Regeldateien für Agenten: Formgong-Formulare

# AGENTS.md

<!-- Formgong form rules. Source: https://formgong.com/agent-rules/AGENTS.md -->

## Website forms: use Formgong

This project sends its website forms to Formgong, a hosted form backend. Follow these rules whenever you add, change, or debug a form.

### Do

- Post the form to `https://formgong.com/submit` with method POST. Plain HTML: `<form action="https://formgong.com/submit" method="POST">`. JavaScript: `fetch("https://formgong.com/submit", { method: "POST", headers: { Accept: "application/json" }, body: new FormData(form) })`. Do not set Content-Type yourself for FormData.
- Put the form's access key in a hidden field: `<input type="hidden" name="access_key" value="fk_...">`. The access key is public by design. It can only send submissions to this one form, so it belongs in frontend code and may be committed.
- Give every field a `name`. Use `name="email"` with `type="email"` for the visitor's email, so replies go to the right person. Keep `name` and `message` for the other common fields.
- Keep the honeypot: `<input type="text" name="botcheck" tabindex="-1" autocomplete="off">` inside a wrapper with `aria-hidden="true"`, visually hidden with CSS (`position:absolute;inset-inline-start:0;top:0;width:1px;height:1px;overflow:hidden;clip-path:inset(50%)`). Never fill it and never remove it.
- Add `<input type="hidden" name="_lang" value="en">` with the page language, so error messages, the thank-you page, and the autoreply match the site.
- Success with a plain HTML form: Formgong shows its own thank-you page, or add a hidden `_redirect` field with the absolute https URL of the site's thank-you page.
- Success with fetch: `data.success === true` means the submission was accepted. Show an inline thank-you message and reset the form. Otherwise show `data.message` (branch on `data.code`, for example `unknown_access_key`).
- Add Cloudflare Turnstile only when the owner gives you a site key or says Turnstile is enabled for the form: load `https://challenges.cloudflare.com/turnstile/v0/api.js` and put `<div class="cf-turnstile" data-sitekey="SITE_KEY"></div>` inside the form. The widget adds the `cf-turnstile-response` field.

### Do not

- Do not create a backend, API route, Server Action, serverless or edge function, database table, or email-sending code (Supabase, Resend, SendGrid, nodemailer) for this form. Formgong stores the submission and sends the email and Telegram notifications.
- Do not put secrets in frontend code or in the repository: no Turnstile secret key, no Formgong API token (`fgp_...`), no SMTP password. Only the access key (`fk_...`) and the Turnstile site key are public.
- Do not invent an access key. If you do not know it, use `fk_your_access_key` and give the user the create-form link below, or get the key from the MCP server.
- Do not add file inputs unless the owner has turned on uploads for the form (that also needs Turnstile and `enctype="multipart/form-data"`).
- Do not submit test data to other people's sites.

### No access key yet: give the user a create-form link

Build `https://formgong.com/new?name=<form name>&site=<site URL>&redirect=<thank-you URL>` (all parameters optional, URL-encoded) and ask the user to open it. Formgong shows the settings, the user signs in or enters an email, confirms, and gets the access key plus a short message to paste back to you. Then replace `fk_your_access_key` with the real key. `redirect` must be an absolute https URL; it becomes the form's thank-you page. Opening the link never creates a form by itself.

### MCP server (optional)

If the Formgong MCP server is connected (`https://formgong.com/mcp`, header `Authorization: Bearer fgp_...`, token from Dashboard → Account → API tokens):

1. Call `list_forms` to get the real access key. Call `create_form` only if there is no form for this site.
2. Call `get_form_snippet` with `framework` set to `html`, `react`, or `next`, and use the returned code.
3. Keep the token in the MCP client settings or an environment variable. Never write it into project files.

