Forms

A form you build in the dashboard, publish at its own link, and embed anywhere. Every submission arrives as a push notification on your phone — the same delivery path as a webhook, so routing, priority levels and message history all work the way you already know.

No email inbox in the middle. No polling a spreadsheet.

Create a form

Forms → Create. The builder has five tabs and a live preview beside them:

Tab	What it holds
Fields	Title, intro text, the fields themselves, footer text
Design	Theme, colours, font, size, corner radius, submit button
Settings	Push title, routing, priority, response limits, messages
Share	Public link, QR code, embed code
Preview	The same live preview, for narrow screens

Save, and the Share tab hands you the link: https://frms.click/<id>.

Field types

Group	Types
Text	Short text, long text, email, phone, number, URL, date
Choice	Dropdown, radio buttons, checkboxes, single checkbox (consent)
Rating	Star rating (1–5), NPS (0–10)
Layout	Heading, paragraph, divider
Tracking	Hidden field

Up to 30 fields per form, up to 50 options in a choice field. Email, phone, number and URL fields are validated in the browser and again on the server — the client check is a convenience, not the guard.

Layout fields are decoration: they never appear in the message. File uploads and payments are not supported.

Hidden fields

A hidden field carries a value from the link into the message. Give it a parameter name, and ?utm_source=newsletter in the URL arrives in the notification. One click adds all five UTM parameters at once.

When a form is embedded, the parameters of the host page are passed through, so a campaign landing page tags its own submissions without any work on your side.

What the message looks like

Answers come first, in the order the fields appear:

Name: Jane Doe
Email: [email protected]
Rating: ★★★★☆ 4/5
Message: Do you ship to Canada?

utm_source: newsletter
Form: Contact
IP: 203.0.113.10
Submitted: 2026-09-23 14:05

Hidden fields, the visitor's IP and the timestamp sit at the bottom, after the answers. The timestamp uses your account timezone. Everything is encrypted at rest with your personal key, exactly like any other message.

Push title

By default the notification is titled Form: <form name>. A template makes it useful at a glance:

New lead: {Name} ({Email})

Tokens reference fields by their label, case-insensitive, plus {form} for the form name. Empty answers drop out of the title; if nothing is left, the default title is used. The template is never exposed on the public page.

The Pocket Alert badge

A published form carries a small "Powered by Pocket Alert" link under it. On a paid plan you can switch it off in Design → Branding.

The API decides, not the browser: saving the flag on the free plan resets it, and if a paid plan lapses the badge comes back on the public page without you touching the form.

Routing and priority

A form can target an application and a specific device, and can carry a priority level from silent to critical — the same levels as the API. Leave the level on Default and the form follows your normal delivery rules.

Each submission consumes one message from your daily quota. When the quota is spent, the visitor sees a neutral "try again later" message with no mention of your plan, and you get the usual limit email.

Closing a form

Three independent switches, any of which closes it:

• Accepting responses — off closes it immediately
• Response limit — closes after N submissions; the slot is reserved before the message is created, so a burst of traffic cannot overshoot it
• Close on — a date and time in your timezone

A closed form still resolves: visitors get your closed message instead of the fields, and submissions are rejected server-side.

Embedding

The Share tab gives you a script embed:

<div data-pocketalert-form="<id>"></div>
<script src="https://frms.click/embed/form.js" async></script>

The form loads in an iframe that reports its own height, so there is no inner scrollbar and no fixed height to maintain. The page background shows through — set the form's card colour to transparent-friendly tones and it blends in.

After a submission the container fires a pocketalert:submit event you can hook analytics to:

document.querySelector('[data-pocketalert-form]')
  .addEventListener('pocketalert:submit', () => gtag('event', 'generate_lead'));

Where scripts are not allowed, a plain <iframe> snippet is provided too — fixed height, and URL parameters are not passed through.

Restricting where the form can be used

A form id is public — it travels in the link and the QR code — so by default anyone who has it can embed the form on any page. Settings → Where it can be used takes a list of domains and closes that:

• only those sites may embed the form (the page is served with a matching frame-ancestors policy);
• a submission whose Origin (or Referer) is not on the list is rejected with 403;
• the form's own link keeps working regardless.

Write hosts, not URLs: example.com, app.example.com, *.example.com for every subdomain, localhost:3000 while developing. Up to 10 entries. www. is ignored, so example.com covers www.example.com.

An empty list means "anywhere", which is the right setting for a link you share in a bio or a QR code on a poster.

What this does and does not stop

Origin is set by the browser and cannot be forged by a page. A script that talks to the API directly can send any header it likes, so the allowlist stops your form from being embedded on someone else's site — it is not a defence against a determined flooder. The rate limits below cover that case.

Where a submission came from

When a submission arrives from an embedded form, the host is recorded in the message next to the IP:

Form: Contact (abc123)
Source: shop.example.com
IP: 203.0.113.10

Submissions from the form's own page have no Source line.

Spam protection

• A honeypot field no human ever sees. Bots that fill it get a normal-looking success screen and nothing is delivered.
• Rate limits: 10 submissions a minute from one IP, 60 a minute and 300 an hour per form. The hourly cap exists so a flood cannot drain a whole day of messages in a few minutes.
• Public form pages are noindex, so a form does not show up in search results by itself.

CAPTCHA is not required and not offered on forms yet.

Plan limits

Plan	Forms
Free	1
Starter	10
Medium	30
Large	Unlimited

Submissions themselves are limited only by your daily message quota.

API

Everything the builder does is available over the REST API:

Endpoint	What it does
GET /v1/forms	List your forms
POST /v1/forms	Create one
PUT /v1/forms/:tid	Replace its fields, design and settings
DELETE /v1/forms/:tid	Delete it
GET /v1/forms/:tid	Public: the fields and design of a live form
POST /v1/forms/:tid/submit	Public: accept a submission

The first four use your normal token; the last two are what the form page itself calls.