---
title: "Create a signup form"
method: POST
path: "/v1/forms"
tags: ["Forms"]
---

# Create a signup form

`POST /v1/forms`

## Request

- Base URL: `https://smtpfa.st/api`
- URL: `https://smtpfa.st/api/v1/forms`
- Auth: HTTP bearer

Create a new signup form, including its confirmation sender and welcome email if you send them. After creation, the embed snippet at /api/forms/{id}/submit (HTML) or /api/forms/{id}/embed.js (JavaScript widget) can be used on third-party sites. Request keys are snake_case; the older camelCase keys are still accepted. Requires the form:write scope.

## Request body

- CreateSignupFormRequest: Keys are snake_case, as in the form object. The older camelCase spelling of each key (buttonText, doubleOptIn, welcomeEmailEnabled and so on) is still accepted; sending both spellings of one field is a 400.
  - `name` string, required
  - `fields` string[]: email is always included.
  - `button_text` string
  - `button_color` string
  - `success_message` string
  - `double_opt_in` boolean
  - `redirect_url` string, nullable: Must start with http:// or https://.
  - `captcha_enabled` boolean: Needs turnstile_site_key and turnstile_secret_key.
  - `captcha_provider` 'turnstile'
  - `turnstile_site_key` string, nullable
  - `turnstile_secret_key` string, nullable: Write-only. Returned forms expose turnstile_secret_configured instead.
  - `block_disposable_emails` boolean
  - `active` boolean
  - `confirmation_email_from` string, nullable: Sender of the double opt-in confirmation email. The platform address is used when this is unset or its domain is not verified.
  - `welcome_email_enabled` boolean: Send a welcome email to each new contact from this form.
  - `welcome_email_from` string, nullable: Sender of the welcome email. Its domain must be verified, or the welcome email is skipped.
  - `welcome_email_subject` string, nullable
  - `welcome_email_markdown` string, nullable: Welcome email body as Markdown.

## Response `201`

Form created

- SignupForm
  - `object` string, required
  - `id` string, required
  - `name` string, required
  - `fields` string[], required
  - `button_text` string, required
  - `button_color` string, required
  - `success_message` string, required
  - `double_opt_in` boolean, required
  - `redirect_url` string, nullable
  - `captcha_enabled` boolean, required
  - `captcha_provider` 'turnstile', required
  - `turnstile_site_key` string, nullable
  - `turnstile_secret_configured` boolean, required
  - `block_disposable_emails` boolean, required
  - `active` boolean, required
  - `confirmation_email_from` string, nullable: Sender of the double opt-in confirmation email. Create, retrieve and update return it; list items leave it out.
  - `welcome_email_enabled` boolean: Create, retrieve and update return it; list items leave it out.
  - `welcome_email_from` string, nullable: Create, retrieve and update return it; list items leave it out.
  - `welcome_email_subject` string, nullable: Create, retrieve and update return it; list items leave it out.
  - `welcome_email_markdown` string, nullable: Create, retrieve and update return it; list items leave it out.
  - `welcome_stats` object: Welcome emails sent and skipped for this form, and how many were delivered, opened and clicked. List items leave it out.
    - `sent` integer
    - `skipped` integer
    - `delivered` integer
    - `opened` integer
    - `clicked` integer
  - `pending_confirmations_count` integer: Signups waiting on their confirmation click. List items leave it out.
  - `recent_pending_confirmations` object[]: Up to 5 of the newest pending signups. List items leave it out.
    - `id` string
    - `email` string
    - `first_name` string, nullable
    - `last_name` string, nullable
    - `created_at` string, date-time
    - `expires_at` string, date-time
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Bad request - check your payload
- `401`: Invalid or missing API key
- `403`: Forbidden - domain not verified or insufficient permissions
- `429`: Rate limit exceeded - retry after the period indicated in the Retry-After header
- `500`: Internal server error

---

[API](https://skmtc.dev/smtpfa/apis/smtpfast-api.md) · [All operations](https://skmtc.dev/smtpfa/apis/smtpfast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/smtpfa/apis/smtpfast-api/revisions/79dda742f53e?raw)