auth.md

FormsFort publishes a canonical, machine-readable authentication and setup guide for coding agents:

GET https://api.formsfort.com/auth.md

Read the live file for the complete contract, including supported and unsupported flows, capability routing, the exact registration request and response, credential handling, form setup, both human verification steps, errors, and handoff requirements.

Discovery

GET https://api.formsfort.com/.well-known/api-catalog
GET https://api.formsfort.com/.well-known/oauth-protected-resource
GET https://api.formsfort.com/.well-known/oauth-authorization-server

Current flow

FormsFort supports user_claimed registration. It does not support identity_assertion, anonymous temporary workspaces, or temporary claim pages.

A new account must complete account email verification before it can create a form. The form's recipient email is verified separately before live submissions can be accepted. Dry-run submissions work before recipient verification.

Credential model

POST /agent/auth returns a full user session, not a scope-limited workspace token. Treat it like a password and use it only for short setup tasks. Never log it, commit it, place it in browser code, or embed it in a form snippet.

For ongoing automation, prefer a dashboard-created workspace API token. Workspace tokens are limited to one workspace and their selected forms:read, forms:write, and submissions:test scopes.

Public websites use the form's access_key, never a session credential or workspace API token.

Agent defaults

• Do not ask a human to paste an existing account password into a prompt or log.
• Leave allowed domains unset unless exact domain lock-down is explicitly requested and production hostnames are known.
• Run a dry-run submission from the deployed origin.
• Report account verification and recipient verification as separate human handoffs.
• Preserve the FormsFort requestId when reporting errors, without including credentials or verification links.

See the Agent Quickstart, CLI and SDK, MCP Server, and OpenAPI contract for the related setup surfaces.