Appearance

Getting started ​

BootForm is a form backend: point an HTML <form> at a BootForm endpoint and it starts accepting submissions immediately - no account, no signup, no API call before your first real submission arrives.

What you can build with it ​

BootForm is meant to be the whole backend of a static site (GitHub Pages, Netlify, plain HTML, VitePress, Astro and so on), for anything that starts with a visitor filling in a form. You don't need a server, a serverless function or a database for:

You want to...UsePlan
Receive a contact, signup or order formThe form endpoint (Building your form)Free
Receive photos or other filesThe same endpoint, with a file inputStarter+
Get notified by email or DiscordNotificationsFree
Get notified in Slack, Telegram or via a webhookNotificationsStarter+
Send submissions to Zapier or MakeIntegrationsPro+
Show submissions on your site: testimonials, a guestbook, a community board, a map of reports, listings, giveaways, photos includedModerated content feed: public, no API key, you approve each onePro+
Let visitors react to or report what's shownModerated content feedPro+
Work with submissions from your own codeThe APIFree
Have an AI agent set it all upMCP & AI agentsFree

What it doesn't do: visitor accounts or logins, submitters editing their own entries, or publishing anything you haven't approved.

Zero-friction quick start ​

Pick any ID (a UUID works well) and POST to it - nothing to register first:

html
<form action="https://f.bootform.com/{form_id}" method="POST">
  <!-- Required: BootForm's spam trap. Keep this hidden field and leave it empty. -->
  <input type="text" name="honeypot" style="position:absolute;left:-9999px" tabindex="-1" autocomplete="off" />
  <input name="email" type="email" required />
  <textarea name="message"></textarea>
  <button type="submit">Send</button>
</form>

The first submission to a given {form_id} creates that form automatically. Submissions are held (up to 10 per form) until someone claims it - see below - so you can try this out right now without losing what comes in while you decide whether to sign up.

The hidden honeypot input is the spam trap. A form you start this way keeps that name when you claim it, and a form you create in the dashboard uses it too. You can rename it later in the form's spam protection settings. See Spam protection.

{form_id} has to be a UUID. You don't have to register it anywhere first, but it does have to be a UUID: an unclaimed form is claimed by its UUID, so anything else is rejected with 422 INVALID_FORM_ID rather than accepted and then left unclaimable. A visitor whose plain HTML form posts to a bad id is sent to a page that explains it and generates a valid one on the spot; a script, curl or fetch call gets the 422 response instead. The placeholder UUIDs printed in these docs (such as 11111111-1111-4111-8111-111111111111) and the all-zeros UUID are rejected the same way, because anyone can see or guess them: generate your own. A memorable id like contact-form is a vanity slug, which you set on a form you already own, on Pro and above.

Requests can be application/x-www-form-urlencoded, multipart/form-data (for file uploads), or application/json. On success, BootForm redirects back to the page that submitted the form; add _format=json (or send Accept: application/json) to get a 200 {"ok":true} JSON response instead, for AJAX/fetch submissions.

Claiming a form ​

You don't need to go find the claim URL yourself - every submission to a form nobody's claimed yet already points at it. A classic browser POST redirects the visitor straight to https://app.bootform.com/claim/{form_id} once the submission is held; an AJAX/JSON request gets the same URL back in the response body instead, as {"ok":true,"status":"pending_claim","claim_url":"https://app.bootform.com/claim/{form_id}"}, so you can surface it in your own UI while you're testing the integration.

Either way, create a BootForm account (or log into an existing one) and follow that link to take ownership of the form. Once claimed, it behaves like any other form in your dashboard: full submission history, notification destinations, spam protection, and every other setting described in the rest of this documentation.

Claiming also sets up your first notification: if the email address you log in with is verified on the account you claim into, the form gets an email destination to that address, and the submissions that were waiting are emailed to you as they're released. If it isn't verified yet (for example you just signed up with a password and haven't clicked the confirmation link), the claim still works and the form starts with no destinations; once you click the link, the email destination is added to it then, and every submission from that point on is emailed to you (the ones already released are not sent again). A team member whose own address isn't one of the team's verified emails gets no email destination. You can remove or change the email destination like any other, from the form's Workflow tab.

The claim page shows how many submissions are waiting, when each arrived, and which fields it has, but not what was typed into them: anyone who reads your page's HTML can see its form id, so the contents stay private until the form is claimed. Held submissions are kept for 48 hours, counted from the first one, so claim the form within two days of your first test.

How the pieces fit together ​

  • f.bootform.com is the public submission endpoint - where your <form>'s action points. No authentication; this is the one part of BootForm meant to be hit directly by a visitor's browser.
  • app.bootform.com is the dashboard - where you view submissions, configure notifications, and manage your account, forms, and workspaces.
  • api.bootform.com is the REST API behind that dashboard - the same operations, callable directly with an API key. See The API.
  • mcp.bootform.com is the MCP (Model Context Protocol) server - lets an AI agent create and configure forms, read submissions, and manage notification destinations on your behalf. You connect it once with a browser sign-in, no API key. See MCP & AI Agents.

Where to go next ​