Connect a form

Public forms

Public browser and static-site submissions use POST /f/:publicKey. HTML, form-encoded requests and JSON are supported. Your public form key is not a secret.

Use the form’s allowed-origin settings when browser access should be limited to your domains. Spam controls and rate limits remain independent of those settings.

fetch('https://pantherhook.com/f/YOUR_PUBLIC_FORM_KEY', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ email: 'lead@example.com' }),
});

Server-side submissions

Server applications can use POST /api/v1/forms/:formId/submissions with a Bearer token scoped to submissions:create. Keep that token in server-side secret storage, never in client JavaScript.

The server submission API accepts an optional test: true field. This trusted API route does not use browser-only Turnstile and honeypot challenges and does not support file uploads.

Run this request from your backend or terminal with a submissions:create token; never paste this command or token into a public browser page.

curl -i -X POST 'https://pantherhook.com/api/v1/forms/YOUR_FORM_ID/submissions' \
  -H "Authorization: Bearer $PANTHER_HOOK_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"email":"test@example.com","test":true}'

Testing and production

• On the public ingestion route, append ?test=true for an explicit test submission.
• Test submissions are visible separately from production traffic in the dashboard.
• Remove test mode only after validating the payload and destination configuration.