API keys, signed webhooks, an embed SDK with 4 modes, service accounts with granular scopes, and JSON Schema export. Everything developers need to integrate forms into any workflow.
Generate API keys to access forms and submissions programmatically. Keys are SHA-256 hashed, shown only once on creation, and tracked with last-used timestamps. Revoke anytime.
xf_live_sk_•••••••••••abc xf_test_sk_•••••••••••xyz Get notified when submissions are created, updated, deleted, or when status changes. Payloads are cryptographically signed. Automatic retry with exponential backoff — up to 3 attempts.
submission.createdsubmission.updatedsubmission.deletedEvery published form exposes a JSON Schema at a public endpoint. Use it for validation, code generation, or documentation. The same schema powers server-side submission validation.
Inline, popup, lightbox, or feedback panel — embed forms anywhere with a lightweight vanilla JS SDK. Auto-resize, event callbacks, theme overrides, and origin-secure messaging.
Admin-managed service accounts with 10 granular scopes — forms:read, submissions:write, webhooks:manage, and more. Perfect for backend integrations and automation.
The public API at /api/v1/ is a frozen contract — no breaking changes, ever. Load forms, submit data, and export schemas with confidence.
Webhook URLs are validated against private and internal address ranges before delivery. No accidental exposure of internal services.
Every webhook delivery is logged with status, response code, response body, and timing. Test webhooks synchronously before going live.
API keys, webhooks, embeds, and service accounts — everything you need to integrate forms into your stack.