> ## Documentation Index
> Fetch the complete documentation index at: https://formpaste.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Options reference

> Every reserved /submit field and per-form dashboard option, in one place.

Two kinds of "options" apply to a Formpaste form: fields you put directly in the
`<form>` that get read by `/submit`, and per-form config you set once in the dashboard.
This page is the complete list of both.

## Reserved fields (in the form body)

These field names are read by `/submit` itself - set them as inputs in your form (or
keys in your JSON/`FormData` body). Every other field name is yours.

| Field        | Required | Purpose                                                                                                                                                                                                                                |
| ------------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `access_key` | **Yes**  | Identifies which form the submission belongs to (`fp_…`). Without it, or with an invalid one, the submission is rejected - see `missing_access_key` / `invalid_access_key` in the [error reference](/docs/reference/error-table).           |
| `botcheck`   | No       | Honeypot. A hidden field real visitors never fill in. If it arrives non-empty, the submission is quarantined. See [Spam filtering](/docs/features/spam-filtering).                                                                          |
| `_ts`        | No       | Timestamp the form was rendered, used for timing-based spam heuristics - a submission that arrives implausibly fast scores as suspicious.                                                                                              |
| `redirect`   | No       | A URL to `303`-redirect the visitor to after a successful no-JS submit. Must be on the form's [allowed domains](/docs/features/custom-domains) list, or the submission fails with `invalid_redirect`. See [Redirects](/docs/features/redirects). |

```html theme={null}
<form action="https://api.formpaste.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="text" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">
  <input type="hidden" name="_ts" value="1720700000000">
  <input type="hidden" name="redirect" value="https://example.com/thank-you">
  <input type="email" name="email" placeholder="Your email" required>
  <textarea name="message" placeholder="Your message" required></textarea>
  <button type="submit">Send</button>
</form>
```

Only `access_key` is required. The other three are opt-in - add `botcheck` and `_ts` to
strengthen spam detection, add `redirect` only for no-JS forms that need a post-submit
navigation.

## Per-form config (dashboard)

These aren't submitted with each request - you set them once per form, from that form's
Setup tab in the [dashboard](https://app.formpaste.com) (or via the MCP
[`create_form`](/docs/agents/create-form) tool for the initial destination email). They
control how a form behaves for every submission it receives.

| Option                  | Field                                    | Plan | Notes                                                                                                                                                                                               |
| ----------------------- | ---------------------------------------- | ---- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Destination email       | -                                        | Free | Where notifications are sent. Must be [verified](/docs/first-form#verify-the-destination-email) (OTP) before delivery starts.                                                                            |
| Allowed domains         | `allowed_domains`                        | Free | Origin allowlist - the real security boundary behind `access_key`. Empty list = any origin. See [Domain allowlist](/docs/features/custom-domains).                                                       |
| Allow disposable emails | `allow_disposable_email`                 | Free | Off by default; disposable-provider emails are quarantined unless this is turned on.                                                                                                                |
| Notification subject    | `notification_subject`                   | Free | Custom subject line for the notification email. ≤ 200 characters.                                                                                                                                   |
| Sender display name     | `sender_name`                            | Free | Display name the notification email appears to come from. ≤ 100 characters.                                                                                                                         |
| Reply-to field mapping  | `reply_to_field`                         | Free | Which submitted field (e.g. `email`) becomes the notification's `Reply-To` header.                                                                                                                  |
| Redirect (submit-time)  | `redirect`                               | Free | See the reserved-field table above - set per-submission, not per-form, but the allowlist that governs it is form-level.                                                                             |
| Additional recipients   | `additional_recipients`                  | Pro  | Extra **To** addresses. Combined with `cc_recipients`, capped at 9 (10 total with the primary). Each must be independently verified. See [Multiple recipients & CC](/docs/features/multiple-recipients). |
| CC recipients           | `cc_recipients`                          | Pro  | Addresses CC'd on the notification. Same cap and verification rule as above.                                                                                                                        |
| Autoresponder           | `autoresponder_enabled` + related fields | Pro  | Auto-reply to the submitter. See [Autoresponder](/docs/features/autoresponder) for the full field list and guardrails.                                                                                   |
| Webhook URL             | `webhook_url`                            | Pro  | Signed HTTPS POST on every delivered submission. See [Webhooks](/docs/features/webhooks).                                                                                                                |

<Note>
  There's no config endpoint to call - these are dashboard-only settings. The MCP server
  doesn't expose an `update_form` tool; if you need to change one of these after
  `create_form`, do it in the dashboard. See [MCP server](/docs/agents/mcp-server#the-three-tools).
</Note>

## Free vs. Pro fields

Attempting to set a Pro-gated field (`additional_recipients`, `cc_recipients`,
`autoresponder_enabled`, `webhook_url`) on a Free-plan form fails at save time:

| Code               | HTTP | Meaning                           |
| ------------------ | ---- | --------------------------------- |
| `upgrade_required` | 403  | This feature requires a Pro plan. |

<CardGroup cols={2}>
  <Card title="Error reference" icon="triangle-exclamation" href="/docs/reference/error-table">
    Every `/submit` error code, HTTP status, and meaning.
  </Card>

  <Card title="Your first form" icon="inbox" href="/docs/first-form">
    The dashboard walkthrough these options come from.
  </Card>
</CardGroup>