# Formivo

> Formivo is a developer-first form backend. Create a form, copy its public endpoint, point an existing website at it, and manage the resulting submissions in a dashboard. Public form submissions require no API key or secret; security comes from server-side validation, rate limits, plan quotas, and workspace authorization for reading data.

## Product

- [Homepage](https://formivo.faizyab.me): Product overview, how it works, features, security model and FAQ.
- [Features](https://formivo.faizyab.me/features): Every capability with a link to how it works.
- [Pricing](https://formivo.faizyab.me/pricing): Free, Pro and Agency plans with form, submission and client-viewer limits.
- [Security](https://formivo.faizyab.me/security): The concrete controls behind the public endpoint and client access.
- [About](https://formivo.faizyab.me/about): Why the product exists and what it deliberately does not do.
- [Contact](https://formivo.faizyab.me/contact): Support, sales and security contact channels.

## Documentation

- [Introduction](https://formivo.faizyab.me/docs): What Formivo is, what it stores, and how the pieces fit together.
- [Quickstart](https://formivo.faizyab.me/docs/quickstart): Create a form, copy its endpoint and receive your first submission.
- [HTML forms](https://formivo.faizyab.me/docs/html): Point an existing <form> at a Formivo endpoint with no JavaScript.
- [JavaScript](https://formivo.faizyab.me/docs/javascript): Send submissions with fetch and handle success and failure states.
- [React](https://formivo.faizyab.me/docs/react): A small controlled-form hook with validation and error handling.
- [Next.js](https://formivo.faizyab.me/docs/nextjs): App Router and Route Handler patterns, including server actions.
- [API reference](https://formivo.faizyab.me/docs/api): Endpoint contract, request fields, responses, status codes and limits.
- [Spam protection](https://formivo.faizyab.me/docs/spam-protection): Honeypots, rate limits, origin rules and how to tune them.
- [Submissions](https://formivo.faizyab.me/docs/submissions): Statuses, filtering, export and what each plan allows.
- [Client portal](https://formivo.faizyab.me/docs/client-portal): Invite a client, scope their access and revoke it later.
- [Troubleshooting](https://formivo.faizyab.me/docs/troubleshooting): The failures people actually hit, and the fix for each one.
- [Changelog](https://formivo.faizyab.me/docs/changelog): What shipped, in order, with dates.

## Guides

- [HTML](https://formivo.faizyab.me/guides/html): The shortest integration: change the form's action and method. No JavaScript, no key in the markup.
- [JavaScript](https://formivo.faizyab.me/guides/javascript): Fetch the endpoint with JSON, read the structured error body, and disable the button only while the request is running.
- [React](https://formivo.faizyab.me/guides/react): Read FormData on submit, validate once for feedback, post JSON, render a status message.
- [Next.js](https://formivo.faizyab.me/guides/nextjs): Server actions keep the endpoint server-side; client fetch keeps the visitor on the page.
- [Vue](https://formivo.faizyab.me/guides/vue): Bind inputs, post JSON on submit, and keep the Submit button disabled only during the request.
- [Nuxt](https://formivo.faizyab.me/guides/nuxt): either $fetch from the component or a Nitro server route that forwards the payload.
- [PHP](https://formivo.faizyab.me/guides/php): The simplest path is a normal HTML form; server-side forwarding needs one cURL call.
- [Laravel](https://formivo.faizyab.me/guides/laravel): Validate in Laravel, then Http::post the payload and branch on successful().
- [Node.js](https://formivo.faizyab.me/guides/node): Native fetch, AbortSignal.timeout for a hard deadline, and a status check.
- [Express](https://formivo.faizyab.me/guides/express): One route, express.json(), a minimum of validation, and an upstream POST.
- [Python](https://formivo.faizyab.me/guides/python): requests.post with a timeout, then raise_for_status and read the JSON.
- [Django](https://formivo.faizyab.me/guides/django): Use a Django Form for validation and requests for the upstream call.
- [Flask](https://formivo.faizyab.me/guides/flask): request.form → validation → requests.post → flash a message.
- [Static sites](https://formivo.faizyab.me/guides/static): Use the native form action. There is no build step, framework or key involved.

