# Is it safe to put a form access key in your HTML?

A form backend's access key is public by design. What someone can do with a copied key, what they cannot, and which checks stop curl.

Author: Formgong
Published: 2026-10-31
Language: en
Canonical: https://formgong.com/en/blog/form-access-key-public/

Yes. A form backend's access key only says which form a submission belongs to: anyone can copy it and post to your form, but it cannot read your submissions or change your settings. Allowed domains stop other websites' browsers and not scripts, because curl can send any Origin header it likes, so forged posts are stopped on the server by the spam filter and rate limits, and by a captcha if you turn one on.

## The key is an address, not a password

You copy a snippet from Web3Forms, Static Forms, Splitforms or Formgong, and there is your key in plain sight: `<input type="hidden" name="access_key" value="...">`. It feels wrong to leave it there. It is fine.

The key does one job. It tells the service which form, and so which inbox, a submission belongs to. Formspree and Forminit do the same with a form ID in the URL. The vendors say this openly. Web3Forms' own example says of the key, "Don't worry this can be public." Splitforms' docs call it "a public identifier, not a secret."

Hiding it does not work anyway. A hidden input is in the page source. A `NEXT_PUBLIC_` or `VITE_` variable is written into the JavaScript the browser downloads. If the browser needs the key to send the form, anyone with a browser can read it.

## What someone can do with your key

With your key, a stranger can send submissions to your form, from a script or from a copy of your form on their own page. That is the whole list. In practice that means:

- **Junk in your inbox.** Anything that gets past the spam checks reaches your email or Telegram like a real enquiry.

- **Your monthly submissions.** On most services, every accepted post counts. On Formgong, posts that land in Spam do not count, but clean-looking forged posts do. At the per-form limit of 30 a minute, a flood could use Free's 250 in about 9 minutes.

- **Your real visitors blocked for a minute.** A per-form limit protects your quota, and while a flood is hitting it, a real visitor in that same minute gets "too many requests" too.

What the key cannot do: read your submissions, see who receives them, change settings, add a webhook or delete anything. On Formgong those need your login or a personal API token, which is a different credential: it starts with `fgp_`, is shown once, is stored only as a hash, and reading submissions is a scope you have to tick separately. That token, your webhook signing secret and a captcha secret key are the things that must never be in a web page.

## Why allowed domains stop browsers but not curl

Every backend in this article has some form of domain restriction. You list your site, and the service checks which page the post came from. It reads that from a header: `Origin`, `Referer` or both.

A browser fills in `Origin` itself, and JavaScript on a page cannot change it. So if someone copies your form onto `other.example`, every visitor's browser says so, and the post is refused. That part works well.

curl, Python or any server is not a browser. It sends whatever headers it is told to: `curl -H "Origin: https://yoursite.com"` is one line. Splitforms' docs say it directly: "Do not treat a Referer or Origin header as proof of a visitor's identity." Domain restriction stops your form being reused on other sites. It does not stop someone who writes a script against your form.

Formgong reads `Origin` first and falls back to `Referer` only when there is no `Origin`. A post with neither header is refused once you have set allowed domains, and so is `Origin: null`. Your domain covers its subdomains, so `yoursite.com` lets `www.yoursite.com` through but not `yoursite.com.other.example`. Add `localhost` to the list while you test on your own machine.

## What each form backend offers against a copied key

From each service's own docs on 31 October 2026. "Server-side post" is what our round-3 test saw on 29 October 2026 for a post with no Origin and no Referer. "Not stated" means we could not find it on their pages.
ServiceWhat sits in your pageDomain restrictionHeader it readsServer-side postRate limit
[Web3Forms](/en/web3forms-alternative/)access_key in the form, "can be public"Restrict to Domain, Pro onlyNot statedBlocked unless on a paid plan with your server's IP allowed (we got 403)429 documented, number not stated
[Formspree](/en/formspree-alternative/)Form ID in the URLRestrict to Domain, all plans; others go to spamRefererAccepted20 posts a minute per form
[Static Forms](/en/staticforms-alternative/)apiKey in the formDomain restriction, from the Starter planOrigin or RefererAcceptedNot stated
[Forminit](/en/forminit-alternative/)Form ID in the URLAuthorized Domains, plan not stated; others go to spam"Referrers"Accepted (public mode)1 per 5 seconds per IP
[Splitforms](/en/splitforms-alternative/)access_key in the form, "a public identifier"Allowed domains, plus a strict mode that drops other originsOriginAccepted6 a minute and 20 per 15 minutes, per IP
Formgongaccess_key in the form, public by designAllowed domains, every plan including Free; others refusedOrigin, or Referer when there is no OriginAccepted, unless allowed domains are set20 a minute per IP, 30 a minute per form
Two of them stand out. Web3Forms is the only one that refused a post from a server outright. Its docs say "Server side usage requires paid plan + server IP whitelisting," and in our test a plain curl post got 403. That stops a basic script. We could not tell what the block looks at; a browser fetch from another website got through it, so it is not a domain check. Formspree and Forminit don't refuse a post from the wrong domain: they put it in your spam folder, so you can still find it.

