Apps
Form Capture
A form backend for your server. Post JSON; Buckhy validates and stores it, handles team notifications, and provides a searchable inbox.
What it does
Your website keeps its own form and your server forwards each submission to Buckhy. Buckhy stores the record, attempts the configured notification, and shows it in the website's Inbox. Storage, notification acceptance and confirmed delivery are different outcomes.
It runs server to server with a secret key. Nothing is added to your pages and nothing runs in the visitor's browser.
Features
| Feature | Detail |
|---|---|
| Any form, any fields | Up to 20 fields per submission with the names you already use. |
| Email alerts | Notifications use the configured recipient; a stored submission does not prove inbox delivery. |
| Visitor details | The API accepts bounded visitor context alongside the submitted fields. |
| Safe retries | An Idempotency-Key makes a retried request return the original record — never a duplicate. |
| Console inbox | Website- and environment-scoped leads with search, form/status filters and assignment. |
| Export | Export the current inbox selection as JSON. |
| Per-site keys | Credentials remain scoped to the website, environment and app family. |
| Privacy by design | The raw visitor IP is deleted after 30 days; the derived country is kept. |
How it works
Visitor submits your form
│
▼
Your server / route handler / function (holds the secret key)
│ POST https://api.buckhy.com/v1/capture
▼
Buckhy validates, sanitises and stores the record
├── emails the site's notify address
└── shows the record in the console inbox
- The browser posts to your endpoint, exactly as it does today.
- Your endpoint forwards
{ form, page, fields, context? }with the site key. - Buckhy answers
201 { id }once the record is stored. Alerts and the console read from that stored record, so nothing is lost if an email fails.
Calls must come from a server. Browser requests from your domain are refused by CORS, by design — see Where the call belongs.
Get started
- Open Businesses > your website > Apps > Form Capture. Register and verify the website first if needed.
- Complete Configure, then create the credential in Integrate for the selected environment. It is shown once.
- Store it on your server as
BUCKHY_CAPTURE_KEYand post:
await fetch("https://api.buckhy.com/v1/capture", {
method: "POST",
headers: { "Content-Type": "application/json", "X-Api-Key": process.env.BUCKHY_CAPTURE_KEY! },
body: JSON.stringify({ form: "contact", page: "/contact", fields }),
});
- Submit once and check the website's Inbox > Leads. Check notifications separately.
- Run the app's Test checks and review Activate before relying on the integration.
Framework examples, visitor context, retries and a copy-paste AI-agent prompt: Install Form Capture.
Configure
| Setting | Where | Effect |
|---|---|---|
| Site name | Businesses > website > Settings | Identifies the website. |
| Notification email | Apps > Form Capture > Configure | Recipient for submission notifications. |
| Form ID | Apps > Form Capture > Configure | The form policy your server's form value must match. |
| Credential | Apps > Form Capture > Integrate; API > Credentials | Issued once and scoped to the website and environment. |
See Keys for staged replacement and emergency revocation. Never retire the credential still used by your deployment.
Guides
Manage sites and keys
Open Businesses > your website > Apps to configure, test, activate, disable or resume Form Capture. Use API > Credentials for credential lifecycle actions. Check the environment before making changes.
Find submissions
Open Businesses > your website > Inbox > Leads:
| Control | Behaviour |
|---|---|
| Search | Narrows the current inbox scope. |
| Website and environment | Chosen before opening the inbox. |
| Form | The form names that exist for the current scope. |
| Status | Active, closed/archived or unread. |
| Assignment | Everyone, assigned to me or unassigned. |
| Pagination | Move through the matching records. |
Read a record
Open a lead to inspect its contact and submitted fields, change its review status, or assign it to a permitted teammate. Leads do not use the Support Desk reply workflow.
Export records
Use Export in the inbox to download JSON for the selected scope. Keep exported visitor data private and apply your organization's retention policy.
Send visitor context
Add a context object to the request — IP, user agent, referrer, landing page, language, time zone, screen, UTM — and alert emails gain one line such as Safari on iPhone · India · via instagram. Details and validation rules: Visitor context.
Reference
| Topic | Page |
|---|---|
| Request body, field rules, responses, idempotency, rate limits, retention | Form Capture API |
| Why this key is secret; rotation | Keys |
| Status codes and what to retry | Errors |
| Every limit in one table | Limits |
