Embedding and Sharing Forms

Overview

Once you publish a form, you can share it with users via a public link, embed it on your website, or protect it with a password. FlowFn forms work on any device and can trigger workflows on submission.

Public link

Every published form has a unique public URL based on its slug: /f/<your-slug>. Share this link directly with anyone who needs to fill out the form. No login is required to access a public form.

Embedding a form

Enable Embedding in the form's Embed tab. FlowFn issues a per-form token and renders an embed URL of the form https://<your-host>/f/<slug>?embed=<token>. The token bypasses password protection.

Basic iframe:

<iframe
  src="https://<your-host>/f/<slug>?embed=<token>"
  title="Form"
  width="100%"
  height="600"
  frameborder="0"
  allow="clipboard-write"></iframe>

Fluid container, no border:

<div style="max-width: 720px; margin: 0 auto;">
  <iframe
    src="https://<your-host>/f/<slug>?embed=<token>"
    title="Form"
    style="width: 100%; min-height: 600px; border: 0; display: block;"
    allow="clipboard-write"></iframe>
</div>

Prefill fields from URL params

On any field in the form editor, set a Prefill param (e.g. utm_source). Visitors can then arrive with that value pre-populated by appending the param to the URL.

<iframe
  src="https://<your-host>/f/<slug>?embed=<token>&utm_source=newsletter"
  title="Form"
  width="100%"
  height="600"></iframe>

Stack multiple prefill params by appending them with &. To forward UTM-style params from the host page automatically:

const url = new URL('https://<your-host>/f/<slug>?embed=<token>');
new URLSearchParams(window.location.search).forEach((v, k) => {
  url.searchParams.set(k, v);
});
document.querySelector('iframe').src = url.toString();

Prefill values do not overwrite anything the visitor has already typed (or any saved draft).

Allowed domains

Add the parent hostnames you want to allow in the Allowed domains field (e.g. example.com — covers www. too). Embedding from any other domain is blocked. Leave empty to allow any site.

Token rotation

Click Regenerate in the embed panel to rotate the token. Previous embed URLs stop working immediately — re-paste the new URL on every site that embeds the form.

Password protection

If you need to restrict access, set a password on the form from the form settings in the dashboard. Visitors must enter the correct password before they can view or submit the form. You can remove the password at any time to make the form fully public again.

Search visibility (SEO)

A public form is hidden from search engines by default. On a plan that includes SEO, open the form's Search visibility section and turn on Enable SEO, then optionally set an SEO title, description, and keywords (blank fields fall back to the form's own title and description). Indexing only takes effect when the form is served on your app's own subdomain or custom domain — under flowfn.com/f/<slug> the page is always kept out of search so it can't affect flowfn.com. The form must be public, published, and not password-protected to be indexable; when it isn't, the toggle explains why.

Spam protection

Public form submissions are protected automatically. The FlowFn-hosted form page (/f/<slug> on flowfn.com or your <name>.flowfn.com subdomain) gets invisible reCAPTCHA — no checkbox or puzzle for your visitors — on top of per-visitor rate limiting, so automated and abusive submissions are rejected before they reach your workflow. Embedded forms load that same FlowFn-hosted page inside an iframe, so they get reCAPTCHA too, on a best-effort basis — some browsers block third-party scripts inside iframes, and in that case the embed token, allowed-domains list, and rate limiting still apply. Forms served on your own custom domain skip reCAPTCHA (it can't verify a non-FlowFn domain) and rely on rate limiting plus your other protections. Nothing to configure either way.

Slug availability

Form slugs must be unique across the platform. When creating or editing a form, the system checks if your chosen slug is available. Use lowercase letters, numbers, and hyphens for slugs.

Submissions

Form submissions are stored and visible in the form's Submissions tab in the dashboard. Each submission includes the submitted data, timestamp, and any file uploads. If the form is linked to a workflow via a Form trigger, the workflow runs automatically with the submission data as trigger inputs.

File uploads in forms

Forms can include file fields for attachments. Uploaded files are stored securely via pre-signed URLs. Fields with multiple enabled accept several file uploads per field, stored as an ordered array of file pointers. Files are accessible from the submission details and in workflow task inputs.