, else ) without nav, header, footer, aside and form elements, in chunks of about 900 characters. - robots.txt and noindex are not checked: a noindex page is read if its URL is added or it is in the fetched sitemap. - The served HTML is read as is; JavaScript does not run. A single-page app that renders its text in the browser (typical Lovable, Bolt or v0 build) gives little or no text: paste the text instead ("Or paste text"). - "Facts the bot must follow" (one per line) win over pages; "Instructions" set tone and focus. How it answers: - Each question is matched against the knowledge by keyword search (BM25; no embeddings); up to 5 best chunks and the facts go to the model. Links that are not in those sources are removed from the answer. - When nothing matches, or the model finds no answer, the reply is "I couldn't find this in the site's pages, so I won't guess. You can ask the team: press “Talk to a human”." The question is listed under "Unanswered questions (30 days)" on the bot page. Talk to a human: - The visitor enters an email (name optional) and ticks consent. The transcript goes to the owner as a submission in the Formgong form chosen under "Handoff and leads go to form" (inbox, email, Telegram and webhooks as for any submission of that form), or, with no form chosen, by email to the owner's account address with Reply-To set to the visitor. - Limits: 5 a day per IP, 2 per conversation, 40 a day per bot. - Optional support tickets (bot page → "Support tickets"): the button becomes "Create a ticket"; tickets get a number with a prefix you set (e.g. AB-1001) and the visitor gets a receipt with a status link. Plans and limits: - Every account is on the Free chat plan: 100 answers a month across the owner's bots (every visitor message counts, "I don't know" replies included; the count resets each calendar month, UTC), 1 bot, 50 pages, a "Powered by Formgong" link in the panel. Paid chat plans are not on sale. - 30 messages per conversation, 40 per visitor IP an hour. Over a limit the chat shows a limit message instead of an answer. - Messages are kept 30 days; the visitor IP is stored only as a hash. Example: a booking form and the help chat on one static page. Pick this booking form under "Handoff and leads go to form" so chat questions land in the same inbox. ```html Book a visit

Book a visit

``` ## Pricing - Free: $0, 1,000 submissions a month, up to 3 email recipients and 3 webhooks per form, unlimited review sites with text, photo and video reviews, 100 AI help chat answers a month. - Pro: $15 a month or $144 a year, one plan for every forms and reviews feature: 25,000 submissions a month, up to 5 email recipients, field routing, inbox operators, auto-replies, AI form check, Reviews AI summaries, AI moderation, mood tags and translation, no Formgong link. - Freemius is the merchant of record. Spam does not count toward the limit. - Founding users programme: 20 places, 12 months of Pro free for honest feedback after a month of use; no positive review required. https://formgong.com/en/founding/ ## Compared with other form backends Short answers from the comparison pages. Facts were checked against each service's public pricing and documentation pages on the date shown on the page; each page links its sources and lists where the other service is stronger. Hub: https://formgong.com/en/compare/ - Formgong vs Formspree (https://formgong.com/en/vs/formspree/, checked 03.10.2026): Formspree has the larger plugin catalogue, team seats that can edit forms, and larger file uploads. Formgong gives 1,000 free submissions a month instead of 50, stores data in the EU, follows the visitor's language automatically, reminds you in Telegram about unhandled leads, and paid plans start at $15 (as of Oct 2026). Both send to Telegram on Free. - Formgong vs Web3Forms (https://formgong.com/en/vs/web3forms/, checked 03.10.2026): Web3Forms has a 250-submission free plan and a broad paid feature set. Formgong gives 1,000 free submissions with Telegram on Free, stores data in the EU, speaks the visitor's language, and paid plans start at $15. Web3Forms stops accepting submissions at the limit; Formgong adds a 20% grace. - Formgong vs Getform (now Forminit) (https://formgong.com/en/vs/getform/, checked 03.10.2026): Forminit's free plan has 1 form and 100 submissions a month; Formgong's has unlimited forms and 1,000. Both store data in the EU. Forminit is stronger on file uploads, analytics and its SDK. Formgong adds Telegram delivery, 12 visitor languages, lead reminders and paid plans from $15 instead of $19 a month (as of Oct 2026). - Formgong vs Basin (https://formgong.com/en/vs/basin/, checked 03.10.2026): Basin's free plan has 1 form and 50 submissions; Formgong's has unlimited forms and 1,000. Basin offers a form builder and AI-generated sites, and bills