File Uploads

Paid/manual forms can accept multipart file fields. The API enforces form-level upload enablement, maximum file count, maximum file size, MIME allowlists, and blocked executable/script-like filename extensions before notification delivery.

Multipart attachments

Inline multipart attachments are scanned before email is queued.

<form action="https://api.formsfort.dev/submit" method="POST" enctype="multipart/form-data">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input type="file" name="attachment" />
  <button type="submit">Submit</button>
</form>

Advanced uploads

Advanced uploads reserve object storage keys through the public-CORS GET /upload endpoint, upload directly to storage, and require the upload scan worker to mark objects clean before a submission can consume them. Use the returned upload headers exactly; S3-compatible reservations bind the upload to the MIME type that passed validation. Upload reservations apply the same size, MIME, and blocked-extension checks as multipart uploads.

Submit the returned storage key in attachment or the original enhanced file field name; FormsFort atomically consumes each clean object so submitted storage keys are single-use, removes storage keys from forwarded custom data, and preserves the upload field name on attachment metadata.

The client helper includes FilePond-compatible theme hooks such as filepond--panel-root, filepond--drop-label, and filepond--label-action so Web3Forms uploader theme snippets can be reused. Custom data-content labels preserve basic inline formatting such as the FilePond label-action span while stripping unsafe markup before rendering.

<form action="https://api.formsfort.dev/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input
    type="file"
    name="attachment"
    data-advanced="true"
    multiple
    accept="image/*, application/pdf"
    data-max-files="3"
    data-max-file-size="5MB"
  />
  <button type="submit">Submit</button>
</form>
<script src="https://api.formsfort.dev/client/script.js" async defer></script>

Delivery

Clean object-storage attachments are delivered as temporary download links. Queued attachment content is redacted after successful email delivery.