Introduction

​

How it fits together

┌────────────────────────────────────────────────┐
│  UI  —  your HTML / React / Vue / Svelte / ...  │
└───────────────────────┬────────────────────────┘
                         │
             ┌───────────▼───────────┐
             │      Raykoi SDK       │  validation · lifecycle
             │  (submit.js + SDK)    │  uploads · idempotency
             └───────────┬───────────┘
                         │
                ┌────────▼────────┐
                │    Forms API    │  validation · spam protection
                │                 │  submissions · storage · analytics
                └────────┬────────┘
                         │
                ┌────────▼────────┐
                │  Server / Admin │  trusted private-data access:
                │       API       │  submissions, analytics, files
                └─────────────────┘

• UI — entirely yours. Raykoi never renders your form.
• SDK — @raykoi/sdk (React/Vue/Svelte/Angular adapters, or plain JS) and submit.js (a zero-dependency runtime for raw HTML) both talk to the same Forms API underneath. Pick whichever matches your stack; the wire contract never changes.
• Forms API — the public, mostly-unauthenticated surface a browser talks to directly: fetch a form’s schema, validate data, submit, upload a file, track an analytics event.
• Server / Admin API — a separate, secret-key-authenticated surface for your own backend to read submissions, analytics, and files. Never used by browsers.

​

What Raykoi does not do

• No hard-required anti-replay token. Every submission path — including a plain <form method="POST"> with JavaScript disabled entirely — hits the exact same public endpoint with no extra round-trip required first. Spam protection is CAPTCHA, honeypot, rate limiting, and abuse detection — signals that provide real, independent value, not a token that only proves a client made a GET request.
• No opinion on your design system. The Basic HTML runtime writes plain, unstyled markup with stable class hooks (.raykoi-message, .raykoi-field-error) — you style it. The framework adapters (useRaykoiForm) return raw state (submitting, fieldErrors, status) — you render it.
• No lock-in on file storage. Uploads go straight to storage via a short-lived signed URL; your server never proxies file bytes unless you want it to.

​

Next step