Reference
Options reference
Every reserved field name the submit endpoint understands, and what each one does.
Reserved fields configure the submission. Everything else you post is treated as form data and shown in the notification email exactly as you named it. Reserved names never appear in the email body.
| Field | Required | What it does |
|---|---|---|
| subject | No | Overrides the email subject line for this submission. Falls back to the form's saved subject. |
| from_name | No | Name shown as the sender of the notification email. Defaults to the name field in the submission. |
| replyto | No | Address used for Reply-To. Also accepted as reply_to. Defaults to the first valid email field found in the submission. |
| redirect | No | Absolute URL to send the browser to after a successful non-JavaScript submission. |
| cc | No | Extra recipients, comma separated. Up to eight, counting the form's own CC list. Also accepted as ccemail or cc_email. |
| botcheck | No | Honeypot field. Hide it with CSS; if it arrives filled in, the submission is silently discarded. The field name is configurable per form. |
| cf-turnstile-response | Conditional | Turnstile token. Required when the form has Turnstile enabled. |
| h-captcha-response | Conditional | hCaptcha token. Required when the form has hCaptcha enabled. |
| g-recaptcha-response | Conditional | reCAPTCHA token. Required when the form has reCAPTCHA enabled. |
Per-form settings
Anything you would rather not repeat in markup — notification address, CC list, autoresponder text, allowed domains, webhook URLs — is configured once per form in the dashboard and applies to every submission that form receives.
Webhook and integration URLs can only be set in the dashboard, never in the posted form. Otherwise anyone who read your endpoint out of the page source could redirect your submissions.