Integration guide
Validate credentials and payload rules from a terminal without confusing temporary Test mode with a production browser integration.
Step by step
Use it only while testing from cURL or Postman. It bypasses allowed-origin enforcement; disable it before production traffic.
Pass Content-Type: application/json and X-API-Key. Quote the JSON carefully so your shell does not alter it.
Use --include to see the HTTP status. A 2xx response confirms acceptance; 4xx responses describe authentication, credit, protection, or validation failures.
Try one invalid request to confirm required fields and formats are enforced, but do not repeatedly consume rate-limit capacity.
Disable Test mode, configure allowed origins, and complete one final browser submission from the real website.
Honeypot in this integration
A honeypot is a browser bot trap, so it is not required for a controlled cURL test. Omit it or send the configured key as an empty string. Never send a non-empty test value unless you are intentionally verifying the spam rejection path.
Read the honeypot fundamentals →Working example
curl --include --request POST "https://YOUR_FORMDEX_DOMAIN/api/forms/FORM_ID" --header "Content-Type: application/json" --header "X-API-Key: YOUR_API_KEY" --data '{
"email": "[email protected]",
"message": "Hello from a controlled test"
}'Troubleshooting
401
The API key is missing, outdated, or belongs to another form.
400 validation error
Add required schema fields or correct their format.
400 captcha failure
Server-only cURL cannot complete an interactive widget; use an appropriate test flow.
429
Wait for the rate-limit window instead of retrying in a tight loop.