overage automatically. Formgong adds Telegram delivery, EU storage, 12 visitor languages, country, distance and throwaway-email filters on every plan, and a cap with 20% grace instead of overage charges. - Formgong vs FormSubmit (https://formgong.com/en/vs/formsubmit/, checked 03.10.2026): FormSubmit is free, needs no account and emails each submission; it publishes no quota and warns of limits it imposes from time to time. Formgong needs a free account and adds a stored inbox with CSV export, Telegram, EU storage, 12 visitor languages, published limits and lead reminders. - Formgong vs Netlify Forms (https://formgong.com/en/vs/netlify-forms/, checked 06.10.2026): On Netlify's credit-based plans, Netlify Forms are free and unlimited, but only for sites hosted on Netlify, and JavaScript-rendered forms need a hidden static copy for detection. Formgong works on any host, accepts JSON and fetch, sends to Telegram, stores data in the EU and has a 1,000-submission free plan. - Best form backend services in 2026: 13 tested with the same requests (https://formgong.com/en/best-form-backend/, checked 16.10.2026): There is no single best one. Pick on three things the lists skip: whether the free allowance is monthly or one-off, what happens to a message that arrives over the limit, and whether your code can tell a broken setup from a sent message. Four of the 12 services that answered gave HTTP 200 to a wrong key at least once: Web3Forms, Forminit, FormSubmit and Formspark. The other eight answered every wrong key with an error status. - Jotform alternative for developers: keep your own HTML form (https://formgong.com/en/jotform-alternative/, checked 16.10.2026): If you write your own form, a form backend replaces Jotform with one URL: your markup, your CSS, no builder scripts and no Jotform branding. Jotform's own Contact Us template loaded 13 files, about 386 KB compressed, when we measured it on 16 October 2026. Formgong's free plan takes 1,000 submissions a month to Jotform's 100. Jotform is the better pick if you do not want to write HTML, or the form takes payments, signatures or needs HIPAA. ## API reference Endpoint: POST https://formgong.com/submit Content types: - application/json (flat values; an array of scalars is joined like a checkbox group) - application/x-www-form-urlencoded - multipart/form-data (files are opt-in per form) Repeated field names (checkbox groups, select multiple) are joined into one string with ", ", e.g. "Email, Phone". Empty repeats are skipped. Every channel (email, Telegram, CSV, webhook JSON) gets that same string. Required field: access_key (public, safe to ship in frontend code). Reserved fields, not stored as answers: - _redirect, redirect or _next: absolute http(s) URL after success. A URL sent by the page must be on the site that sent the form (same host as Origin/Referer, ignoring www., or a subdomain or parent of it) or, when the form has allowed domains, on one of them. Otherwise it is ignored and the redirect set in the dashboard (or the hosted page) is used. The dashboard redirect can point anywhere. - _error_redirect or error_redirect: absolute http(s) URL after an error, same rule - _subject: email subject. Without it, the subject set in the dashboard, then a field named subject (kept as an answer too), then the default. - _replyto or replyto: Reply-To address (otherwise the email or Email field is used) - _from_name or from_name: sender name stored with the submission (notifications still come from Formgong's address) - botcheck, _honeypot, _gotcha (Formspree) or _honey (FormSubmit): if filled, the request looks successful but is stored as spam and is not delivered or counted - Ignored and never acted on: _cc, _bcc, ccemail, _webhook, _autoresponse, _captcha, _blacklist. Recipients, webhooks, the autoreply and field-routing destinations are set only in the dashboard, so a page cannot choose where mail, Telegram or webhooks go. - cf-turnstile-response: required when Turnstile is enabled OR the request includes files - _ts: unix timestamp when the form was rendered; submissions faster than 1.5s are treated as spam - _fg_b, _fg_pow: added by fg.js only (fill time, typing/paste counts, proof-of-work). Do not set them by hand; requests without them are not penalised, unless the owner turns on "Require browser signals" for the form (Settings → Protection), which sends them to spam. - _format=json: force a JSON response - _lang: visitor language (uk, en, pl, tr, ar, he, es, fr, pt, hi, ja, de; uk-UA style tags accepted; others fall back to English). fg.js sends it from the form's lang attribute or . - _page_url: page that showed the form. It is stored as the submission page when it is an http(s) URL on the same host as the Referer (www. ignored). Otherwise the Referer is kept. With no Referer it is stored only when its