Public form key and private access
Distinguish the browser-safe intake key from private management credentials.
What the public key does
HTML sends the key as _fq_key and JSON sends it as form_key. It identifies the form that receives fields and may be visible in source code.
The key cannot read previous submissions or modify account settings. Schema validation, origin policy, rate limits, and abuse controls protect the public intake path.
Use and rotate the key
- Copy the key from the intended form, not a workspace or project identifier.
- Confirm that the form is active and its current configuration is published.
- After rotation, update every installed page and verify each origin before retiring the old key.
Keep management credentials server-side
API tokens, provider keys, CAPTCHA secrets, and connection credentials must never appear in HTML, a public repository, browser storage, or a support screenshot.
Documentation reviewed on October 20, 2026Suggest an improvement →