Connect with Node.js and Express
Proxy server-validated form fields through a trusted backend.
Before you begin
In Panther Hook, open Forms → your form → Setup & delivery → Form setup. Copy its public form key or internal form ID, depending on your integration mode.
Create an Express POST handler with JSON parsing enabled. Save PANTHER_HOOK_TOKEN on the server, not in source control.
Start with the setup checklistStep-by-step integration
Step 1: Configure the form
Create a workspace-scoped API token with submissions:create permission. Save it in a server-only secret store and copy the real form ID.
Step 2: Add the integration
Replace the example with your validated req.body and handle non-2xx upstream responses. Add application-level rate limits to your public proxy.
Step 3: Send a safe test
Use test: true on the protected submission request, or use Send test submission from the dashboard before allowing production data.
Step 4: Verify and go live
Open the form’s Submissions tab and select Test data. Confirm received fields, then configure any delivery destinations and verify attempts in Deliveries.
Use the production endpoint only after testing. A successfully stored lead and a successful outbound delivery are two separate states.
Example code
The example below comes from the same Node.js generator used by Form Setup. Replace placeholder IDs and configure required fields for your form.
// Express route — runs on your server.
app.post('/contact', async (req, res) => {
const body = req.body;
const response = await fetch('https://pantherhook.com/api/v1/forms/YOUR_FORM_ID/submissions', {
method: 'POST',
headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${process.env.PANTHER_HOOK_TOKEN}` },
body: JSON.stringify(body),
});
res.status(response.status).json(await response.json());
});Troubleshooting and security
- A 400 or 422 response can indicate missing or invalid fields. Compare payload keys and form validation rules.
- A 403 response may indicate a missing scope, blocked origin, or authorization rule. Do not bypass restrictions by exposing a private token.
- A 429 response means you reached a request rate limit. Use a bounded backoff rather than retrying continuously.
- A request can be accepted even if an outbound integration is failing; inspect the destination separately in Deliveries.