Getting in
The gap between your website and your CRM is usually a third product.
An automation service, a monthly fee, a connector that breaks on a Sunday, and a lead sitting in a queue nobody monitors.
It is a form posting to an address. It should not need a vendor.
Consent
The snippet is generated from what you actually ask people to agree to.
The code you hand your web developer is not a static sample. It is built from your live consent configuration — a checkbox for every purpose you have defined that requires an explicit opt-in, wired to send the agreement along with the submission.
Add a purpose next quarter and the snippet changes with it. Which is the only way the form on your website and your record of what people agreed to stay in step.
- <input name="full_name">
- <input name="email">
- <input name="company_name">
- <input name="message">
- Product updates by email
- Event invitations
- A renamed purpose does not start rejecting real leads —
An unknown or retired consent purpose arriving from a form is skipped and logged rather than failing the submission. A stale form on a page somebody forgot about keeps capturing.
- Spam gets a success response —
A hidden field that only an automated submitter would fill causes the submission to be accepted and discarded. It looks identical to a real one, so probing learns nothing about what gets through.
- A wrong key and a wrong workspace fail the same way —
Deliberately vague about which half was wrong.
- Owner assignment falls through three levels —
Your routing rules, then the default owner you nominated, then the longest-standing administrator — chosen deterministically, so attribution does not change between two identical submissions.
Being straight about the shape
This is one endpoint for your whole site, not a form builder.
There is one key per workspace and no concept of named forms. Every page that posts reports the same source, so telling a pricing-page enquiry from a contact-page one is done through the campaign parameters rather than through the form's identity.
Rotating the key is instant and global — every embedded form stops at once and needs the new one. There is no second active key and no grace period, so rotate when you can update every page, not on a Friday.
There is no auto-responder, no redirect after submission, no captcha, and no mapping to custom fields. And the endpoint rejects fields it does not know rather than ignoring them, so a developer who adds one will get an error rather than silence — which is the better failure, but it is a failure.
- A suspended workspace's forms fail closed —
Rather than continuing to accept submissions into an account that is not being watched.
- The key is compared in a way that does not leak timing —
A small thing, and it is the difference between a secret and a secret that can be guessed a character at a time.
›Is the endpoint rate limited?
Yes, and you should still put your usual protection in front of it — a public endpoint on your own domain deserves the same edge protection as the rest of your site.
›Where does the visitor's message go?
It is stored with the submission. It is not currently rendered on the lead screen, which is a gap we would rather name than have you discover — the practical workaround today is an export.
›Can I see which campaign produced a lead?
The campaign parameters are captured on every submission and travel with the record. They are available to routing rules and to exports.
›Is there a size limit on a submission?
Yes, checked before anything is parsed — so an oversized body is refused rather than processed.