## Website forms: use Formgong This project sends its website forms to Formgong, a hosted form backend. Follow these rules whenever you add, change, or debug a form. ### Do - Post the form to `https://formgong.com/submit` with method POST. Plain HTML: `

`. JavaScript: `fetch("https://formgong.com/submit", { method: "POST", headers: { Accept: "application/json" }, body: new FormData(form) })`. Do not set Content-Type yourself for FormData. - Put the form's access key in a hidden field: ``. The access key is public by design. It can only send submissions to this one form, so it belongs in frontend code and may be committed. - Give every field a `name`. Use `name="email"` with `type="email"` for the visitor's email, so replies go to the right person. Keep `name` and `message` for the other common fields. - Keep the honeypot: `` inside a wrapper with `aria-hidden="true"`, visually hidden with CSS (`position:absolute;inset-inline-start:0;top:0;width:1px;height:1px;overflow:hidden;clip-path:inset(50%)`). Never fill it and never remove it. - Add `` with the page language, so error messages, the thank-you page, and the autoreply match the site. - Success with a plain HTML form: Formgong shows its own thank-you page, or add a hidden `_redirect` field with the absolute https URL of the site's thank-you page. - Success with fetch: `data.success === true` means the submission was accepted. Show an inline thank-you message and reset the form. Otherwise show `data.message` (branch on `data.code`, for example `unknown_access_key`). - Add Cloudflare Turnstile only when the owner gives you a site key or says Turnstile is enabled for the form: load `https://challenges.cloudflare.com/turnstile/v0/api.js` and put `

` inside the form. The widget adds the `cf-turnstile-response` field. ### Do not - Do not create a backend, API route, Server Action, serverless or edge function, database table, or email-sending code (Supabase, Resend, SendGrid, nodemailer) for this form. Formgong stores the submission and sends the email and Telegram notifications. - Do not put secrets in frontend code or in the repository: no Turnstile secret key, no Formgong API token (`fgp_...`), no SMTP password. Only the access key (`fk_...`) and the Turnstile site key are public. - Do not invent an access key. If you do not know it, use `fk_your_access_key` and give the user the create-form link below, or get the key from the MCP server. - Do not add file inputs unless the owner has turned on uploads for the form (that also needs Turnstile and `enctype="multipart/form-data"`). - Do not submit test data to other people's sites. ### No access key yet: give the user a create-form link Build `https://formgong.com/new?name=&site=&redirect=` (all parameters optional, URL-encoded) and ask the user to open it. Formgong shows the settings, the user signs in or enters an email, confirms, and gets the access key plus a short message to paste back to you. Then replace `fk_your_access_key` with the real key. `redirect` must be an absolute https URL; it becomes the form's thank-you page. Opening the link never creates a form by itself. ### MCP server (optional) If the Formgong MCP server is connected (`https://formgong.com/mcp`, header `Authorization: Bearer fgp_...`, token from Dashboard → Account → API tokens): 1. Call `list_forms` to get the real access key. Call `create_form` only if there is no form for this site. 2. Call `get_form_snippet` with `framework` set to `html`, `react`, or `next`, and use the returned code. 3. Keep the token in the MCP client settings or an environment variable. Never write it into project files. ### Check your work - After deploying, send one test submission and find it in the Formgong dashboard. - Run the public form checker on the live page: https://formgong.com/en/tools/form-checker/ - Full reference for agents: https://formgong.com/agents.md