### Check your work

- After deploying, send one test submission and find it in the Formgong dashboard.
- Run the public form checker on the live page: https://formgong.com/en/tools/form-checker/
- Full reference for agents: https://formgong.com/agents.md

# CLAUDE.md

<!-- Formgong form rules for Claude Code. Source: https://formgong.com/agent-rules/CLAUDE.md -->
<!-- If this repository already has these rules in AGENTS.md, this file can be one line instead: @AGENTS.md -->

## Website forms: use Formgong

This project sends its website forms to Formgong, a hosted form backend. Follow these rules whenever you add, change, or debug a form.

### Do

- Post the form to `https://formgong.com/submit` with method POST. Plain HTML: `<form action="https://formgong.com/submit" method="POST">`. JavaScript: `fetch("https://formgong.com/submit", { method: "POST", headers: { Accept: "application/json" }, body: new FormData(form) })`. Do not set Content-Type yourself for FormData.
- Put the form's access key in a hidden field: `<input type="hidden" name="access_key" value="fk_...">`. The access key is public by design. It can only send submissions to this one form, so it belongs in frontend code and may be committed.
- Give every field a `name`. Use `name="email"` with `type="email"` for the visitor's email, so replies go to the right person. Keep `name` and `message` for the other common fields.
- Keep the honeypot: `<input type="text" name="botcheck" tabindex="-1" autocomplete="off">` inside a wrapper with `aria-hidden="true"`, visually hidden with CSS (`position:absolute;inset-inline-start:0;top:0;width:1px;height:1px;overflow:hidden;clip-path:inset(50%)`). Never fill it and never remove it.
- Add `<input type="hidden" name="_lang" value="en">` with the page language, so error messages, the thank-you page, and the autoreply match the site.
- Success with a plain HTML form: Formgong shows its own thank-you page, or add a hidden `_redirect` field with the absolute https URL of the site's thank-you page.
- Success with fetch: `data.success === true` means the submission was accepted. Show an inline thank-you message and reset the form. Otherwise show `data.message` (branch on `data.code`, for example `unknown_access_key`).
- Add Cloudflare Turnstile only when the owner gives you a site key or says Turnstile is enabled for the form: load `https://challenges.cloudflare.com/turnstile/v0/api.js` and put `<div class="cf-turnstile" data-sitekey="SITE_KEY"></div>` inside the form. The widget adds the `cf-turnstile-response` field.

### Do not

- Do not create a backend, API route, Server Action, serverless or edge function, database table, or email-sending code (Supabase, Resend, SendGrid, nodemailer) for this form. Formgong stores the submission and sends the email and Telegram notifications.
- Do not put secrets in frontend code or in the repository: no Turnstile secret key, no Formgong API token (`fgp_...`), no SMTP password. Only the access key (`fk_...`) and the Turnstile site key are public.
- Do not invent an access key. If you do not know it, use `fk_your_access_key` and give the user the create-form link below, or get the key from the MCP server.
- Do not add file inputs unless the owner has turned on uploads for the form (that also needs Turnstile and `enctype="multipart/form-data"`).
- Do not submit test data to other people's sites.

### No access key yet: give the user a create-form link

Build `https://formgong.com/new?name=<form name>&site=<site URL>&redirect=<thank-you URL>` (all parameters optional, URL-encoded) and ask the user to open it. Formgong shows the settings, the user signs in or enters an email, confirms, and gets the access key plus a short message to paste back to you. Then replace `fk_your_access_key` with the real key. `redirect` must be an absolute https URL; it becomes the form's thank-you page. Opening the link never creates a form by itself.

### MCP server (optional)

If the Formgong MCP server is connected (`https://formgong.com/mcp`, header `Authorization: Bearer fgp_...`, token from Dashboard → Account → API tokens):

1. Call `list_forms` to get the real access key. Call `create_form` only if there is no form for this site.
2. Call `get_form_snippet` with `framework` set to `html`, `react`, or `next`, and use the returned code.
3. Keep the token in the MCP client settings or an environment variable. Never write it into project files.