The rate limits differ a lot. In the same round-3 test, 30 posts in a row with a wrong key got a 429 at post 21 from Formspree and at post 7 from Splitforms, as their docs describe, and at post 10 from Static Forms' hosting firewall. The other 6 of the 9 we could test did not limit a wrong key at all. That says nothing about their real forms, since a service may count only posts to a form that exists.

## What a forged request gets past, checked in the code

We did not fire forged posts at live forms. Instead we took Formgong's own check functions from its source (the domain check, the spam score, the block list, the browser-signal rule and the rate limits), ran them in Node on made-up requests, and recorded what each one decided.

Formgong's own check functions run on forged requests in Node, 31 October 2026. Nothing was sent to any server.
Forged requestWhat Formgong does
curl, no Origin, no Referer, allowed domains emptyAccepted and delivered
curl, no Origin, no Referer, allowed domains setRefused, 403
A browser on another websiteRefused, 403
Origin: null (sandboxed frame)Refused, 403
curl with Origin: https://yoursite.comAccepted and delivered
curl with only a Referer from www.yoursite.comAccepted and delivered
curl with Origin: https://yoursite.com.other.exampleRefused, 403
Faked Origin, Require browser signals on, no fg.js fieldsAnswered as sent, kept in Spam, not delivered, not counted
Four links in the messageAccepted, scored 50 of the 60 that makes spam
A stop word such as "seo services"Spam
Sender's email domain on your block listSpam
Post 21 from one IP within a minute429
Post 31 to one form within a minute, any IPs429, real visitors included
Allowed domains catch every request that tells the truth about where it comes from and none that lie. The spam score catches posts that look like spam. A carefully written forged post with a faked header and an ordinary message gets through, and it would on any backend in the table above.

Spam is not refused with an error. The sender gets the normal success answer, so a bot learns nothing, and you can still open the Spam folder and restore a real message. Only past 100 spam posts to one form in a day does the rest get a 429.

"Require browser signals" is a switch for forms that are only ever sent through Formgong's fg.js script. Posts without the script's signals go to Spam, which stops scripts that just post your field names. A script written for your form specifically can imitate those signals, so treat the switch as a filter against generic bots, not a lock.

## What to turn on

For a contact form on a static site, this order covers most of it. On Formgong all of it is under the form's Settings → Protection, on every plan.

- **Allowed domains.** List your site, plus `localhost` while you build. Copies of your form on other sites stop at once.

- **Require browser signals,** if the form only ever posts through fg.js or a Formgong component. Leave it off if a server, a plugin or an app also posts to the form.

- **A block list** for the sender who keeps coming back: an email, a domain, a word or an IP.

- **Cloudflare Turnstile,** when spam keeps arriving after all that. The token has to be solved in a browser on one of your allowed domains, which is the one check a plain script cannot fake.

If your key is already being abused, replace it under Settings → General → Replace access key. You can keep the old key working for 24 hours while you update your site.

Moving the key to your own server, behind a small proxy, only moves the problem. Your proxy is now the public endpoint, and curl can post to it just as easily. It helps only if the proxy adds checks of its own. For more on the filters themselves, see [stopping spam without a captcha](/en/blog/contact-form-spam-without-captcha/), the [honeypot field](/en/blog/honeypot-form-field/) and [Turnstile, reCAPTCHA and hCaptcha compared](/en/blog/turnstile-vs-recaptcha-vs-hcaptcha/).

## What a public key cannot prevent

No setting makes an open form closed. A person can type spam into your real form on your real site, and every check sees a real visitor. A headless browser can open your page and submit from there, with your Origin, real signals and sometimes a solved captcha. A flood can still fill the per-minute limit and make a real visitor wait.

What the checks do is raise the cost. Most form spam is generic: bots that find any form and post the same text everywhere. Those are stopped by the layers above. Someone who targets your form personally can get through, and at that point the defences are the rate limit, the spam folder and replacing the key.

