The API
BootForm has three separate hosts, each its own service with its own auth model - not one API behind one base URL.
| Host | Purpose | Auth |
|---|---|---|
f.bootform.com | Public submission endpoint + content feed | None |
api.bootform.com | Dashboard/account operations (forms, submissions, destinations, workspaces, billing, etc.) | API key or session token |
mcp.bootform.com | MCP server for AI agents | None for bootform_create_form and bootform_get_snippet; API key for everything else |
f.bootform.com is deliberately open - it's the one part of BootForm meant to be hit directly by a visitor's browser, with no credentials involved. The MCP server is open in a narrower way: an unauthenticated session can reserve a form ID and build a snippet, and nothing else (see MCP & AI agents). Everything else requires authentication.
Authentication
Programmatic access to api.bootform.com, and to all but two of mcp.bootform.com's tools, uses an API key:
Authorization: Bearer {api_key}Create one from the dashboard (Settings → API Keys). The full key is shown exactly once at creation time - store it securely, since it can't be retrieved again (only its prefix and label are ever shown afterward). Revoking a key takes effect immediately.
An API key can do everything on your account. Keys have no scopes, and there are no read-only or per-form keys. Use them only from a server, a script or an integration (the MCP server does not take API keys; AI tools sign in through the browser instead), and never put one in client-side JavaScript, a static site's source or a public repository. To show submissions on a public page, use the moderated content feed: it needs no key and shows only what you approved.
The dashboard UI itself authenticates differently - a session/JWT token issued at login, not an API key - since it also carries things an API key doesn't need, like which team account you're currently acting as. If you're calling the API from a script or an integration, an API key is what you want; the session-token flow is for the dashboard's own use.
Requests and responses
All request and response bodies are JSON (except the submission endpoint, which also accepts application/x-www-form-urlencoded and multipart/form-data - see Building your form). Every successful response includes "ok": true; every error follows the same shape:
{ "ok": false, "error": "human-readable message", "code": "MACHINE_CODE" }Pagination uses page (1-based) and per_page (default 50, max 200) query params. Timestamps are ISO 8601 UTC strings.
Common error codes
| Code | HTTP status | Meaning |
|---|---|---|
UNAUTHORIZED | 401 | Missing or invalid API key |
FORBIDDEN | 403 | Key valid but lacks permission for this action |
NOT_FOUND | 404 | Resource does not exist |
VALIDATION_ERROR | 422 | Request body failed validation |
PLAN_LIMIT | 403 | This feature isn't included on the account's current plan |
FORM_DELETED | 410 | The form was deleted; its ID can never be used or claimed again |
FORM_INACTIVE | 410 | The form's account was closed; signing in again brings the form back |
QUOTA_EXCEEDED | 429 | The account's monthly submission quota is used up (Free plan; it's shared by all the account's forms) |
FORM_LIMIT_REACHED | 403 | The account has 1,000 forms, the fair-use limit on every plan |
RATE_LIMITED | 429 | Too many requests - see Rate limits below |
INTERNAL_ERROR | 500 | Unexpected server error |
Many endpoints have their own specific error codes beyond this list (e.g. field-validation codes on the submission endpoint) - the full set is in the OpenAPI schema.
Rate limits
Every authenticated api.bootform.com request counts against a per-minute limit based on your plan. The limit is per account: every API key and dashboard session on the account shares it.
| Plan | Requests per minute |
|---|---|
| Free | 60 |
| Starter | 300 |
| Pro | 1,000 |
| Business | 5,000 |
Every response includes rate-limit headers so you can track your usage without guessing:
X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287
X-RateLimit-Reset: 1751457600The public endpoints on f.bootform.com have their own limits, per visitor IP address rather than per account, and don't count against the table above:
| Endpoint | Limit |
|---|---|
| Submitting a form | 5 per minute per IP address per form, and 100 per hour per form |
| Content feed | 60 per minute per IP address per form |
| Content feed files | 600 per minute per IP address per form |
| Reactions / reports | See Moderated content feed |
Full schema
This page covers the shape of the API; for the exhaustive, always-current schema (every endpoint, every request/response field), see the generated OpenAPI spec: openapi.json / openapi.yaml.