# Access key

> The access key identifies your form. It is safe to publish in your page’s HTML.

Source: https://docs.formclick.io/html-forms/access-key

Every Formclick form has an access key, a UUID such as `21e56b6c-55b5-4c8d-ab3b-83222682465f`. Formclick uses it to decide which form, inbox and integrations a submission belongs to.

## Where to find it

Open the form in your dashboard and go to the **Connect** tab. The key is shown there along with ready-to-copy snippets.

## Two ways to send it

Send the key as a hidden field named `access_key`, or put it in the endpoint path. Both work the same way; the hidden field is the most common.

**Hidden field**

```html
<form action="https://api.formclick.io/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <!-- your fields -->
</form>

<!-- Handles submit, file upload, loading state and success/error messages. -->
<script src="https://cdn.formclick.io/formclick.min.js"></script>
```

**In the URL**

```html
<form action="https://api.formclick.io/submit/YOUR_ACCESS_KEY" method="POST">
  <!-- With the script, keep the hidden access_key field as well -->
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <!-- your fields -->
</form>

<!-- Handles submit, file upload, loading state and success/error messages. -->
<script src="https://cdn.formclick.io/formclick.min.js"></script>
```

> **Note:** Using `formclick.min.js`? Use the hidden field. The script needs it for its key check and for file uploads.

## Is it safe to put in public HTML?

Yes. The access key can only **create** submissions for that one form. It cannot read submissions, change settings, see your email address or access your account. Treat it like a public form address, not a password.

Abuse is handled on the server: honeypot checks, spam scoring, per-IP rate limits and duplicate detection all apply no matter who has the key. See [Spam protection](https://docs.formclick.io/html-forms/spam-protection).

> **Invalid keys are rejected:** The key must be a valid UUID. A missing or malformed key returns `400`, an unknown key returns `404`, and a form you have disabled returns `403`. `formclick.min.js` checks the key before submitting and shows a configuration message if it is missing.