## What Formgong's free plan includes

- **Build the form or bring your own.** The [form builder](/en/tools/form-builder/) takes the colours and fonts from your site's address, with no sign-up; ready [form templates](/en/templates/) copy into your account; AI writes the fields from one sentence. Any hand-written HTML form works too.

- **Websites with the form already connected.** 28 free [website templates](/en/website-templates/) post to Formgong out of the box.

- **250 submissions a month on unlimited forms.** Spam does not count. Once a year, a busy month keeps delivering on credit until the 7th instead of stopping.

- **Everywhere you work.** Email to up to 3 people at once, [Telegram](/en/integrations/telegram/) with Reply and Handled buttons, [Google Sheets](/en/integrations/google-sheets/), [Notion](/en/integrations/notion/), and 3 signed [webhooks](/en/integrations/webhooks/) for Slack, Discord, Zapier, Make or n8n.

- **Emails to your customers in your business's name.** Formgong sends them under your business name and replies come back to you, with no email service of your own to set up: a review request to every lead, a reminder a visitor asked for, and review emails after an order with your logo and colours. People who agree can also go straight into your [Mailchimp, Klaviyo, Brevo, MailerLite or Kit](/en/docs/marketing-lists/) list. An automatic reply to each visitor is on Pro.

- **No captcha needed.** A server-side spam filter, a honeypot, allowed domains and a block list; add your own Turnstile key if you want one.

- **Files and voice.** Visitors can attach files, or record a [voice message](/en/docs/voice-field/) that arrives transcribed.

- **Made for AI-built sites.** A hosted form page and a contact button; step-by-step guides for sites built with [Lovable](/en/docs/lovable/), [Bolt](/en/docs/bolt/), [v0](/en/docs/v0/), [Replit](/en/docs/replit/) and [Base44](/en/docs/base44/); an [MCP server](/en/docs/mcp/) lets Cursor or Claude wire the form for you.

- **See what the form does.** [Analytics](/en/docs/analytics/) for views, starts, conversion and where each lead came from, and an alert when a form goes quiet.

- **One account for the rest.** Customer reviews and an [AI help chat](/en/docs/help-chat/) that answers visitors from your own pages, with every message in one inbox. Data is stored in the EU.

## Frequently asked questions

### Can someone read my form submissions with my access key?

No. The access key only lets someone send to your form. Reading submissions needs your login or, on Formgong, a personal API token with the submissions scope, which is a separate secret that never goes in a web page.

### Should I hide my form access key in an environment variable?

It does not help in frontend code. A NEXT_PUBLIC_ or VITE_ variable is written into the JavaScript the browser downloads, so the key is still visible. The key is meant to be public; protect the form with allowed domains and spam checks instead.

### Does restricting my form to my domain stop spam from curl?

No. Domain restriction reads the Origin or Referer header, and curl can send any value. It stops other websites from reusing your form. Spam from scripts is stopped by the server-side spam filter, rate limits and, if needed, a captcha.

### What should I do if my form access key is being abused?

Turn on allowed domains, add the sender to the block list and, if it continues, turn on Turnstile. On Formgong you can also replace the key under Settings → General and keep the old one working for 24 hours while you update your site.

### Does spam from a copied key count toward my Formgong limit?

Posts that land in Spam do not count and are not delivered. A forged post that looks like a real message and passes the checks counts like any other submission.

## Sources and documentation

- [Web3Forms: Restrict to Domain](https://docs.web3forms.com/getting-started/pro-features/restrict-to-domain)
- [Web3Forms docs (llms-full.txt)](https://docs.web3forms.com/llms-full.txt)
- [Web3Forms: API reference](https://docs.web3forms.com/getting-started/api-reference.md)
- [Formspree: Restrict to Domain](https://help.formspree.io/articles/form-and-project-settings/restrict-to-domain)
- [Formspree: system limits](https://help.formspree.io/articles/form-and-project-settings/system-limits)
- [Static Forms: domain restriction](https://www.staticforms.dev/docs/forms/security/domain-restriction)
- [Forminit: Authorized Domains](https://forminit.com/docs/authorized-domains/)
- [Forminit llms.txt](https://forminit.com/llms.txt)
- [Splitforms docs](https://splitforms.com/docs)
- [Splitforms: Is a public form access key safe?](https://splitforms.com/blog/public-form-access-key-security)
- [MDN: forbidden request header](https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_request_header)
- [Formgong contact form API test](/contact-form-api)
- [Formgong HTML form docs](https://formgong.com/en/docs/html/)

[Get a form key](https://formgong.com/en/#top)