host is on the form's allowed domains, and dropped when the form has none. The WordPress plugin sends it (scheme, host, and path; no query string) because a cross-origin post often carries only the site origin in Referer. Visitor language order: _lang, Referer locale path or ?lang=, form default language, Referer country domain, Accept-Language, English. Owners can restrict a form to chosen languages (Settings → General → Form languages); a detected language outside that list falls back to the form's primary language. Owners can override visitor texts per language (Settings → Messages): success message, thank-you page heading/body, and error messages. The error code never changes, only the message. It applies to error messages, the hosted thank-you/error page, the badge, the autoreply, and visitor reminders. Limits: text-only body <= 64 KiB, <= 50 answer fields including file parts. Multipart text <= 64 KiB; up to 3 files, 5 MiB each, 10 MiB total, plus 128 KiB multipart overhead. Plans: Free 1000/month, Pro 25000/month. After the monthly limit, Formgong still accepts and delivers 20% more (grace). After that, new submissions are accepted (HTTP 200, success true) and stored but held without delivery, up to one more monthly plan limit; they are delivered and counted when the owner upgrades or the next month starts. Beyond that hold cap, Formgong rejects with HTTP 429 and code limit_exceeded. Spam does not count toward the limit and is not emailed, telegraphed, or webhooked. Form monitoring (on by default, per-form switch in Settings → Email): if a form that usually gets submissions on most days gets none for several days (at least 7 active days in the last 28 and a gap that would happen by chance under 1% of the time at that pace; at least 3 empty days), the owner gets one email and Telegram message per quiet spell. After a dashboard form check finds the form, Formgong re-runs that check on the same page once a week (only when robots.txt allows; forms with allowed domains can also use the page of a recent submission) and alerts after two failing checks a day apart if the form or its access key is gone. Pages that build the form with JavaScript never alert, because the form must have been seen there first. Spam scoring adds points per signal; a score of 60 or more goes to the spam folder. Signals: honeypot (always spam), _ts too fast, many links, stop words, and consent-free signals. The first is a keyed hash of IP + User-Agent + Accept-Language under a key that rotates every UTC day, kept only in hourly counters deleted within 48 hours, to catch one sender hitting many forms or owners. The others need fg.js: fill time, typing/paste counts, and a signed, short-lived SHA-256 proof-of-work from GET /pow. A missing proof-of-work counts only for clients that ran fg.js; plain HTML, curl, and SDK posts are not penalised by default. No cookies, no stored fingerprint, no cross-site tracking. Reason codes (for example b_fast, pow_invalid, burst_owners) appear on the submission page in the dashboard. Per-form spam rules (Settings → Protection): "Require browser signals" sends /submit requests without fg.js or component signals to spam (reason signals_required); a block list of emails, domains, IP addresses (stored only as the keyed IP hash) and words sends matches to spam (reasons blocked_email, blocked_domain, blocked_ip, blocked_word). Spam is stored, not delivered, and not counted. Platform integrations (/in) use the block list but not the browser-signal rule. Per-form filters (Settings → Protection, every plan including Free): country allow-list or block-list (ISO codes; an unknown country never fails), distance from a point (the owner's approximate location when they saved; unknown location passes), throwaway email domains anywhere in the fields, the alphabet most letters are written in (needs 12+ letters; email fields ignored), and the same content to the same form within 24 hours. Reasons: filter_country, filter_radius, filter_disposable, filter_language, filter_duplicate. Like the block list, a match is spam: stored, restorable from the Spam tab, not delivered, not counted. JSON success: {"success": true, "id": "...", "lang": "uk", "message": ""} JSON failure: {"success": false, "code": "...", "message": "..."