Docs

1) Create a form endpoint

After creating a form in your dashboard, you get a unique endpoint like:

https://getformali.com/f.php?form_key=<form_key>

2) Plain HTML (copy/paste)

<form action="https://getformali.com/f.php?form_key=a1b2c3d4e5f6a7b8" method="POST">

  <input name="email" type="email" required />
  <textarea name="message" required></textarea>

  <button type="submit">Send</button>

</form>

Replace <form_key> with your real key from the dashboard.

3) Email notifications

Every valid submission is sent as an email notification to the configured client mailbox. If no client email is set, Get Formali uses the account email.

Flow: HTML form → Get Formali → client inbox.

4) Optional storage

In each form configuration, choose whether Get Formali keeps a dashboard copy of submissions.

• Conserver les soumissions: submissions are stored and visible in the dashboard.
• Ne pas conserver les soumissions: submissions are emailed to the client without storing a dashboard copy.

5) Redirect after submit

Add an optional _redirect field:

<input type="hidden" name="_redirect" value="https://your-site.com/thanks" />

Get Formali will redirect with a 303 when the URL is safe.

6) JavaScript / fetch

If you prefer AJAX, POST as application/x-www-form-urlencoded or multipart/form-data:

const form = new FormData();
form.append('email', 'name@domain.com');
form.append('message', 'Hello');

const res = await fetch('https://getformali.com/f.php?form_key=a1b2c3d4e5f6a7b8', {
  method: 'POST',
  body: form,
  headers: { 'Accept': 'application/json' },
});

console.log(await res.json());

Limits & behavior

• Max payload: 100 KB
• Max fields: 50
• Nested fields: not supported
• Email notification: sent to the configured client mailbox after each valid submission
• Storage: dashboard retention can be enabled or disabled per form
• Monthly limit: enforced per account plan (new submissions get rejected when exceeded)

Security

Recommended for production forms:

• Allowed domains: lock a form to your website to prevent third parties from using your endpoint.
• Turnstile captcha (optional): enable it in your form settings to reduce spam.

Webhooks

Get Formali can POST each submission to your server (signed HMAC).

Delivery is best-effort (no retries). Use your endpoint to return 2xx quickly.

Request format

JSON body:

{
  "form_id": 123,
  "timestamp": 1717171717,
  "data": {
    "email": "name@domain.com",
    "message": "Hello"
  }
}

X-Formali-Signature verification

Headers: X-Formali-Timestamp and X-Formali-Signature where signature is sha256=HMAC(secret, timestamp + '.' + body).

// Node.js example
import crypto from 'crypto';

const timestamp = req.headers['x-formali-timestamp'];
const signature = req.headers['x-formali-signature'];
const body = rawBody; // raw request body string

const expected = 'sha256=' + crypto
  .createHmac('sha256', WEBHOOK_SECRET)
  .update(String(timestamp) + '.' + body)
  .digest('hex');

if (signature !== expected) throw new Error('Invalid signature');