were dropped
      files?: { received: number; stored: number; hint?: string };
    }
  | { success: false; message: string; code?: string };

export async function submit(fields: Record<string, string>) {
  const res = await fetch("https://splitforms.com/api/submit", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      access_key: process.env.NEXT_PUBLIC_SPLITFORMS_KEY,
      ...fields,
    }),
  });

  const result = (await res.json()) as SubmitResult;
  if (!result.success) throw new Error(result.message);
  return result;
}

Sending a real <form>? Pass new FormData(form) as the body and drop the Content-Type header — the browser sets the multipart boundary for you, and file inputs are carried automatically.

Other languages — use the platform HTTP client

We don't publish per-language SDKs for a one-endpoint API. Every modern language ships a perfectly capable HTTP client; using it is one fewer dependency to keep current.

• Browsers: fetch or a plain <form action>.
• Node.js: built-in fetch (Node 18+) or undici.
• Python: requests or httpx.
• Go: net/http.
• Ruby: Net::HTTP or faraday.
• PHP: cURL or Guzzle.
• Rust: reqwest with tokio.
• AI agents: the splitforms MCP server exposes form/submission tools to Claude Code, Cursor, Windsurf.

How to test

Two recommended paths for confirming an integration works without polluting your real submissions table.

1. The hosted live test form

Visit splitforms.com/test-form for a working /api/submit form wired up to a sandbox key. Use it to confirm the endpoint is up, see exactly what a successful response looks like, and spot-check email delivery.

2. cURL against your real key

Fastest way to confirm your key works. The submission shows up in your dashboard immediately — delete it after if you don't want it cluttering your table.

curl -X POST https://splitforms.com/api/submit \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "access_key": "YOUR_ACCESS_KEY",
    "name": "Test from cURL",
    "email": "[email protected]",
    "message": "Confirming integration works."
  }'

Expected response:

{ "success": true, "message": "Submission received" }

Testing webhooks

In Dashboard → Integrations → Webhooks, every webhook has a Test button that fires a sample submission.created payload signed with your real secret. Use it to verify your signature verification logic before going live.

Common errors and one-line fixes

For a deeper troubleshooting guide (webhook timeouts, deliverability, CORS, honeypot misfires) see the docs troubleshooting section.

HTTP 400 — "Missing access_key"

You posted a form without the access_key field, or with an empty value. Add <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" /> inside your form, or include access_key in your JSON body.

HTTP 404 — "Invalid access_key"

The supplied key doesn't match any form on any account. Most often: trailing whitespace pasted with the key, or a stale value served from a CDN cache after a key rotation. Re-copy from the dashboard.

HTTP 429 — "Too many submissions"

You hit the per-IP burst limit of 6 submissions per minute for this form, or the sustained limit of 20 per 15 minutes. No Retry-After header is sent — wait 60 seconds and retry. If you see this from real users, it's almost always a script retrying on every keystroke instead of on submit.

HTTP 415 — "Unsupported content type"

The request had no Content-Type, or one the endpoint doesn't accept. The usual cause is fetch with a JSON.stringify() body and no headers, which browsers send as text/plain. Add Content-Type: application/json, or post a FormData object instead.

API FAQ