# Authentication

> Submissions are authenticated with your form’s public access key.

Source: https://docs.formclick.io/api-reference/authentication

The Submission API uses the form’s **access key**, a UUID shown in the form’s **Connect** tab. It identifies the form and can only create submissions, so it is safe to ship in browser code.

**In the body**

```json
{
  "access_key": "YOUR_ACCESS_KEY",
  "email": "jane@example.com"
}
```

**In the path**

```bash
curl -X POST https://api.formclick.io/submit/YOUR_ACCESS_KEY \
  -H "Content-Type: application/json" \
  -d '{"email":"jane@example.com"}'
```

If both are present, the key in the path wins.

## What the key cannot do

- Read submissions, forms or account details.
- Change notification recipients or any setting.
- Submit to a form that is disabled (`403`).

## Account-level access

Reading submissions and managing forms needs a signed-in user. AI assistants and tools get that access through the [MCP server](https://docs.formclick.io/mcp/mcp-authentication) with OAuth 2.1 and per-scope consent.