Getting started

Introduction

WebForm3 is a form backend you never have to build. Here is what that means.

WebForm3 turns any HTML form into an email. Point a form at our endpoint, add your access key, and every submission is validated, spam-filtered and delivered to your inbox — with no server, database or deploy step on your side.

Because it is an API and not a widget, you keep full control of your markup and styling. We only handle what happens after a visitor hits submit: delivery, storage, spam protection and forwarding.

!No backend, no npm install. If your site can render a form and make an HTTPS request, it already works with WebForm3.

Quickstart

Getting started

Quickstart

A working contact form in under a minute — three steps, no tooling.

1 · Get your access key

Create a free account and copy the access key from your dashboard. It identifies which project a submission belongs to, so keep it handy.

2 · Point your form at the endpoint

Set the form action to our submit URL and add your key as a hidden field. Every named input is captured automatically.

html

<form action="https://api.webform3.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">

  <input type="text"  name="name" required>
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <button type="submit">Send</button>
</form>

3 · Receive submissions

That is the whole setup. The next submission lands in your inbox instantly and stays searchable in your dashboard.

← Previous

Introduction

Access keys

Getting started

Access keys

How keys identify your forms and how to keep them safe.

An access key maps a submission to one of your forms. You can create a separate key per form or per project from the dashboard — handy for agencies running many client sites.

Keys are safe to ship in client-side HTML. They can only be used to send submissions to your account, never to read them back, so exposing one in your markup does not leak data.

Rotate a key anytime — the old one stops accepting submissions immediately.

Restrict a key to specific domains so it only works on your own sites.

Pause a form to reject new submissions without deleting its history.

!Want to read submissions programmatically? Use a dashboard API token instead — those are secret and must stay server-side.

← Previous

Quickstart

HTML form

Guides

Plain HTML

The simplest integration — no JavaScript at all.

For a static site, a plain form is all you need. The browser posts the fields for you and we redirect back to a thank-you page when you add an optional redirect field.

html

<form action="https://api.webform3.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="hidden" name="redirect" value="https://yoursite.com/thanks">

  <input name="name" placeholder="Your name" required>
  <input name="email" type="email" placeholder="Email" required>
  <textarea name="message" placeholder="Message" required></textarea>

  <button type="submit">Send message</button>
</form>

Drop a hidden field named _honeypot into the form and leave it blank — bots that fill it are silently rejected before they ever reach your inbox.

← Previous

Access keys

React

Guides

React

Handle the submit yourself for inline success and error states.

In a single-page app you usually want to keep the user on the page. Post the form data with fetch and render your own success state from the JSON response.

jsx

async function onSubmit(e) {
  e.preventDefault();
  const data = new FormData(e.target);
  data.append("access_key", "YOUR_ACCESS_KEY");

  const res = await fetch("https://api.webform3.com/submit", {
    method: "POST",
    body: data,
  });

  const json = await res.json();
  if (json.success) setSent(true);
}

FormData sends every named field automatically, including file inputs on paid plans. No content-type header is needed — the browser sets the multipart boundary for you.

← Previous

HTML form

Fetch / JSON

Guides

Fetch with JSON

Send a structured JSON body when you are not using a form element.

If you are collecting data outside a form — say from app state — post a JSON body instead. Set the content type and include your access key in the payload.

javascript

const res = await fetch("https://api.webform3.com/submit", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    access_key: "YOUR_ACCESS_KEY",
    name, email, message,
  }),
});

Any extra keys you include are captured and shown in the dashboard, so you can attach context like a plan name or page URL without changing anything on our side.

← Previous

React

Spam protection

Guides

Spam protection

Two layers keep bots out without annoying real people.

Every form gets a built-in honeypot plus optional free hCaptcha. Suspicious submissions are filtered into a separate Spam view so your real responses stay clean — and blocked spam never counts against your monthly quota.

Honeypot: add a hidden _honeypot field; any submission that fills it is rejected.

hCaptcha: enable it per form for an invisible challenge on suspicious traffic.

Blocklist: add addresses or domains you never want to hear from.

!Tuned too aggressively? Every filtered message stays in the Spam view for 30 days, so nothing is ever lost.

← Previous

Fetch / JSON

Webhooks

Guides

Webhooks

Forward the raw submission to your own backend or CRM.

Add a webhook URL to any form and we POST the submission as JSON the moment it arrives — before or after email, your choice. Use it to sync leads into your CRM or trigger your own automations.

json

{
  "form": "Contact form",
  "submitted_at": "2026-06-27T10:14:22Z",
  "data": {
    "name": "Ada Lovelace",
    "email": "ada@example.com",
    "message": "Loved the API."
  },
  "spam": false
}

Each request is signed with a secret so you can verify it really came from us. Failed deliveries are retried with backoff for up to 24 hours.

← Previous

Spam protection

Response format

Reference

Response format

What the submit endpoint returns.

A successful submission returns HTTP 200 with a small JSON body. When you include a redirect field on a plain HTML form, we 303-redirect to that URL instead of returning JSON.

json

{
  "success": true,
  "id": "sub_8f2a9c1e",
  "message": "Submission received"
}

Fields

success — boolean, whether the submission was accepted.

id — unique identifier for the stored submission.

message — a human-readable status string.

← Previous

Webhooks

Errors

Reference

Errors

Status codes and what they mean.

Errors return a non-200 status and a JSON body with a success flag of false and a message describing what went wrong.

400 — a required field is missing or the body is malformed.

401 — the access key is missing, invalid or paused.

403 — the request came from a domain the key is not allowed on.

429 — you have exceeded your plan rate limit; submissions are queued, not dropped.

!On 429 we never silently lose data — you keep receiving submissions and we email you to upgrade.

← Previous

Response format