} (code is stable; message is localized) HTML forms without Accept: application/json receive 303 redirects. CORS allows any origin unless the form has an allow list (every plan, Free included). Telegram is connected from the dashboard with https://t.me/?start=. Groups use /connect . Chat ids are never copied by hand. Each Telegram delivery has Reply (mailto when the visitor left an email), Mark handled, and Spam; callbacks are HMAC-signed and only work from a chat linked to that form. Handled maps to closed in the dashboard. Free and Pro both include these buttons. A chat that still fails after the last retry emails the account owner: the problem in plain words (for example the bot was removed from the group, the chat was not found, or the user blocked the bot) and how to reconnect with a new code and /connect. At most one such email a day per form. Every plan, including Free. This is separate from submission emails. Webhooks: POST JSON, header X-Signature: sha256=, X-Formgong-Event: submission.created (webhook.test for the dashboard test). HTTPS on port 443 to a public host only; 10 s timeout; redirects and non-2xx count as failures. Retries: 5 attempts via Cloudflare Queues, waiting 30 s, 2 min, 10 min and 30 min. After the last failed attempt, Formgong emails the form owner, at most once a day per form and channel, on every plan including Free. That email covers webhooks (including Slack and Discord), Google Sheets, and Telegram. It is separate from submission emails. A Telegram email names the problem in plain words and how to reconnect with a new code and /connect. Webhooks per form: Free 3, Pro 5. Slack incoming webhooks (https://hooks.slack.com/services/…) and Discord channel webhooks (https://discord.com/api/webhooks/…) get a readable chat message instead of the JSON: form name, answers, page, a link to the submission; @everyone/@here/@channel are defused, visitor text cannot hide links, long messages are cut to the platform limits. Every other URL gets the JSON. No custom headers or payload templates, so CRMs that need an API key (KeyCRM) go through Make, n8n or a small script: https://formgong.com/en/integrations/. Settings (recipients, Telegram, redirects, Turnstile, webhook, retention, field routing) are changed in the dashboard and apply to the next submission without redeploying the site. Field routing (Pro: 25 rules per form): in Settings → Routing, if one form field equals a value, email for that submission goes to one already-verified recipient and/or Telegram goes to one chat already linked to that form. The first matching rule wins. Comparison ignores surrounding spaces and letter case. If no rule matches, every verified recipient and every linked chat still get it. A rule replaces only the channel it names. If that saved recipient or chat is later removed, that channel is not sent for a match, instead of falling through to everyone. Webhooks, Google Sheets and the auto-reply are not routed. On Free, saved rules are kept and ignored. Inbox operators (unlimited on Pro, fair-use ceiling 100 per account, 20 invitations a day): the owner invites an email address from Account. That person opens the link, which signs them in for that address, and accepts. They can open the inbox, export CSV, download files, mark the workflow, mark spam and retry a failed delivery. They cannot change billing, recipients, Telegram, webhooks, keys, or delete the form or a submission. On Free, operator access pauses. This is not shared editing of form settings. Attachments: enable in Settings > Attachments, verify owner email, and configure website Turnstile keys in Protection. Files must pass matching extension/MIME/header checks and private ClamAV scanning before private EU R2 storage. D1 stores metadata only. Free storage 100 MiB, Pro 5 GiB per account. Full storage rejects new uploads and keeps existing files. Owners download through authenticated dashboard links; public access keys and webhook URLs do not grant read access. Attachments follow form retention and are deleted with submissions/forms/accounts; failed deletions are retried. File bytes are never sent to an AI provider. Never encode files as base64. Upload errors include uploads_disabled, uploads_unverified, uploads_unavailable (503/retry later), file_invalid, file_type, file_unsafe, storage_full (429). Notifications and webhook payloads include an attachments array with id, field, filename, size, content_type, and an owner-authenticated url, not binary content or public storage URLs. Auto-reply is available per form on Pro, with daily caps. Free has no auto-reply. Dashboard setup: every form has a 4-step connect wizard ("Add a form to your site"). 