Embed tokens and API keys

Two token types

Which one to use

Embed tokens

Create an embed token

1. In your dashboard, click Embed Tokens
2. Click Create token
3. Name it (e.g., "Main website" or "Contact page")
4. Optionally set allowed domains
5. Click Create
6. Copy the full token starting with cf_embed_

Use an embed token

In the JS embed script attribute (recommended: the script handles submission automatically):

<script
  src="https://my.contactfire.com/api/embed-script"
  data-token="cf_embed_your_token_here"
  data-form-id="your_form_id"
  async
></script>

In a plain HTML form (add data-contactfire-token; embed script intercepts the submit):

<script src="https://my.contactfire.com/api/embed-script" async></script>

<form data-contactfire-token="cf_embed_your_token_here">
  <input type="text" name="name" />
  <input type="email" name="email" />
  <button type="submit">Send</button>
</form>

In a fetch request (send as JSON with X-Embed-Token header):

await fetch('https://my.contactfire.com/api/form/submit', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Embed-Token': 'cf_embed_your_token_here',
  },
  body: JSON.stringify({
    formData: {
      name: 'Alice',
      email: 'alice@example.com',
    },
  }),
});

API keys

Create an API key

1. In your dashboard, click API Keys
2. Click Create key
3. Name it (e.g., "Backend integration")
4. Click Create
5. Copy the full key: it is only shown once

Use an API key

Send the key in the x-api-key header:

// Node.js example
const res = await fetch('https://my.contactfire.com/api/form/submit', {
  method: 'POST',
  headers: {
    'x-api-key': process.env.CONTACTFIRE_API_KEY, // cf_api_...
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    formData: {
      name: 'Alice',
      email: 'alice@example.com',
      message: 'Hello from the backend',
    },
  }),
});

const result = await res.json();
// { message: 'Form submission received successfully', submissionId: 'abc123xyz', status: 'accepted', usage: {...} }

Domain restrictions (embed tokens)

Restrict an embed token to specific domains. Submissions from unlisted origins are rejected with a 403 response.

Recipient overrides

Both token types support custom notification recipients. Useful when different tokens are used for different departments or clients.

Rotating and revoking