# Responsible API Use

These guidelines help you integrate with the forms.app API safely, respectfully, and in compliance with applicable laws. They supplement the [API Terms of Use](/legal/terms).

## Protect your credentials

- Treat API keys and OAuth tokens like passwords.
- Store them in a secret manager or environment variables, never in client-side code, public repositories, or shared documents.
- Use one key per integration or environment so you can revoke access without disrupting other systems.
- Rotate or revoke keys immediately if you suspect they have been exposed.


See [Quick start](/guides/quickstart#step-1-create-an-api-key) for how to create and manage keys.

## Respect rate limits

The API enforces rate limits per key or token. When you receive `429 Too Many Requests`:

1. Stop retrying immediately in a tight loop.
2. Wait before sending the next request.
3. Use exponential backoff for automated sync jobs.


Cache form structure when possible instead of re-fetching on every run. See [The essentials](/guides/the-essentials#rate-limiting).

## Handle submission data responsibly

Submissions returned by the API may contain personal data, such as names, email addresses, phone numbers, files, and other sensitive information.

When you sync or store this data:

- Collect and process only what your integration needs.
- Apply appropriate access controls in your systems.
- Retain data only as long as necessary for your stated purpose.
- Honour privacy rights and deletion requests from your respondents where applicable.
- Comply with laws such as GDPR, CCPA, or other regulations that apply to you.


forms.app provides the API on your behalf as the form owner. You remain responsible for how you use respondent data once it leaves the API.

## Stay within read-only access

The API is read-only. Do not attempt to modify forms, submissions, or account settings through undocumented endpoints or unsupported methods. Write operations are not available in the current release.

Build integrations that read and sync data, for example, exporting submissions to a CRM, data warehouse, or reporting tool.

## Build reliable integrations

- Check the `success` field in every response before reading `data`.
- Handle errors using `errors[].errorCode` and `errors[].errorMessage`. See [The essentials](/guides/the-essentials#response-envelope).
- Use `GET /__health` for uptime monitoring. This endpoint does not require authentication.
- Log failures without storing API keys or full submission payloads in plain text.


## Do not abuse the service

Avoid behaviour that could harm forms.app or other users, including:

- Excessive polling that could be replaced with reasonable sync intervals
- Attempting to access forms or submissions belonging to other accounts
- Circumventing authentication or rate limits
- Using the API for spam, fraud, or other unlawful activity


forms.app may throttle or revoke API access to protect the platform.

## Keep up to date

- Review the [changelog](/changelog) for API and documentation updates.
- Read [The essentials](/guides/the-essentials) and the [FAQ](/guides/faq) before shipping an integration.
- Refer to the [API reference](/apis) for endpoint and schema details.


## Need help?

- [Quick start](/guides/quickstart): Create a key and make your first request
- [FAQ](/guides/faq): Common integration questions
- [forms.app Help Center](https://forms.app/en/help-center): Account and product support
- [Privacy Policy](https://forms.app/en/privacy-policy): How forms.app handles personal data


*Last updated: May 21, 2026*