Server API keys
Use a project/environment API key for submissions sent from a backend, worker, CMS server, or another environment where the browser Origin header is absent.
Keys are submission-write-only. They cannot read leads, export data, alter forms, manage webhooks, access billing, or call the management API.
- A key belongs to exactly one project and one environment.
- The secret appears only once. FormRoost stores a digest, not the original secret.
- Up to five active keys are allowed per project/environment.
- Prefer overlapping rotation: create a replacement, deploy it, verify traffic, then revoke the old key.
- Free permits two active keys per project and environment. Starter, Growth, and Agency permit ten. Revoked and expired keys do not consume the active limit; Enterprise is negotiated.
- Expiration is optional and must be in the future. Configured expirations receive warnings at 30, 14, 7, 3, and 1 day before expiry.
The public browser submission ID is an address, not a secret. It normally remains stable. The form settings expose a recent-authentication-protected emergency regeneration action; it invalidates the old address immediately and therefore requires updating every deployed browser form.
- Never place a server key in browser JavaScript, HTML, a mobile application, a public repository, or a URL.
Browser submissions use an exact origin allowlist instead of API keys.