Hosted sign-up form page and embed code #39

New issue

Closed

opened 2026-10-15 01:19:06 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-15 01:19:06 -04:00

Owner

Today: a form is only an API endpoint (POST /api/public/forms/:id/submit, JSON). There is no page to send people to and no HTML to paste into a website.

Plan

Public form page, GET /f/:formId (served by the backend, no login):
- renders the form's fields and wording
- accepts a normal HTML form post as well as JSON
- then shows the thank-you message or redirects
Embed code: a copyable HTML snippet with a plain <form> and inline styles that posts to the public endpoint. An "Allow embedding" setting controls whether cross-site posts and framing are accepted.
The form list shows Open, Copy link, and Edit on each form.
Use CSRF-safe handling for cross-site posts. Don't set cookies, and validate the form id and fields only.
The page is accessible: labels, error messages tied to fields, keyboard use.

**Today:** a form is only an API endpoint (`POST /api/public/forms/:id/submit`, JSON). There is no page to send people to and no HTML to paste into a website. **Plan** - **Public form page**, `GET /f/:formId` (served by the backend, no login): - renders the form's fields and wording - accepts a normal HTML form post as well as JSON - then shows the thank-you message or redirects - **Embed code**: a copyable HTML snippet with a plain `<form>` and inline styles that posts to the public endpoint. An "Allow embedding" setting controls whether cross-site posts and framing are accepted. - The form list shows **Open**, **Copy link**, and **Edit** on each form. - Use CSRF-safe handling for cross-site posts. Don't set cookies, and validate the form id and fields only. - The page is accessible: labels, error messages tied to fields, keyboard use.

vmanne-poc added this to the Phase 11: Sign-up forms milestone

2026-10-15 01:19:06 -04:00

vmanne-poc added the

feature

label

2026-10-15 01:19:06 -04:00

vmanne-poc referenced this issue from a commit

2026-10-15 09:31:16 -04:00

Sign-up forms: hosted page and embed, validated settings, opt-in and welcome emails, spam protection

vmanne-poc referenced this issue from a commit

2026-10-15 09:31:16 -04:00

Form editor and forms list