Posting forms from your own front end

You build forms in the admin under Site → Forms. Every form has a slug, and every question has an id. The form's Integration tab shows you the endpoint, the write key and a snippet that works as is.

The endpoint

POST https://intake.foundationcms.org/v1/<site>/forms/<slug>    works from day one
POST https://intake.<your domain>/forms/<slug>                    once the intake address is set up (no CORS preflight)

Content-Type: application/json
x-foundation-key: <the form's write key>

{ "q_name": "Amara Reid", "q_email": "amara@example.com", "q_message": "…",
  "cf-turnstile-response": "<token>" }

Answers are keyed by question id. Only send the form's own ids, because any question the form doesn't have will be rejected.

The human check

If the site has spam protection switched on (Settings → Site → Spam protection), you need to render its widget inside your form. That's Cloudflare Turnstile by default, or Google reCAPTCHA. Use the site key shown on that settings page, then send the token the widget produces (cf-turnstile-response or g-recaptcha-response) along with the answers.

Don't submit until the token is there. If the form is sent before the check has finished, it'll be rejected.

Keep the key on your server if you can

Foundation's own sites post forms to their own Worker first. The Worker adds the write key and the visitor's IP address, then forwards the submission, so the key never reaches the browser.

If the key does end up in your page source, the damage is limited: someone could only submit that one form, and the rate limits below still apply. It's still better kept on the server.

Responses