Options reference

<form action="https://api.formpaste.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="text" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">
  <input type="hidden" name="_ts" value="1720700000000">
  <input type="hidden" name="redirect" value="https://example.com/thank-you">
  <input type="email" name="email" placeholder="Your email" required>
  <textarea name="message" placeholder="Your message" required></textarea>
  <button type="submit">Send</button>
</form>
Field	Required	Purpose
`access_key`	Yes	Identifies which form the submission belongs to (`fp_…`). Without it, or with an invalid one, the submission is rejected - see `missing_access_key` / `invalid_access_key` in the error reference.
`botcheck`	No	Honeypot. A hidden field real visitors never fill in. If it arrives non-empty, the submission is quarantined. See Spam filtering.
`_ts`	No	Timestamp the form was rendered, used for timing-based spam heuristics - a submission that arrives implausibly fast scores as suspicious.
`redirect`	No	A URL to `303`-redirect the visitor to after a successful no-JS submit. Must be on the form’s allowed domains list, or the submission fails with `invalid_redirect`. See Redirects.
Option	Field	Plan	Notes
Destination email	-	Free	Where notifications are sent. Must be verified (OTP) before delivery starts.
Allowed domains	`allowed_domains`	Free	Origin allowlist - the real security boundary behind `access_key`. Empty list = any origin. See Domain allowlist.
Allow disposable emails	`allow_disposable_email`	Free	Off by default; disposable-provider emails are quarantined unless this is turned on.
Notification subject	`notification_subject`	Free	Custom subject line for the notification email. ≤ 200 characters.
Sender display name	`sender_name`	Free	Display name the notification email appears to come from. ≤ 100 characters.
Reply-to field mapping	`reply_to_field`	Free	Which submitted field (e.g. `email`) becomes the notification’s `Reply-To` header.
Redirect (submit-time)	`redirect`	Free	See the reserved-field table above - set per-submission, not per-form, but the allowlist that governs it is form-level.
Additional recipients	`additional_recipients`	Pro	Extra To addresses. Combined with `cc_recipients`, capped at 9 (10 total with the primary). Each must be independently verified. See Multiple recipients & CC.
CC recipients	`cc_recipients`	Pro	Addresses CC’d on the notification. Same cap and verification rule as above.
Autoresponder	`autoresponder_enabled` + related fields	Pro	Auto-reply to the submitter. See Autoresponder for the full field list and guardrails.
Webhook URL	`webhook_url`	Pro	Signed HTTPS POST on every delivered submission. See Webhooks.