Skip to main content
No. Every submission path — including a plain <form> with JavaScript disabled entirely — hits the same public endpoint directly, with no round-trip required first. See Introduction for why this is deliberate.
Whichever matches your project — there’s no “recommended” tier that gets better treatment. React/Vue/Svelte/Angular all get the same useRaykoiForm lifecycle management; plain HTML gets it automatically via submit.js; anything else uses the headless client.form(id).submit() directly. See Integrations.
Yes — a plain <form method="POST"> works, protected by honeypot, rate limiting, and origin checks (CAPTCHA can’t run without JS, so it’s excluded from that path’s protection). See No JavaScript.
Yes, entirely — Raykoi writes plain markup with stable class/attribute hooks (.raykoi-message, .raykoi-field-error, data-raykoi-state) and adds zero inline styles. Add your own rules to your page’s stylesheet. See Markup Hooks.
No — a file uploads directly from the visitor’s browser to storage via a short-lived signed URL. Your server (and Raykoi’s own API server) never sees the file bytes unless you explicitly proxy them yourself. See File Uploads.
It’s stored, never silently dropped — just filtered into the Suspicious tab instead of Valid, for you to review. Only a filled honeypot or a verified-invalid CAPTCHA token blocks a submission from being stored at all.
API keys support a test type (rk_test_...) alongside live — use a test key while developing so submissions don’t mix into real data on the backend/Server-Data-API side. There’s no separate test environment for public submissions (the browser-facing endpoint doesn’t distinguish); use a dedicated test form during development instead.
Every submission carries an Idempotency-Key (auto-generated by the SDK if you don’t supply one) — retrying with the same key and same payload returns the original result instead of creating a duplicate, so a flaky network or a double-click never double-submits.
See Submissions.
Configure a webhook — your own endpoint, Slack, Discord, or Telegram — with a fully structured payload.
The public API (/api/v1/forms/p/..., /api/v1/submit/p/...) is what a browser calls directly — no secret required, protected by spam signals instead of a credential. The Server Data API (/api/v1/server/...) is secret-key-authenticated, server-side only, and exists for your backend to read data it owns — never called from a browser.