Browser mode and server mode

A form accepts requests in one way or both, on the Security tab:

Mode	Switch	Who sends it
Browser mode	Accept submissions from browsers	The visitor's browser sends the form. This covers the embed snippet, the hosted page, and your own frontend posting to the desk.
Server mode	Accept signed submissions from servers	Your backend sends the request, signed with a secret. Use it when the request comes from your own app, so you can include facts the requester can't change, such as their user ID or plan. These arrive on the case under Data from the integration.

The desk tells the two apart by the request: one with signature headers or a bearer key is a server request, any other is a browser request.

Every submission goes through the checks of its mode before it becomes a case:

Submitted → Checks → Case created → Rules run → Confirmation sent
Checks → Refused: a check failed; the submission log says why
Case created → Held for review: the unit holds requests from people who aren't known contacts

Protecting browser mode

Setting	What it does	At first
Allowed websites	One origin per line, such as https://example.com. Only these sites can load and send the form; on others the snippet doesn't render. The hosted page on the desk is always allowed.
Cloudflare Turnstile	An invisible bot check. It needs the Turnstile keys under Settings → Installation (Bot protection).	On
Honeypot field	A hidden field that people don't see and bots fill in.	On
Minimum time to fill in	Submissions sent faster than this (in seconds, 0 to 120) are treated as bots. With a minimum time set, a page left open for more than a day has to be reloaded before sending.	2 seconds

[!WARNING] Without the Turnstile keys, every submission to a form with the check turned on is refused.

Protecting server mode

• Signing secrets: Create secret makes the first one. It starts with fsk_; the desk shows only its first and last characters afterwards. Rotate secret makes a new one; the previous one keeps working for 24 hours, so you can switch without downtime. Revoke stops a secret at once.
• Also accept a plain bearer key: the secret sent as Authorization: Bearer fsk_… instead of a signature. Simpler, but anyone who sees the key can post. Off by default.
• IP allowlist: tick the shared lists of your organization that this form accepts, and add Extra addresses for this form (addresses or ranges, one per line). Signed requests are accepted only from these addresses. The note below says which addresses apply; when the list is empty, requests are accepted from any address.

[!IMPORTANT] A new signing secret is shown once: copy it into your backend's configuration then.

IP allowlists protect server mode only. Browser requests come from your visitors and are never checked against them.

How to sign a request, the headers, the body and the answers are in Form submissions.

Rate limits

These apply to both modes:

Setting	What it limits	At first
Requests per address and Per window of	How many attempts one IP address may make in a window of seconds. Further attempts are refused until the window ends.	5 per 600 seconds
Hourly cap	The most cases the form creates in an hour, from all addresses together. When it's reached, the form pauses and every admin gets an email.	200

[!WARNING] A paused form refuses requests until an admin opens it and picks Resume in the warning at the top. It doesn't resume by itself.