## Blog

- [How to add a contact form to a static site](https://formivo.faizyab.me/blog/contact-form-on-a-static-site): A static site cannot receive a POST request on its own. Here is the shortest working path: one action attribute, one redirect, one honeypot field.
- [Form backend vs building your own endpoint](https://formivo.faizyab.me/blog/form-backend-vs-custom-backend): Cost, control and maintenance compared between a hosted form backend and your own API route — including the cases where building it yourself is the right call.
- [How to share form submissions with clients (without sharing your account)](https://formivo.faizyab.me/blog/share-form-submissions-with-clients): Why emailing CSV exports and sharing logins both fail, and how per-form read-only access with revocable invitations works in practice.
- [Honeypots versus CAPTCHAs for form spam](https://formivo.faizyab.me/blog/honeypots-versus-captchas): CAPTCHAs ask every visitor to prove they are human. A honeypot asks only the bots. Here is where each one works, and why the strongest setup uses several cheap layers.
- [Form submission security: what actually protects a public endpoint](https://formivo.faizyab.me/blog/form-submission-security): A public form endpoint is unauthenticated by design. Here is what genuinely protects it — and which popular measures are theatre.
- [What a client should see in a form dashboard](https://formivo.faizyab.me/blog/form-dashboard-for-clients): Sending a CSV every Friday is not a client portal. Here is the access model that works: one permission per form, read-only by default, revocable in one click.
- [How to prevent contact form spam (without CAPTCHA everywhere)](https://formivo.faizyab.me/blog/prevent-contact-form-spam): Layered spam defence for public forms: honeypots, rate limits, origin allow-lists, idempotency and content checks — and when a CAPTCHA is actually worth the friction.
- [How to stop duplicate form submissions](https://formivo.faizyab.me/blog/stop-duplicate-form-submissions): Duplicates come from three places: a double click, a retried request after a timeout, and a refreshed thank-you page. Each needs a different fix.
- [Connecting a React form to a backend](https://formivo.faizyab.me/blog/react-form-backend): A complete React form with controlled inputs, client validation, a real POST request and accessible error handling — no form library required.
- [A form submission data model that ages well](https://formivo.faizyab.me/blog/form-data-model): Most form schemas start as a column per field and end as a migration every time marketing changes a question. Here is the shape that avoids that, and the fields to never store.
- [How to handle form submissions in Next.js](https://formivo.faizyab.me/blog/nextjs-form-backend): Three working patterns for Next.js App Router forms: a server action, a client fetch, and a plain HTML form. Plus where the data should live.
- [HTML form action vs JavaScript fetch: which should you use?](https://formivo.faizyab.me/blog/form-action-vs-javascript-fetch): Native form submission is faster, works without JavaScript, and is easier to make accessible. fetch() gives you inline validation and no page reload. Here is how to decide.
- [How to handle HTML form submissions without building a backend](https://formivo.faizyab.me/blog/html-form-submissions-without-a-backend): Point an existing HTML form at a hosted endpoint, choose the right response format, and read the submissions in a dashboard. No server required.
- [What is a form backend?](https://formivo.faizyab.me/blog/what-is-a-form-backend): A form backend receives, validates, stores and delivers the data behind an HTML form. Here is what it replaces, what it does not do, and how to choose one.

## Alternatives

- [Formivo vs Formspree](https://formivo.faizyab.me/alternatives/formspree): Both accept a POST from an existing form. The difference appears after the submission: Formspree is built around your inbox and integrations, Formivo around the client who receives the leads. Competitor facts verified 2026-11-05.
- [Formivo vs Web3Forms](https://formivo.faizyab.me/alternatives/web3forms): Both are aimed at sites without a backend. Web3Forms optimises for email delivery with an embedded access key; Formivo optimises for stored submissions you can hand to a client. Competitor facts verified 2026-11-05.
- [Formivo vs Formspark](https://formivo.faizyab.me/alternatives/formspark): Formspark's model is prepaid credits that never expire. Formivo's model is a monthly plan with seats for the people who read the leads. Competitor facts verified 2026-11-05.
- [Formivo vs Basin](https://formivo.faizyab.me/alternatives/basin): Basin bundles forms, spam protection and collaboration into projects. Formivo trades breadth for a narrow, well-defined client-sharing model. Competitor facts verified 2026-11-05.
- [Formivo vs FormSubmit](https://formivo.faizyab.me/alternatives/formsubmit): FormSubmit is email forwarding with a one-time activation link. Formivo keeps a record you can query, filter and share. Competitor facts verified 2026-11-05.

## Pricing summary

- Free: $0, 3 active forms, 300 submissions per month, 3 client viewers, no CSV export.
- Pro: $19 per month, 10 active forms, 2,000 submissions per month, 10 client viewers, CSV export.
- Agency: $49 per month, 50 active forms, 10,000 submissions per month, 50 client viewers, CSV export.

## API summary

- Endpoint: POST https://formivo.faizyab.me/api/f/{formId}
- Content types: application/json, application/x-www-form-urlencoded, multipart/form-data
- Success: 200 (HTML thank-you page) or 201 with a JSON body containing success, leadId and message
- Errors: 400 invalid payload, 404 unknown form, 409 paused form or quota reached, 413 body too large, 415 unsupported content type, 429 rate limited with Retry-After, 405 for reads
- Authentication: none for submissions; reading submissions requires a signed-in workspace member or an invited client viewer
- Reserved helper fields: _redirect, _gotcha, _honey, _subject, _idempotency_key

## Terminology

- "Form": one endpoint plus its settings, owner and submissions.
- "Client viewer": a client account with read-only access to specific forms.
- "Workspace": the container that owns forms, billing and usage.
- "Submission": one accepted POST, stored with structured data and metadata.