# Is my access key safe in public HTML?

> Why it’s fine for anyone to see your access key, and what happens if it’s misused.

Source: https://docs.formclick.io/help/access-key-security

**Yes, it’s safe.** The access key works like a mailbox address: anyone who knows it can send a submission to your form, and that’s all.

| Someone with your key can… | Someone with your key cannot… |
| --- | --- |
| Submit to that one form | Read your submissions |
|  | Change settings, recipients or integrations |
|  | See your email address or account |
|  | Use it on other forms in your account |

## What stops abuse

- Honeypot checks and spam scoring.
- Rate limits of 5 submissions per form, per visitor, every 10 minutes.
- Duplicate detection.
- Notification recipients that only you can change.

## If a key is being abused

Turn on a [captcha](https://docs.formclick.io/html-forms/recaptcha) and [restrict the form to your domains](https://docs.formclick.io/help/allowed-domains) in **Settings → Security**. If that isn’t enough, pause the form, create a new one (which has a new key) and update your website. Contact [support@formclick.io](mailto:support@formclick.io) if you see heavy abuse; we can help.