### Check your work

- After deploying, send one test submission and find it in the Formgong dashboard.
- Run the public form checker on the live page: https://formgong.com/en/tools/form-checker/
- Full reference for agents: https://formgong.com/agents.md

---
description: Formgong form rules. Use when adding, editing, or debugging a website form, contact page, or form submission.
alwaysApply: false
---

<!-- Save as .cursor/rules/formgong.mdc. Source: https://formgong.com/agent-rules/formgong.mdc -->

## Website forms: use Formgong

This project sends its website forms to Formgong, a hosted form backend. Follow these rules whenever you add, change, or debug a form.

### Do

- Post the form to `https://formgong.com/submit` with method POST. Plain HTML: `<form action="https://formgong.com/submit" method="POST">`. JavaScript: `fetch("https://formgong.com/submit", { method: "POST", headers: { Accept: "application/json" }, body: new FormData(form) })`. Do not set Content-Type yourself for FormData.
- Put the form's access key in a hidden field: `<input type="hidden" name="access_key" value="fk_...">`. The access key is public by design. It can only send submissions to this one form, so it belongs in frontend code and may be committed.
- Give every field a `name`. Use `name="email"` with `type="email"` for the visitor's email, so replies go to the right person. Keep `name` and `message` for the other common fields.
- Keep the honeypot: `<input type="text" name="botcheck" tabindex="-1" autocomplete="off">` inside a wrapper with `aria-hidden="true"`, visually hidden with CSS (`position:absolute;inset-inline-start:0;top:0;width:1px;height:1px;overflow:hidden;clip-path:inset(50%)`). Never fill it and never remove it.
- Add `<input type="hidden" name="_lang" value="en">` with the page language, so error messages, the thank-you page, and the autoreply match the site.
- Success with a plain HTML form: Formgong shows its own thank-you page, or add a hidden `_redirect` field with the absolute https URL of the site's thank-you page.
- Success with fetch: `data.success === true` means the submission was accepted. Show an inline thank-you message and reset the form. Otherwise show `data.message` (branch on `data.code`, for example `unknown_access_key`).
- Add Cloudflare Turnstile only when the owner gives you a site key or says Turnstile is enabled for the form: load `https://challenges.cloudflare.com/turnstile/v0/api.js` and put `<div class="cf-turnstile" data-sitekey="SITE_KEY"></div>` inside the form. The widget adds the `cf-turnstile-response` field.

### Do not

- Do not create a backend, API route, Server Action, serverless or edge function, database table, or email-sending code (Supabase, Resend, SendGrid, nodemailer) for this form. Formgong stores the submission and sends the email and Telegram notifications.
- Do not put secrets in frontend code or in the repository: no Turnstile secret key, no Formgong API token (`fgp_...`), no SMTP password. Only the access key (`fk_...`) and the Turnstile site key are public.
- Do not invent an access key. If you do not know it, use `fk_your_access_key` and give the user the create-form link below, or get the key from the MCP server.
- Do not add file inputs unless the owner has turned on uploads for the form (that also needs Turnstile and `enctype="multipart/form-data"`).
- Do not submit test data to other people's sites.

### No access key yet: give the user a create-form link

Build `https://formgong.com/new?name=<form name>&site=<site URL>&redirect=<thank-you URL>` (all parameters optional, URL-encoded) and ask the user to open it. Formgong shows the settings, the user signs in or enters an email, confirms, and gets the access key plus a short message to paste back to you. Then replace `fk_your_access_key` with the real key. `redirect` must be an absolute https URL; it becomes the form's thank-you page. Opening the link never creates a form by itself.

### MCP server (optional)

If the Formgong MCP server is connected (`https://formgong.com/mcp`, header `Authorization: Bearer fgp_...`, token from Dashboard → Account → API tokens):

1. Call `list_forms` to get the real access key. Call `create_form` only if there is no form for this site.
2. Call `get_form_snippet` with `framework` set to `html`, `react`, or `next`, and use the returned code.
3. Keep the token in the MCP client settings or an environment variable. Never write it into project files.

