Features

Get a clean, formatted email the moment someone submits your form. Every field is laid out in a readable table with a direct link back to your dashboard.

A hidden field that bots fill in and humans never see. If it has a value, the submission is silently accepted (so bots don't know they were caught) but never stored or emailed.

Every endpoint is rate-limited via Upstash Redis — per IP, per form, and per account. Abuse is blocked automatically with proper 429 responses and Retry-After headers.

Download all submissions for any form as a CSV file with one click. All field keys are auto-detected across submissions so nothing is missed.

Set a default redirect URL per form, or override it per submission with the _redirect field. Send visitors to your own thank-you page instead of ours.

View all your forms and submissions in one place. See submission counts, email delivery status, timestamps, and all submitted field data at a glance.

No passwords to remember or leak. Sign in with a magic link sent to your email. Sessions are secured with HTTP-only cookies.

Keys are prefixed (ob_live_) for easy identification, shown once at creation, and stored as SHA-256 hashes. Regenerate anytime — the old key is invalidated instantly.

The submission endpoint accepts POST requests from any origin. Point forms from any domain — no proxy or server-side setup needed.

No JavaScript required on your site. A standard HTML form with a hidden _apikey input and a POST action is all you need. Works everywhere HTML works.