The whole loop, in code.
Point any HTML form at an endpoint. Receive each submission as a signed webhook. Reply from your own address through the API. The REST API and the MCP server are on every plan, including free.
Steps 1 and 2 work on every plan, including Free. Webhooks start on Pro. Step 4 uses Response Desk, which is on Scale.
What you build against
One surface, five ways in. Anything you can do in the dashboard, you can do from code.
- REST API
- Create forms, read submissions, manage everything. An OpenAPI spec ships with it, so client generation comes for free. The spec lives at
/api/v1/openapi.json. - Webhooks
- Signed, retried, replayable. The delivery log sits next to the submission it belongs to.
- MCP server
- Connect Claude, Cursor or any MCP client and run Formspring from your assistant, scoped to one workspace. 579 tools. About the MCP server
- Tokens and abilities
- Grant forms:read without forms:write. Rotate from the dashboard and see which token did what.
- Embed and quick tools
- One script tag drops a hosted form anywhere. Quick forms and short links work without an account.
Before anything reaches your webhook, five checks run in order.
Cheapest first. Suspect submissions are filed in a spam folder for review, never silently deleted.
- 1
Honeypot
A hidden field on every form. Bots fill it, people never see it.
- 2
Captcha, your keys
hCaptcha or reCAPTCHA per form, only when it is worth the friction.
- 3
Custom rules
Block by keyword, domain, country or regex.
- 4
Reputation
An optional Akismet pass catches known bad actors.
- 5
AI moderation
Reads the message and flags solicitation, scams and prompt injection. Pro and up.
What each plan opens up
The API and the MCP server are on every plan. Webhooks start on Pro.
Full pricing| Plan | Per month | Submissions | Adds |
|---|---|---|---|
| Free | $0 | 50/mo, 30-day retention | REST API, MCP server, spam filtering |
| Pro | $19 | 5,000/mo | Signed webhooks, AI features, custom branding |
| Team | $49 | 25,000/mo | Roles, shared workspaces, agency mode |
| Scale | $149 | Unlimited | Response Desk and unlimited seats |
Frequently asked
Is it really free?
Yes. The Free plan accepts 50 submissions per month with 30-day retention, no credit card required. Upgrade only when a project crosses 50 a month.
How does pricing scale?
Plans are billed per workspace, not per form. Pro is $19/mo for 5,000 submissions. Team is $49/mo for 25,000. Scale is $149/mo with unlimited submissions. Over-quota submissions return HTTP 402 so the client knows the response was not accepted.
Do I need to handle CORS?
No. The ingestion endpoint allows cross-origin POSTs from any domain, returns JSON on Accept: application/json, and supports both standard form-encoded bodies and JSON payloads. No preflight tuning required.
Is my data in the EU?
Yes. Submissions and uploaded files are stored in Germany by default - EU object storage for files and EU-region transactional mail. The Data Processing Addendum at /dpa lists every sub-processor.
Will it work with my React, Next, Vue, or Astro setup?
Anything that can POST works. Drop the endpoint URL into the form action, or fetch() to it from a client component. Snippets ship for HTML, React, Vue, Next.js, Astro, SvelteKit, Nuxt, vanilla JS, Python, PHP, and Ruby.
How does spam protection work?
Layered, not stacked. A hidden honeypot field catches naive bots before any compute runs. Optional hCaptcha or reCAPTCHA add a real-user challenge. Custom rules let you block by keyword or pattern. Akismet reputation scoring filters known bad actors. AI moderation reads the message itself and flags solicitation, profanity, and prompt injection.
Are webhooks signed?
Yes. Every webhook delivery carries an x-formspring-signature header with an HMAC-SHA256 of the raw body using your per-form secret. A failed delivery is retried on an exponential schedule, 8 attempts across about 4.9 hours, with full delivery history and one-click replay from the dashboard.