Authentication

The Submission API uses the form’s access key, a UUID shown in the form’s Connect tab. It identifies the form and can only create submissions, so it is safe to ship in browser code.

{
  "access_key": "YOUR_ACCESS_KEY",
  "email": "jane@example.com"
}

If both are present, the key in the path wins.

What the key cannot do

• Read submissions, forms or account details.
• Change notification recipients or any setting.
• Submit to a form that is disabled (403).

Account-level access

Reading submissions and managing forms needs a signed-in user. AI assistants and tools get that access through the MCP server with OAuth 2.1 and per-scope consent.