How to Get a Working Form Endpoint With Just Your Email (No Signup)

You can have a working form endpoint with nothing but an email address. Put https://shipmyform.com/to/[email protected] in the form's action, and the first submission creates the form, holds the message, and emails you a link that turns it into a normal account with one click. No signup first, no dashboard, no API key in the page. This guide walks through every step, what happens behind each one, and the trade-offs you should know before relying on it.

Full disclosure: ShipMyForm is our product. FormSubmit popularised this pattern years ago; the last section says honestly where the two differ.

Step 1: write the form

<form action="https://shipmyform.com/to/[email protected]" method="POST">
  <label>
    Your email
    <input type="email" name="email" autocomplete="email" required />
  </label>
  <label>
    Message
    <textarea name="message" rows="5" required></textarea>
  </label>

  <!-- Anti-spam honeypot: hidden from people, filled in by bots. Leave empty. -->
  <input type="text" name="_gotcha" tabindex="-1" autocomplete="off"
         aria-hidden="true" style="position:absolute;left:-9999px" />

  <button type="submit">Send</button>
</form>

Three things matter here:

• The address in the URL is where submissions go. Lowercase it, and use a real mailbox. Disposable-inbox domains are refused outright, because a throwaway address is the cheapest way to farm endpoints.
• Every input needs a name. That is the key the value is stored and emailed under. An input without one is dropped.
• Keep the honeypot. Real visitors never see it, so it stays empty; bots fill every field, so theirs are rejected before anything else runs.

Two optional hidden fields work exactly as they do on any ShipMyForm form: _subject sets the subject of the notification email, and _redirect sends the visitor to your own thank-you page after submitting, provided it is on the same site.

Step 2: put it on a real page

The endpoint binds the form to the site it came from. It reads the browser's Origin header on the first submission, records that host, and from then on accepts submissions only from it. Two consequences:

• Test from the page, not from the terminal. A curl request has no Origin and is refused. Open the page in a browser and submit there.
• One form per address per site. The same address on another domain becomes a separate form. That is deliberate: it stops one leaked address from being used to send you junk from anywhere.

Step 3: submit once

Fill the form in and press send. Behind that click:

1. The submission is parsed and run through the same spam pipeline as every other form: honeypot, rate limits, cross-form velocity checks, and content classification.
2. If it is clean, a placeholder account, a workspace and a form are created for the address, and the submission is stored, encrypted, against it.
3. An activation email goes to the address. It names the site and links to an activation page. It never contains what the visitor typed, because the address has not been proven yet, and it will not until you activate.

You, the visitor, land on the thank-you page as normal. If you used a test message, check it was not something a spam filter would object to; a submission that scores as spam is stored as spam and sends no email.

Step 4: activate

The email has one button. It opens a page that says which site the form is on, how many submissions are waiting, and what activating does. Pressing Activate and open my inbox creates a free account for the address, signs you in, opens the inbox with the held submissions, and switches on email notifications. No password, no card.

From that moment the form is an ordinary ShipMyForm form. Notifications go out for every clean submission, from an authenticated domain with the visitor's address as Reply-To, so replying reaches them and the mail does not land in spam.

Two details of the activation link are worth knowing. It is a signed token that expires after 14 days, the same window the held submissions live for. And it can never be used to sign into an account that already exists: if the address later becomes a verified account, the link stops working and sends you to the normal sign-in instead.

Step 5: swap in the form ID

Your email address is now in the page source, where a scraper can find it. That is the price of skipping signup, and it is a fair one for getting started, but you do not have to keep paying it. In the dashboard, open the form, copy its /f/<id> endpoint from the Setup tab, and replace the action:

<!-- Before -->
<form action="https://shipmyform.com/to/[email protected]" method="POST">

<!-- After -->
<form action="https://shipmyform.com/f/frm_8Kx2mQ9pL4vN" method="POST">

Both URLs keep working, so there is no rush and nothing breaks while you make the change.

What is held before you activate

Already have an account?

Then there is nothing to activate. A form pointed at an address that belongs to a verified account is created straight in that account's workspace, named after the site, already active, with notifications on. The first submission just arrives.

For AI agents

This is the reason the feature exists. An agent building a site end to end cannot sign up for anything, so it either leaves a placeholder or invents an endpoint that silently fails. With this, it asks one question, "which email should submissions go to?", and writes a form that works. Our llms.txt tells agents exactly that: ask for the address, never invent one, and tell the user an activation email is coming. If the agent has an API key, the MCP server is better still, because it creates a form with a real ID and keeps the address out of the page.

Where this differs from FormSubmit

The starting move is the same, and FormSubmit deserves the credit for it: an email address in the action, an activation email on first use. The differences start after activation. Submissions here are stored in an inbox you can search and export, not only emailed. Spam is handled server-side with a honeypot, rate limits and classification rather than a CAPTCHA the visitor has to solve. You get validation rules, auto-reply, and routing to Slack, Sheets, Notion and webhooks. And you can move to a form ID so your address leaves the page. If all you want is an email per submission and you are happy with a CAPTCHA, either works; the difference is what happens once the form is real.

Next steps

• The no-signup endpoint, on one page: instant endpoints
• Markup to start from: HTML contact form templates that email you
• Why the form cannot email you by itself: HTML form to email
• What you are actually using: what is a form endpoint?