1) Where the site is built: no website (a hosted form link, /f/), WordPress, WooCommerce, Wix, Tilda, Webflow, Framer, Shopify, Squarespace, plain HTML, React/Next.js, Lovable/Bolt/v0/Cursor (a prompt to paste), or an existing form (only the action and access_key change). The Formgong plugin for WordPress and WooCommerce (folder formgong) posts to /submit, next to the Shopify Custom Liquid path. It is tested on WordPress 7.1 with WooCommerce and Storefront, and Plugin Check passes. Install it from the WordPress plugin directory (https://wordpress.org/plugins/formgong/: Plugins, Add New, search for "Formgong", Install Now, Activate); sites that block the directory can upload https://formgong.com/downloads/formgong-wordpress.zip, whose archive contains formgong/formgong.php. Settings → Formgong takes the public access key and Send a test submission (user agent FormgongInstallationTest/1.0, address plugin-test@example.com). That test does not finish the connect wizard. It embeds the same Formgong templates as the Shopify HTML snippet: 28 website templates (aula, lattice, and the rest), 7 starter layouts, nps, and 25 industry forms such as clinic-appointment. Pick one in the block, with the shortcode [formgong template="aula"], or in Settings. An empty product or order template inherits the main template. The slug plain forces the built-in contact form. A shortcode or block template wins. On a store it can add a product question (name, SKU, URL) and an order question (order number only, and only for a customer who can view that order). The heading stays the product or order question unless a custom heading is set. A hidden _page_url records the current page because a cross-origin Referer is often only the site origin. Checkout, payments, and order emails stay in WooCommerce. Styles stay inside the form on Storefront, Astra, and Twenty. Telegram is instant on every plan, including Free. On the Free plan, email is a daily digest to up to 3 addresses. While that digest is paused, Free also emails each submission so a first test is not silent until the next morning. Guides: https://formgong.com/en/for/woocommerce/, https://formgong.com/en/for/wordpress/, https://formgong.com/en/docs/wordpress/, https://formgong.com/en/docs/woocommerce/. 2) Email and/or Telegram. 3) For Tilda, WordPress with Elementor Pro, Webflow and Framer the first option needs no code: the owner keeps the builder's own form and pastes a Formgong webhook link (POST /in/) into its settings (Tilda: Site Settings → Forms → Webhook; Elementor Pro: Actions After Submit → Webhook; Webflow: form Settings → Send to → Webhook; Framer: Send To → Webhook). Retries are de-duplicated (Tilda tranid, Webflow payload.id, Framer-Webhook-Submission-Id). Otherwise, three platform-specific steps and the code for that platform; the form design (fields, heading, colour, languages) saves as you edit. The field builder takes up to 20 fields of these types: short text, email, phone, long text, dropdown, choose one, checkboxes, single consent checkbox, number, date, website; drag or use the arrows to reorder. "Describe the form" sends only the owner's description to an AI model, which proposes the fields (5 a day on Free, 30 on Pro); the owner reviews them before they are saved. 4) A live screen waits for the first real submission from the site (dashboard tests don't count) and shows its page and time, or says it landed in Spam. Privacy notice (every plan): a privacy policy address set once per form (Fields step of the connect wizard) adds one line under the send button, "We use your details only to reply to you." in the form language (or the owner's own wording, up to 160 characters), with a link to that policy. It appears in the builder's HTML, React and AI-builder code, on the hosted page /f/, and in the Wix contact form (Wix app dashboard). The WordPress plugin links to the site's privacy policy page (Settings → Privacy) or an address set in Settings → Formgong; the Shopify contact blocks link to the store's privacy policy and have a setting to hide the line. Without an address no line is shown. The address must be absolute http(s), at most 300 characters. It helps you show the notice the GDPR asks for at collection; replying to a message needs no consent box, so industry templates have none, except the health templates (clinic-appointment, patient-intake), which ask for explicit consent to process health details. Out of scope: WhatsApp, Viber, native CRM connectors, shared editing of form settings, multi-step forms, and site building or hosting. Inbox operators can mark submissions; they are not seats that edit settings. Projects (every plan): group forms per client, up to 100 projects per account. Invite a client by email as a view-only reader of that project's submissions and files (the invitation lasts 7 days and works only for that verified email), or transfer the project to the client's own Formgong account. A transfer removes the sender's delivery channels (recipients, Telegram, webhooks, platform sources), autoreplies and client access, so the new owner connects their own. Before a transfer, file uploads must be off and pending deliveries finished. Page for agencies: [en](https://formgong.com/en/for/agencies/), [uk](https://formgong.com/uk/for/agencies/), [pl](https://formgong.com/pl/for/agencies/). Site platforms (same plan limits on each; details in the docs): - Shopify (https://formgong.com/en/docs/shopify/): installing the app creates a Formgong account, or sends a confirmation