A FormSubmit-style backend, running on localhost.

This is the Phase 3 Worker UI: a live demo form plus the real pages people see after submit, verify, and errors. The API still returns JSON when you send Accept: application/json.

Email delivery hCaptcha + rate limits R2 uploads Webhooks Autoreply

Try a submission

This demo posts to a preview endpoint so you can see the thank-you page without Supabase credentials. Wire a real form to /f/:formId or /email/you@domain.com once .dev.vars is set.

Other screens

These are the same HTML templates the Worker returns to real users.

Thank-you pageShown after a successful HTML form post Email verifiedAfter clicking GET /verify/:token Check your inboxZero-config form waiting for verification Validation errors400 page when required fields fail

Drop-in HTML

Every FormSubmit special field works here. The UUID endpoint (/f/:id) keeps your real address out of page source.

<form action="http://127.0.0.1:8787/f/YOUR_FORM_UUID"
      method="POST"
      enctype="multipart/form-data">
  <input name="name" required />
  <input name="email" type="email" required />
  <textarea name="message"></textarea>
  <input name="attachment" type="file" />

  <!-- spam trap: bots fill it, humans never see it -->
  <input type="text" name="_honey" style="display:none" />

  <!-- email shaping -->
  <input type="hidden" name="_subject" value="New lead" />
  <input type="hidden" name="_cc" value="team@example.com" />
  <input type="hidden" name="_replyto" value="ada@example.com" />
  <input type="hidden" name="_template" value="table" />

  <!-- per-submission overrides -->
  <input type="hidden" name="_next" value="https://example.com/thanks" />
  <input type="hidden" name="_blacklist" value="viagra, casino, free money" />
  <input type="hidden" name="_captcha" value="false" />
  <input type="hidden" name="_webhook" value="https://example.com/hook" />
  <input type="hidden" name="_autoresponse" value="Thanks {{name}}!" />

  <button>Send</button>
</form>

Special fields

Full reference, all live in this Worker.

`_subject`	Email subject line
`_cc`	Comma-separated CC recipients
`_replyto`	Reply-To header
`_template`	`table` or `plain`
`_next`	Redirect for this submission only
`_blacklist`	Phrases that silently mark it spam (20 max)
`_captcha`	`false` skips hCaptcha once
`_webhook`	Extra one-off webhook URL
`_autoresponse`	Custom autoreply body
`_honey` / `_honeypot`	Bot trap; filled = dropped
`_format=json`	AJAX mode; returns JSON