REST API
Create forms, read submissions, and manage everything programmatically. An OpenAPI spec ships with it, so client generation and request validation come for free.
API referenceHooks, not headaches.
A clean REST API, signed webhooks, scoped tokens, and an MCP server your assistant can drive.
<form action="https://formspring.io/f/abc123" method="POST">
<input type="email" name="email" required />
<textarea name="message"></textarea>
<button type="submit">Send</button>
</form>- Signed webhooks
- OpenAPI spec
- 134 tools
- EU hosted
The API and the MCP server are on every plan, free included. Webhooks unlock on Pro.
One URL in your form action.
Point the action attribute at your form endpoint and you are done: no SDK, no build step, no server route. Every submission lands in a real dashboard, fires a signed webhook, and is filtered for spam before it reaches you.
<form action="https://formspring.io/f/abc123" method="POST">
<input type="email" name="email" required />
<textarea name="message"></textarea>
<button type="submit">Send</button>
</form>Capabilities
Inspectable plumbing, all the way down.
Five surfaces, one workspace. Read the docs for the full reference; the shape does not change out from under you every six months.
Webhooks
Signed, retried, replayable delivery of every submission event. Verify the HMAC signature, replay a delivery from history, and read the delivery log right next to the submission.
MCP server
Connect Claude, Cursor, or any MCP client and run Formspring from your assistant. 134 tools, OAuth device flow, scoped to one workspace at a time.
Tokens & abilities
Scoped personal access tokens with fine-grained abilities. Grant forms:read without forms:write, rotate a token from the dashboard, and audit which token did what.
Embed & quick tools
Drop a form anywhere with one script tag. Shorten a link or spin up a 24-hour quick form with no account, then graduate to the full workspace when you are ready.
Verify the signature. Trust the payload.
Every delivery carries an HMAC signature you check in constant time. The same scoped token reads submissions back over the REST API when you want a pull instead of a push.
- Signed
- HMAC-SHA256 over the raw body, compared in constant time.
- Retried
- Failed deliveries back off and retry, and the attempts are logged.
- Replayable
- Re-send any past delivery from history once your handler is fixed.
// Every delivery is signed. Compare in constant time.
const signature = req.headers["x-formspring-signature"];
const expected = hmacSha256(signingSecret, rawBody);
if (!timingSafeEqual(expected, signature)) {
return res.status(401).end();
}
const payload = JSON.parse(rawBody);
handle(payload.submission);Spam protection
Layered, not stacked.
Five filters, each at the right point in the pipeline. The cheap ones run first; nothing wastes compute on a bot a honeypot already caught.
Honeypot
A hidden field is auto-injected on every form. Naive bots fill it; real people do not. Rejected before any spam compute runs.
Captcha (your keys)
Bring your own hCaptcha or reCAPTCHA keys, configured per form. The challenge fires only when reputation says the friction is worth it.
Custom rules
Block by keyword, domain, country, or regex. Useful for blanket bans on competitor outreach and known burner-email patterns.
Reputation pass
An optional Akismet pass scores every submission and catches known bad actors before they ever reach your inbox.
AI moderation
A model reads the message body itself and flags solicitation, scam patterns, and prompt injection in the response payload.
Send submissions anywhere.
Native destinations, signed outbound webhooks, and a REST API with an OpenAPI spec. Set them up in a couple of clicks, or wire them yourself.
Slack
Google Sheets
Zapier
Notion
Airtable
HubSpot
Telegram- WHWebhook
Plans
Per workspace. Not per form.
One submission counter for the whole workspace. The API and the MCP server ship on every plan; signed webhooks unlock on Pro.
| Plan | Price | Submissions | Retention | What's included |
|---|---|---|---|---|
| Free | Free | 50 submissions/mo | 30-day retention | REST API, MCP server, spam filtering |
| Pro | $19/mo | 5,000 submissions/mo | Keep as long as you like | Signed webhooks, AI features, custom branding |
| Team | $49/mo | 25,000 submissions/mo | Keep as long as you like | Roles, shared workspaces, agency mode |
| Scale | $149/mo | Unlimited submissions | Keep as long as you like | Response Desk and unlimited seats |
Questions from builders.
Is it really free?
Yes. The Free plan accepts 50 submissions per month with 30-day retention, no credit card required. Upgrade only when a project crosses 50 a month.
How does pricing scale?
Plans are billed per workspace, not per form. Pro is $19/mo for 5,000 submissions. Team is $49/mo for 25,000. Scale is $149/mo with unlimited submissions. Over-quota submissions return HTTP 402 so the client knows the response was not accepted.
Do I need to handle CORS?
No. The ingestion endpoint allows cross-origin POSTs from any domain, returns JSON on Accept: application/json, and supports both standard form-encoded bodies and JSON payloads. No preflight tuning required.
Is my data in the EU?
Yes. Submissions and uploaded files are stored in Germany by default - EU object storage for files and EU-region transactional mail. The Data Processing Addendum at /dpa lists every sub-processor.
Will it work with my React, Next, Vue, or Astro setup?
Anything that can POST works. Drop the endpoint URL into the form action, or fetch() to it from a client component. Snippets ship for HTML, React, Vue, Next.js, Astro, SvelteKit, Nuxt, vanilla JS, Python, PHP, and Ruby.
How does spam protection work?
Layered, not stacked. A hidden honeypot field catches naive bots before any compute runs. Optional hCaptcha or reCAPTCHA add a real-user challenge. Custom rules let you block by keyword or pattern. Akismet reputation scoring filters known bad actors. AI moderation reads the message itself and flags solicitation, profanity, and prompt injection.
Are webhooks signed?
Yes. Every webhook delivery carries an x-formspring-signature header with an HMAC-SHA256 of the raw body using your per-form secret. A failed delivery is retried on an exponential schedule, 8 attempts across about 4.9 hours, with full delivery history and one-click replay from the dashboard.
Read the docs. Get a token.
The free plan covers a personal site or a small intake flow. Upgrade when you want signed webhooks and the higher submission allowance.
Signed webhooks, an OpenAPI spec, and EU hosting.