email when that address already has one, plus a contact form and a product-reviews form. The review stores gid://shopify/Product/…. Uninstall deletes the access token immediately. shop/redact deletes that shop's forms, submissions, and reviews, and deletes the account only when the app created it, it has never had a paid plan, and it has no other forms. customers/data_request exports one shopper; customers/redact deletes that shopper. Custom Liquid (https://formgong.com/en/for/shopify/) does not install the app. Removing that section does not delete stored submissions. This file does not give an App Store URL. - Wix (https://formgong.com/en/docs/wix/): Dev Center app Formgong, public app id 31f05ba3-6758-4300-8b97-9f578efb6946, draft, not on the App Market, Wix account support@formgong.com. Install creates the same account, contact form, and reviews form. A review stores a Wix Stores product GUID. Removing the app deletes that site's forms, submissions, and reviews at once, with the same account rule as Shopify. The dashboard can export or delete one visitor by email. Embed HTML (https://formgong.com/en/for/wix/) is the path before the app is listed. Removing the embed does not delete stored submissions. - Free email is sent for each submission. Telegram is instant on every plan. Free is 1,000 submissions a month. Nothing is sold inside the Shopify or Wix app: Formgong Pro ($15 a month or $144 a year, 25,000 submissions a month) is bought on formgong.com and covers the same account. Support is support@formgong.com. Integration recipes (setup guides, no affiliate links). n8n also has the Formgong community node (npm n8n-nodes-formgong) and Zapier the Formgong app (beta, by invite); both register the webhook themselves. Slack and Discord URLs get a formatted chat message. Make, n8n, Zapier and KeyCRM catch the signed webhook above and map submission.fields; repeated field names arrive as one comma-separated string. Tilda is inbound, not one of those recipes: the owner pastes https://formgong.com/in/ into Tilda Site Settings → Forms → Webhook. Tilda sends that webhook only on a paid Tilda plan. On Formgong Free, email goes out on every submission and Telegram is instant. Guide: https://formgong.com/en/docs/tilda/ (and the same path in the other site languages). Shopify and Wix have their own pages. The public App Store listing was not found on 11 October 2026. There is no public install link yet. - Hub: [en](https://formgong.com/en/integrations/), [uk](https://formgong.com/uk/integrations/), [pl](https://formgong.com/pl/integrations/), [de](https://formgong.com/de/integrations/) - Make: Custom webhook module, optional signature check with sha256(). [en](https://formgong.com/en/integrations/make/), [uk](https://formgong.com/uk/integrations/make/), [pl](https://formgong.com/pl/integrations/make/), [de](https://formgong.com/de/integrations/make/) - n8n: Webhook node, optional HMAC check with the Crypto node. [en](https://formgong.com/en/integrations/n8n/), [uk](https://formgong.com/uk/integrations/n8n/), [pl](https://formgong.com/pl/integrations/n8n/), [de](https://formgong.com/de/integrations/n8n/) - Zapier: Webhooks by Zapier Catch Hook (a paid Zapier plan), Code by Zapier for the signature. [en](https://formgong.com/en/integrations/zapier/) - KeyCRM: leads and orders through Make, n8n or a small Cloudflare Worker, because KeyCRM needs an API key header. [en](https://formgong.com/en/integrations/keycrm/), [uk](https://formgong.com/uk/integrations/keycrm/), [pl](https://formgong.com/pl/integrations/keycrm/) - Discord: a channel webhook URL becomes a formatted embed, with no Discord bot. [en](https://formgong.com/en/integrations/discord/) - Slack: an Incoming Webhook URL becomes a formatted message, with no Formgong Slack app. [en](https://formgong.com/en/integrations/slack/) - Telegram: built in and free: one tap to connect, no bot token or chat ID, Reply / Mark handled / Mark as spam buttons on each message. [en](https://formgong.com/en/integrations/telegram/) - Webhooks: signed JSON (HMAC-SHA256 X-Signature) for every submission, on every plan including Free, with 5 retries, a test button and a delivery log. [en](https://formgong.com/en/integrations/webhooks/) - Notion: built in on every plan including Free: sign in to Notion, pick a page, Formgong creates a database (or uses yours), one row per submission, new fields become new columns. [en](https://formgong.com/en/integrations/notion/) - Google Sheets: built in on every plan including Free: sign in with Google, one row per submission, new fields become new columns. [en](https://formgong.com/en/integrations/google-sheets/) MCP server: POST https://formgong.com/mcp (Streamable HTTP, stateless, JSON responses). initialize, ping and tools/list work without a token (discovery). tools/call needs Authorization: