Add a form. Skip the CAPTCHA.

Create an endpoint, paste it on your site, click activate once. Messages go to email, Slack, Discord, or wherever you already work.

Add a form to your site

Copy, paste, done. Works on any HTML page.

Best for a portfolio, a landing page, or a client site. Use our builder or bring your own HTML.

Click Create a new form, pick fields, and add the inbox that should receive messages. Each person confirms once before mail starts. You can add Slack or Discord on the same form later.

Paste this on the page:

Form HTML

Need a form ID? Get one here

<form method="POST" action="https://boosterpackforms.com/api/forms/<FORM_ID>/submit">
  <input name="name" placeholder="Name" required />
  <input name="email" type="email" placeholder="Email" required />
  <textarea name="message" placeholder="Message" required></textarea>
  <button type="submit">Send</button>
</form>

Spam protection script

Once per page. Visitors never see a puzzle.

<script src="https://boosterpackforms.com/embed.js" defer></script>

Open the live page, click Activate form, and confirm from your inbox. After that, it stays on for that domain.

Want to customize the success state?

The script disables the button, shows Sending, then Sent, and clears the fields.

<form
  method="POST"
  action="https://boosterpackforms.com/api/forms/<FORM_ID>/submit"
  data-bp-forms-success-message="Thanks!"
  data-bp-forms-success-timeout="2500"
  data-bp-forms-success-reset="true"
>
  <!-- your fields -->
</form>

Where submissions can go

Slack, Discord, Teams, Google Chat, and Telegram are native. Paste the URL. Everything else goes through Zapier, Make, n8n, or Sheets.

SlackNative

DiscordNative

Microsoft TeamsNative

n8n

Works with the site you already have

Same product on HTML, WordPress, Webflow, Next.js, and the rest.

Wix

Let an AI agent set it up

MCP for Cursor, Claude, and Codex

Sign in once, then ask the agent for a contact form. Works on Free. It does not change how visitors submit on your live site.

Open the MCP guide

For developers

API, React, and webhook signing. Skip this if you only need a site form.

React package

No embed.js. Official @boosterpack/react-form.

For React and Next.js. The package handles hidden fields and submit for you.

Install

npm i @boosterpack/react-form

'use client'

import { BoosterpackForm } from '@boosterpack/react-form'

export function ContactForm() {
  return (
    <BoosterpackForm formId='<FORM_ID>'>
      {({ status, error }) => (
        <>
          <input name='name' placeholder='Name' required />
          <input name='email' type='email' placeholder='Email' required />
          <textarea name='message' placeholder='Message' required />
          <button type='submit' disabled={status === 'sending'}>
            {status === 'sending' ? 'Sending…' : 'Send'}
          </button>
          {status === 'success' && <p>Sent.</p>}
          {status === 'error' && error && <p>{error}</p>}
        </>
      )}
    </BoosterpackForm>
  )
}

Create forms via API

For platforms, site builders, and automation

Get an API key from your dashboard and keep it on the server.

curl -X POST "https://boosterpackforms.com/api/forms/provision" \
  -H "Authorization: Bearer $BPF_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "destinationEmails": ["owner@domain.com"],
    "webhookUrls": ["https://hooks.slack.com/services/T.../B.../xxx"]
  }'

Quick reference

destinationEmails or webhookUrls (at least one)
Webhooks need Professional or Business
Store form.id and any newWebhookSecrets (shown once)
PATCH and DELETE live at /api/forms/<formId>

Your own webhook

HMAC-signed JSON to any HTTPS URL

Slack, Discord, Teams, Google Chat, and Telegram are formatted for those apps. Any other HTTPS URL gets JSON plus X-BoosterpackForms-Signature.

Respond 2xx within 5 seconds
No automatic retries. Email still sends if the webhook is down.
Up to 10 destinations on one form

import { createHmac, timingSafeEqual } from 'crypto'

function verifyWebhook(rawBody, signatureHeader, timestampHeader, secret) {
  const ts = String(timestampHeader || '').trim()
  const sig = String(signatureHeader || '').trim().replace(/^sha256=/, '')
  if (!ts || !sig) return false
  const expected = createHmac('sha256', secret).update(ts + '.' + rawBody, 'utf8').digest('hex')
  try {
    return timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(sig, 'hex'))
  } catch {
    return false
  }
}

How it stays quiet and private

Spam, storage, activation, and billing

Invisible spam checks

Background checks and AI scoring. Spam is blocked before it reaches you. Visitors never see a CAPTCHA.

Nothing stored

Messages are delivered, then discarded. Destination emails are encrypted at rest.

Domain lock

The first time a form loads on a new site, you confirm it. Nobody else can reuse your form ID.

Delivered-only billing

Blocked spam never counts. You only pay for messages that actually arrive.