Email notifications
Instant email for every submission. Custom templates and multiple recipients.
Drop in an endpoint. Get submissions instantly. No server setup. No backend code. Ever.
FREE FOREVER · NO CREDIT CARD · UP AND RUNNING IN 30 SECONDS
10K+
FORMS CREATED
1M+
SUBMISSIONS
<50ms
P95 RESPONSE
99.9%
UPTIME SLA
01 · ONE ENDPOINT
No SDK to install, no server to run. Works from any language, any framework, any static HTML page. Responses are verifiable with HMAC-SHA256 and retry on failure.
const res = await fetch("https://api4form.com/f/YOUR_SLUG", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
name: "Ada Lovelace",
email: "ada@example.com",
message: "Hi — can I get a demo?",
}),
});
// => { ok: true, message: "Thank you for your submission!" } Atomic delivery
Your webhook receiver gets each submission exactly once — with retry + dead-letter log.
Signed payloads
X-Api4form-Signature (HMAC-SHA256) + X-Api4form-Timestamp on every outbound call.
Structured errors
422 + per-field errors when the submission fails schema validation. No guessing.
02 · FEATURES
A complete toolkit for collecting, managing and acting on form submissions — without writing a single line of backend code.
Instant email for every submission. Custom templates and multiple recipients.
Real-time JSON POST to any URL. Per-form rotating signing secret, at-least-once delivery with retries.
Cloudflare Turnstile, Akismet-compatible honeypot, per-IP persistent rate limit, password-gated forms.
Per-form peak hours, field breakdown, UTM/referrer/country. Export CSV or full JSON at any time.
React, Next, Vue, Svelte, plain HTML. If it can POST, it works. Static sites welcome.
Branded confirmation emails with {{field}} interpolation. Keep submitters in the loop automatically.
03 · INTEGRATIONS
22 first-party destinations, zero glue code. Flip a toggle and every submission fans out to Slack, Airtable, Stripe, Salesforce, your Zap — whichever pattern fits.
At-least-once delivery
Failed dispatches go on a retry schedule (1m → 5m → 30m → 3h). Full event log per form.
Signed webhooks
HMAC-SHA256 with a per-form secret you rotate. X-Api4form-Signature header on every POST.
SSRF-safe outbound
Private IP / link-local / metadata-service destinations are rejected before fetch.
04 · VS THE ALTERNATIVES
Everything the incumbents put behind a Business tier — HMAC webhooks, custom domains, SSO, audit log — ships in api4form on Pro or by default.
| Capability | api4form | Typical competitor |
|---|---|---|
| Free tier (submissions / month) | 50 | 50 |
| HMAC-signed webhooks | ✅ | Paid |
| Native integrations | 22+ | 13 |
| Custom submission domain | ✅ | Business only |
| SSO (SAML) at workspace level | ✅ | Business only |
| Audit log, exportable CSV | ✅ | — |
| Org-scoped quotas | ✅ | — |
| Self-host option | ✅ | — |
COMPARED AGAINST LISTED TIERS AS OF APR 2026. SPECS DRIFT; FEEDBACK WELCOME.
05 · SECURITY
Built controls first, features second. Audit log, RLS, HMAC, Turnstile, SSO and customer-accessible evidence for SOC 2 reviews.
End-to-end encryption across every hop. Your submissions never travel unprotected.
Every webhook delivery carries X-Api4form-Signature (HMAC-SHA256). Rotate the secret any time.
Postgres RLS keeps every workspace's forms and submissions sealed off from its neighbours.
Every access-changing action recorded per workspace, exportable to CSV for SOC 2 review.
SAML SSO via Okta / Google / Azure AD. Owner / admin / member roles, scoped permissions.
Cloudflare Turnstile, honeypot, persistent rate-limit, per-form password gating, SSRF block-list.
06 · PRICING
No credit card for the free tier. Plans priced per workspace, not per seat. Self-host with zero license fee if you'd rather run it yourself.
For side projects & prototypes.
For shipping developers.
For teams and customers.
OVERAGES BILLED AT $0.002 / SUBMISSION · UPGRADE / DOWNGRADE ANY TIME
07 · ADOPTION
"Moved off Formspree in an afternoon. The HMAC-signed webhooks + audit log alone pay for it."
"Our forms backend is finally just `fetch()`. The Astro + edge integration is chef's kiss."
"The built-in org model + SAML meant our security review closed in a week, not a month."
Open schemas
Every migration, every RPC, every edge function is in the open repo.
Self-host
docker-compose up. One VM, one host, zero vendor lock-in.
Proper REST
No magical SDK. Curl-first. OpenAPI spec on every endpoint.
Real SLAs
99.9% uptime, credits automatic when we miss it. Status page public.
08 · SHIP
Sign up. Create a form. Paste the endpoint into your site. Submissions arrive in your inbox before you finish your coffee.