Bearer, either an OAuth access token from Formgong sign-in or a personal API token fgp_… (Dashboard → Account → API tokens). OAuth is authorization-code + PKCE (S256), public clients only: built-in client ids cursor, claude, vscode and loopback, plus dynamic registration limited to listed MCP callbacks (Cursor, Claude, VS Code, and https://api.lovable.dev/workspaces/connectors/mcp/oauth/callback for Lovable), HTTPS on exactly lovable.dev or bolt.new (no subdomains, nonstandard ports, userinfo, query or fragment), and HTTP loopback callbacks. Each client stays bound to the exact URI it registered. Scopes forms:read, forms:write, submissions:read; forms:read is always included; submissions:read is opt-in. Access and refresh tokens are stored as peppered hashes. Refresh tokens rotate; reuse revokes that connection. Session cookies never authorize /mcp. Discovery: https://formgong.com/.well-known/oauth-protected-resource/mcp and https://formgong.com/.well-known/oauth-authorization-server. Tools: list_forms, create_form, get_form_snippet (html/react/next), list_recent_submissions (read-only, opt-in, no IP or user agent), list_webhooks, create_webhook (public https URL only, plan limit per form, returns the form signing secret), delete_webhook, list_website_templates (forms:read; complete site templates with the form already wired, optional topic filter). Limits: 60 requests/min per token, 120 per account, 30/min per IP without a token, 10 new forms/hour. A tool call without a token returns HTTP 401 with WWW-Authenticate. For clients such as Bolt that only start OAuth during initialization, use https://formgong.com/mcp?auth=required: anonymous discovery then returns 401; token audience remains the canonical https://formgong.com/mcp resource. Setup: https://formgong.com/en/docs/mcp/. Blog setup guides: - Lovable form submissions to email and Telegram: https://formgong.com/en/blog/lovable-contact-form-email-telegram.md - HTML contact form without a backend: a working example: https://formgong.com/en/blog/html-contact-form-without-backend.md - How to send website form submissions to Telegram: https://formgong.com/en/blog/website-form-to-telegram.md - Contact form not sending email? Check where it stops: https://formgong.com/en/blog/contact-form-not-sending-email.md - Managing website leads in Telegram without a CRM: https://formgong.com/en/blog/manage-leads-in-telegram.md - Form backend for Lovable, Bolt, v0, Cursor: https://formgong.com/en/blog/form-backend-for-ai-website-builders.md - Telegram bot for a contact form: build or skip?: https://formgong.com/en/blog/telegram-bot-for-contact-form.md - GDPR form backend: 7 checks before you choose: https://formgong.com/en/blog/gdpr-form-backend.md - Lovable form not sending email? 6 fixes: https://formgong.com/en/blog/lovable-form-not-sending-email.md - Netlify Forms not working? React and Bolt fixes: https://formgong.com/en/blog/netlify-forms-not-working.md - Stop contact form spam without a CAPTCHA: https://formgong.com/en/blog/contact-form-spam-without-captcha.md - GitHub Pages contact form: a working setup: https://formgong.com/en/blog/github-pages-contact-form.md - Mailto Form in HTML: Why It Fails and What to Use: https://formgong.com/en/blog/mailto-form-vs-form-backend.md - HTML form to Google Sheets: 2 free methods: https://formgong.com/en/blog/html-form-to-google-sheets.md - Webflow form submission limit: what to do at 50: https://formgong.com/en/blog/webflow-form-submission-limit.md - Turnstile vs reCAPTCHA vs hCaptcha for forms: https://formgong.com/en/blog/turnstile-vs-recaptcha-vs-hcaptcha.md - Contact Form 7 and Elementor forms to Telegram: https://formgong.com/en/blog/contact-form-7-elementor-telegram.md - Squarespace contact form not sending email?: https://formgong.com/en/blog/squarespace-contact-form-not-sending-email.md - Shopify contact form: where do messages go?: https://formgong.com/en/blog/shopify-contact-form-where-does-it-go.md - Google Form to Telegram: free Apps Script way: https://formgong.com/en/blog/google-form-to-telegram.md - Wix contact form not sending email? Fixes: https://formgong.com/en/blog/wix-contact-form-not-sending-email.md - EU / GDPR Formspree alternatives compared: https://formgong.com/en/blog/eu-gdpr-formspree-alternatives.md - HTML form action attribute explained: https://formgong.com/en/blog/html-form-action.md - How do HTML forms work? The HTTP request: https://formgong.com/en/blog/how-html-forms-work-low-level.md - Types of Injection Attacks on Web Forms (2026): https://formgong.com/en/blog/injection-taxonomy-2024-2026.md - Indirect Prompt Injection in MCP: https://formgong.com/en/blog/indirect-prompt-injection-mcp.md - MCP Rug Pull Attack: Detect Tool Changes: https://formgong.com/en/blog/mcp-rug-pull-attack.md - Form without a backend: 7 ways that work: