Instant endpoints
A working form endpoint from just your email address.
Put your address in the form's action and it works from the first submission. No signup, no API key, and no dashboard until you want one.
<form action="https://shipmyform.com/to/[email protected]" method="POST">
<input type="email" name="email" required />
<textarea name="message" required></textarea>
<input type="text" name="_gotcha" tabindex="-1" autocomplete="off"
aria-hidden="true" style="position:absolute;left:-9999px" />
<button type="submit">Send</button>
</form>Replace [email protected] with the address that should receive submissions. That is the entire setup.
Three steps. The last one is a click.
- 1
Point the form at your address
Set the action to https://shipmyform.com/to/[email protected] with method POST, give every input a name attribute, and add the hidden _gotcha honeypot field.
- 2
Submit it once from your page
The first clean submission creates the form, stores the message, and emails you an activation link. The email never includes what the visitor typed.
- 3
Click activate
One click creates a free account for the address, signs you in, shows the held submissions, and turns on email notifications. From then on it is an ordinary ShipMyForm form.
Every step, explained: the full walkthrough
What you get before and after activating
Notifications that reach your inbox
Sent from an authenticated domain with the visitor's address as Reply-To, so replying reaches them and the mail stays out of spam.
Spam filtered from the first submission
Honeypot, rate limits, cross-form velocity checks and content classification. No CAPTCHA in your visitor's way.
Nothing is lost while you decide
The first 10 submissions are stored, encrypted, and held for 14 days before you have activated. After activation, every submission is kept.
The full product after one click
Routing to Slack, Google Sheets, Notion and webhooks, validation rules, auto-reply, exports, and a hosted page, all available once you activate.
Bound to your site
The form only accepts submissions from the site that created it, so a leaked address cannot be used to send you junk from anywhere else.
Built for AI agents
An agent building a site cannot sign up for anything. With this, it asks one question, which email address, and writes a form that works.
Hidden fields you can add
The same reserved fields as every ShipMyForm form. Turnstile and file uploads are available after activation.
- _subject
- Subject line of the notification email.
- _redirect
- Your own thank-you page. Must be on the same site as the form.
- _gotcha
- The honeypot. Hidden from people; a bot that fills it in is rejected.
Limits before you activate
Enough to try it properly, and tight enough that nobody can abuse it.
- Held submissions
- 10 per form; later ones still get a success page
- Held for
- 14 days, then deleted with the placeholder account
- Activation emails
- 1 a day, 3 in total, per address
- Accepted from
- The site that created the form only
- Disposable inboxes
- Refused
The one trade-off, and how to remove it
Your email address is in your HTML, where a scraper can read it. That is the cost of skipping signup. Once you have activated, open the form in the dashboard, copy its /f/<id> endpoint, and swap it into the action. The address URL keeps working while you do, so nothing breaks.
Questions, answered
Yes. The form works from the first submission with no account. Activating creates a free account for your address, 100 submissions a month, no card. You can upgrade later if you need more.
The first 10 submissions are held for 14 days, then the placeholder account and everything in it is deleted automatically. You get at most one activation email a day and three in total, so an inbox is never flooded.
It is in your HTML, where scrapers can find it. That is the trade-off for skipping signup. After activating, copy the form's /f/<id> endpoint from the dashboard and use that instead; the address URL keeps working meanwhile.
The endpoint binds the form to the site it came from using the browser's Origin header, and refuses requests without one. Submit from the page in a browser.
Nothing to activate. A form pointed at your account's address is created in your workspace, named after the site, already active with notifications on.
That is what it is for. Our llms.txt tells agents to ask which email should receive submissions and to use /to/that-address, never to invent one. With an API key, the MCP server is better still: it creates a form with a real ID and keeps the address out of the page.
Prefer to start with an account?
You get a form ID that keeps your address out of the page, plus the dashboard from the start. Free, 100 submissions a month, no card.