Forms from your own front end

Forms are built in the admin (Site → Forms). Each has a slug and questions, and each question an id. The form's Integration tab shows its endpoint, its write key and a working snippet.

The endpoint

POST https://intake.foundationcms.org/v1/<site>/forms/<slug>    works from day one
POST https://intake.<your domain>/forms/<slug>                    once the intake address is set up (no CORS preflight)

Content-Type: application/json
x-foundation-key: <the form's write key>

{ "q_name": "Amara Reid", "q_email": "amara@example.com", "q_message": "…",
  "cf-turnstile-response": "<token>" }

Answers are keyed by question id. A question the form does not ask is refused, so post only the form's own ids.

The human check

When the site has a check in force (Settings → Site → Spam protection: Cloudflare Turnstile by default, or Google reCAPTCHA), draw its widget inside your form with the site key shown there, and send the token it writes — cf-turnstile-response or g-recaptcha-response — with the answers. Wait for the token before submitting: a form sent before the check finishes is refused.

Keep the key server-side if you can

Foundation's own sites post the form to their own Worker, which adds the write key and the visitor's address and forwards it, so the key never reaches the browser. A key in a page's source still only lets someone submit that one form, and the limits below still apply — but server-side is better.

What comes back