### Check your work

- After deploying, send one test submission and find it in the Formgong dashboard.
- Run the public form checker on the live page: https://formgong.com/en/tools/form-checker/
- Full reference for agents: https://formgong.com/agents.md

<!-- Formgong form rules for Windsurf. Append to .windsurfrules in the project root. Source: https://formgong.com/agent-rules/windsurfrules.md -->

## Website forms: use Formgong

This project sends its website forms to Formgong, a hosted form backend. Follow these rules whenever you add, change, or debug a form.

### Do

- Post the form to `https://formgong.com/submit` with method POST. Plain HTML: `<form action="https://formgong.com/submit" method="POST">`. JavaScript: `fetch("https://formgong.com/submit", { method: "POST", headers: { Accept: "application/json" }, body: new FormData(form) })`. Do not set Content-Type yourself for FormData.
- Put the form's access key in a hidden field: `<input type="hidden" name="access_key" value="fk_...">`. The access key is public by design. It can only send submissions to this one form, so it belongs in frontend code and may be committed.
- Give every field a `name`. Use `name="email"` with `type="email"` for the visitor's email, so replies go to the right person. Keep `name` and `message` for the other common fields.
- Keep the honeypot: `<input type="text" name="botcheck" tabindex="-1" autocomplete="off">` inside a wrapper with `aria-hidden="true"`, visually hidden with CSS (`position:absolute;inset-inline-start:0;top:0;width:1px;height:1px;overflow:hidden;clip-path:inset(50%)`). Never fill it and never remove it.
- Add `<input type="hidden" name="_lang" value="en">` with the page language, so error messages, the thank-you page, and the autoreply match the site.
- Success with a plain HTML form: Formgong shows its own thank-you page, or add a hidden `_redirect` field with the absolute https URL of the site's thank-you page.
- Success with fetch: `data.success === true` means the submission was accepted. Show an inline thank-you message and reset the form. Otherwise show `data.message` (branch on `data.code`, for example `unknown_access_key`).
- Add Cloudflare Turnstile only when the owner gives you a site key or says Turnstile is enabled for the form: load `https://challenges.cloudflare.com/turnstile/v0/api.js` and put `<div class="cf-turnstile" data-sitekey="SITE_KEY"></div>` inside the form. The widget adds the `cf-turnstile-response` field.

### Do not

- Do not create a backend, API route, Server Action, serverless or edge function, database table, or email-sending code (Supabase, Resend, SendGrid, nodemailer) for this form. Formgong stores the submission and sends the email and Telegram notifications.
- Do not put secrets in frontend code or in the repository: no Turnstile secret key, no Formgong API token (`fgp_...`), no SMTP password. Only the access key (`fk_...`) and the Turnstile site key are public.
- Do not invent an access key. If you do not know it, use `fk_your_access_key` and give the user the create-form link below, or get the key from the MCP server.
- Do not add file inputs unless the owner has turned on uploads for the form (that also needs Turnstile and `enctype="multipart/form-data"`).
- Do not submit test data to other people's sites.

### No access key yet: give the user a create-form link

Build `https://formgong.com/new?name=<form name>&site=<site URL>&redirect=<thank-you URL>` (all parameters optional, URL-encoded) and ask the user to open it. Formgong shows the settings, the user signs in or enters an email, confirms, and gets the access key plus a short message to paste back to you. Then replace `fk_your_access_key` with the real key. `redirect` must be an absolute https URL; it becomes the form's thank-you page. Opening the link never creates a form by itself.

### MCP server (optional)

If the Formgong MCP server is connected (`https://formgong.com/mcp`, header `Authorization: Bearer fgp_...`, token from Dashboard → Account → API tokens):

1. Call `list_forms` to get the real access key. Call `create_form` only if there is no form for this site.
2. Call `get_form_snippet` with `framework` set to `html`, `react`, or `next`, and use the returned code.
3. Keep the token in the MCP client settings or an environment variable. Never write it into project files.

### Check your work

- After deploying, send one test submission and find it in the Formgong dashboard.
- Run the public form checker on the live page: https://formgong.com/en/tools/form-checker/
- Full reference for agents: https://formgong.com/agents.md