HTML forms

Use a standard form with method POST. The browser follows a redirect after submit. No CORS setup is required.

Minimal example

Replace the email in the action URL with the inbox that should receive submissions. Any field names are forwarded except names that start with _.

index.html

<form action="https://api.postme.dev/submit/you@example.com" method="POST">
  <input type="text" name="name" required />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

After submit

On success, PostMe redirects to _next if you set one, otherwise to the hosted /thank-you page. On failure, it uses _postme_error_next or /thank-you?status=error.

index.html

<form action="https://api.postme.dev/submit/you@example.com" method="POST">
  <input type="text" name="name" required />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>

  <input type="hidden" name="_subject" value="New inquiry" />
  <input type="hidden" name="_next" value="https://www.postme.dev/thank-you" />
  <input type="hidden" name="_postme_error_next" value="https://www.postme.dev/thank-you?status=error" />
  <input type="hidden" name="_postme_message" value="Thanks — we'll reply soon." />

  <button type="submit">Send</button>
</form>

Put the visitor's email in a field named email, or set _replyto so you can reply from your inbox. Auto-reply destinations also use that address.

First submission

The first time a new inbox is used, PostMe sends a confirmation email instead of forwarding the form. The visitor sees a pending message. After the inbox is confirmed, later submissions deliver normally.

Spam

Add a honeypot named _postme_hp. Leave it empty. Filled values are discarded silently and do not count toward your monthly limit. Keep it off-screen rather than display:none — many bots skip those.

<input type="text" name="_postme_hp" tabindex="-1" autocomplete="off" aria-hidden="true" style="position:absolute;left:-10000px;height:1px;width:1px;overflow:hidden" />

Public /submit also accepts Cloudflare Turnstile. Add the widget and post the token as cf-turnstile-response (or _turnstile). When Turnstile is enabled on PostMe, missing or invalid tokens fail with captcha_failed.

Honeypot + first-use confirmation is a start. Use an Intake with an origin allowlist on a live site, and Turnstile on public try URLs.