Skip to main content
This walks through creating a form in the dashboard end to end, including the one manual step every new form needs: verifying where its email goes.

​
Create the form

  1. Sign in to the dashboard.
  2. Click New form.
  3. Give it a name (for your own reference - visitors never see it) and a destination email - where submissions get sent.
Formpaste generates an access key (fp_…) for the form. This is the value every submission includes to say which form it belongs to. It’s designed to live in public page source - it is not a bearer credential and does not need to be kept secret the way an API token does.
There’s no separate “create form” REST call to make. Forms are created in the dashboard, or by an AI agent through the MCP server’s create_form tool - both paths land in the same place.

​
Verify the destination email

The first time a form’s destination email is used, Formpaste sends a 6-digit code to that address and holds delivery until the code is entered in the dashboard. This exists so a form can’t be pointed at an inbox you don’t control and used to spam it - an agent creating a form for you can’t complete this step on its own (it can’t read your inbox), so it’s always a human action.
  1. Open the code in the email you were sent.
  2. Enter it on the form’s Setup tab in the dashboard.
  3. Once verified, submissions start delivering to that address immediately.
If you create a second form using an email that’s already verified on your account, delivery starts immediately - no repeat OTP.

​
Configure the basics

From the form’s Setup tab you can set:
  • Allowed domains - an allowlist of domains permitted to submit to this form. This, not CORS, is the real security boundary (see Spam filtering).
  • Allow disposable emails - toggle whether submissions from disposable email providers are accepted or quarantined.
  • Notification subject - a custom subject line for the notification email (notification_subject).
  • Sender display name - the display name submissions arrive from (sender_name).
  • Reply-to field mapping - which submitted field (e.g. email) becomes the Reply-To header, so you can hit “reply” and answer the visitor directly (reply_to_field).
  • Redirect - an optional URL visitors land on after a no-JS submit; see Redirects.

​
Paste the snippet

Copy the access key and snippet from the Setup tab - or see Framework snippets for the six supported frameworks (HTML, React, Next.js, Astro, Vue, Svelte), each a bare, wired form.

​
Next

Framework snippets

Wired snippets for every supported framework.

Spam filtering

How submissions are screened.

Quarantine

Where suspicious submissions go instead of being dropped.

MCP server

Create and configure forms through an agent instead of the dashboard.