https://formgong.com/en/blog/form-without-backend.md - Thank-you page after form submission (HTML): https://formgong.com/en/blog/thank-you-page-after-form-submission.md - Indirect Prompt Injection Examples (2023–2026): https://formgong.com/en/blog/indirect-prompt-injection-examples.md - Indirect Prompt Injection via Email: https://formgong.com/en/blog/indirect-prompt-injection-via-email.md - What Is Tool Poisoning in MCP?: https://formgong.com/en/blog/mcp-tool-poisoning.md - WordPress contact form without a plugin: https://formgong.com/en/blog/wordpress-contact-form-without-plugin.md - Send email from frontend JavaScript: https://formgong.com/en/blog/send-email-from-frontend-javascript.md - How to Prevent Indirect Prompt Injection: https://formgong.com/en/blog/indirect-prompt-injection-prevention.md - Honeypot Form Field: How to Add One That Works: https://formgong.com/en/blog/honeypot-form-field.md - Contact Form with File Upload (HTML, No PHP): https://formgong.com/en/blog/contact-form-with-file-upload.md - Angular contact form without a backend: https://formgong.com/en/blog/angular-contact-form-without-backend.md - Send form submissions to Slack or Discord without Zapier: https://formgong.com/en/blog/form-submissions-to-slack-discord.md - Verify a form webhook signature (HMAC-SHA256): https://formgong.com/en/blog/verify-form-webhook-signature.md - Contact forms that send nothing: 793 AI-built sites tested: https://formgong.com/en/blog/contact-forms-that-send-nothing.md - v0 contact form that actually sends: 3 ways: https://formgong.com/en/blog/v0-contact-form.md - How we tested AI-built contact forms, and 12 bugs we hit: https://formgong.com/en/blog/how-we-tested-contact-forms.md - Cloudflare vs Netlify free plan: hosting that never pauses: https://formgong.com/en/blog/cloudflare-vs-netlify.md - EmailJS errors 400, 412 and 422: causes and fixes: https://formgong.com/en/blog/emailjs-errors.md - Resend errors in contact forms: domain, CORS, API key: https://formgong.com/en/blog/resend-errors.md - Supabase Edge Function blocked by CORS policy: 3 causes: https://formgong.com/en/blog/supabase-edge-function-cors.md - Formspree “Form not found” and other errors: fixes: https://formgong.com/en/blog/formspree-errors.md - Web3Forms errors: “Invalid access key” and 403 explained: https://formgong.com/en/blog/web3forms-errors.md - How to add customer reviews to your website for free: https://formgong.com/en/blog/add-reviews-to-website.md - Getform not working? “This form has been deleted” and more: https://formgong.com/en/blog/getform-errors.md - Next.js contact form not working? 6 errors, reproduced: https://formgong.com/en/blog/nextjs-contact-form-not-working.md - Webflow form not sending email? What to check, tested: https://formgong.com/en/blog/webflow-form-not-sending-email.md - FormSubmit not working? “This form needs Activation” fix: https://formgong.com/en/blog/formsubmit-errors.md - Contact form “TypeError: Failed to fetch”: causes and fixes: https://formgong.com/en/blog/contact-form-failed-to-fetch.md - WooCommerce product enquiry form: https://formgong.com/en/blog/woocommerce-product-enquiry-form.md - Contact Form 7 vs WPForms: https://formgong.com/en/blog/contact-form-7-vs-wpforms.md - Gravity Forms alternative free: https://formgong.com/en/blog/gravity-forms-alternative.md - WordPress contact form block: https://formgong.com/en/blog/wordpress-contact-form-block.md - 535-5.7.8 Username and Password not accepted (Gmail): https://formgong.com/en/blog/gmail-smtp-535-username-and-password-not-accepted.md - 535 5.7.3 Authentication unsuccessful: Office 365 SMTP: https://formgong.com/en/blog/office-365-smtp-535-authentication-unsuccessful.md - Nodemailer “Missing credentials for "PLAIN"”: the fix: https://formgong.com/en/blog/nodemailer-missing-credentials-for-plain.md - Nodemailer “Greeting never received”: port 465 fix: https://formgong.com/en/blog/nodemailer-greeting-never-received.md - Nodemailer SSL “wrong version number”: the port fix: https://formgong.com/en/blog/nodemailer-ssl-wrong-version-number.md - Nodemailer “self-signed certificate in certificate chain”: https://formgong.com/en/blog/nodemailer-self-signed-certificate.md - Nodemailer ECONNREFUSED 127.0.0.1:587: missing SMTP host: https://formgong.com/en/blog/nodemailer-econnrefused.md - SendGrid “authorization grant is invalid”: 401 fix: https://formgong.com/en/blog/sendgrid-authorization-grant-invalid.md - Mailgun 401 Forbidden: why the API rejects your key: https://formgong.com/en/blog/mailgun-401-forbidden.md - “Edge Function returned a non-2xx status code”: the fix: https://formgong.com/en/blog/supabase-edge-function-non-2xx-status-code.md - Next.js “Body exceeded 1 MB limit”: Server Action fix: https://formgong.com/en/blog/nextjs-body-exceeded-1mb-limit.md - Unexpected token '<', "