> ## Documentation Index
> Fetch the complete documentation index at: https://formpaste.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Your first form

> Create a form, verify its destination email, and configure the basics.

This walks through creating a form in the dashboard end to end, including
the one manual step every new form needs: verifying where its email goes.

## Create the form

1. Sign in to the [dashboard](https://app.formpaste.com).
2. Click **New form**.
3. Give it a name (for your own reference - visitors never see it) and a
   **destination email** - where submissions get sent.

Formpaste generates an **access key** (`fp_…`) for the form. This is the
value every submission includes to say which form it belongs to. It's
designed to live in public page source - it is not a bearer credential and
does not need to be kept secret the way an API token does.

<Info>
  There's no separate "create form" REST call to make. Forms are created in
  the dashboard, or by an AI agent through the [MCP server's `create_form`
  tool](/docs/agents/create-form) - both paths land in the same place.
</Info>

## Verify the destination email

The first time a form's destination email is used, Formpaste sends a
6-digit code to that address and **holds delivery** until the code is
entered in the dashboard.

This exists so a form can't be pointed at an inbox you don't control and
used to spam it - an agent creating a form for you can't complete this step
on its own (it can't read your inbox), so it's always a human action.

1. Open the code in the email you were sent.
2. Enter it on the form's Setup tab in the dashboard.
3. Once verified, submissions start delivering to that address immediately.

If you create a second form using an email that's already verified on your
account, delivery starts immediately - no repeat OTP.

## Configure the basics

From the form's Setup tab you can set:

* **Allowed domains** - an allowlist of domains permitted to submit to this
  form. This, not CORS, is the real security boundary (see
  [Spam filtering](/docs/features/spam-filtering)).
* **Allow disposable emails** - toggle whether submissions from disposable
  email providers are accepted or quarantined.
* **Notification subject** - a custom subject line for the notification
  email (`notification_subject`).
* **Sender display name** - the display name submissions arrive from
  (`sender_name`).
* **Reply-to field mapping** - which submitted field (e.g. `email`) becomes
  the `Reply-To` header, so you can hit "reply" and answer the visitor
  directly (`reply_to_field`).
* **Redirect** - an optional URL visitors land on after a no-JS submit; see
  [Redirects](/docs/features/redirects).

## Paste the snippet

Copy the access key and snippet from the Setup tab - or see
[Framework snippets](/docs/framework-snippets) for the six supported frameworks
(HTML, React, Next.js, Astro, Vue, Svelte), each a bare, wired form.

## Next

<CardGroup cols={2}>
  <Card title="Framework snippets" icon="brackets-curly" href="/docs/framework-snippets">
    Wired snippets for every supported framework.
  </Card>

  <Card title="Spam filtering" icon="shield" href="/docs/features/spam-filtering">
    How submissions are screened.
  </Card>

  <Card title="Quarantine" icon="box-archive" href="/docs/features/quarantine">
    Where suspicious submissions go instead of being dropped.
  </Card>

  <Card title="MCP server" icon="server" href="/docs/agents/mcp-server">
    Create and configure forms through an agent instead of the dashboard.
  </Card>
</CardGroup>