Forms

Password protected forms

Secret key access puts a password in front of the form. Anyone with the link and the key gets in, anyone with only the link does not. It is the simplest of the four access types and the right one more often than you would think.

Create a form with OneCraftThe secret key access type, the gate respondents meet, and its honest weaknesses

The Access Type list open in the Publish tab showing public, secret key, login required and domain restricted — All four access types. A form has exactly one of them.

What it is good for

A group who all get the same key from you: a class, a team, a set of suppliers, the attendees of one event. You share one link and one key, and the barrier is enough to stop the form being filled in by whoever finds the URL in a forwarded email. It is a door with a lock, not an identity check.

What it is not

It does not tell you who filled the form in, and it cannot stop somebody passing the key on. If you need to know that a specific person answered, use login required with an allow-list instead. If you only need to keep the form off the open internet, the key is enough and it is far less friction.

Where to put the key

Never in the same message as the link, if the message might be forwarded. In practice most people do send both together and accept that, which is fine when the risk is casual rather than deliberate. If it matters, send the link by email and the key by another channel.

Access travels with the version

Access settings are stored with each published version, not just on the form. That means publishing a new version carries its access settings with it, and a specific historical version keeps the settings it was published with. Change the key and republish for the change to reach the live link.

How it works, in three steps

Step 1
Set the access type to secret key
It is in the publish settings, alongside the other three access types.
Step 2
Set the key and publish
Access settings are stored with the published version, so publish after changing them.
Step 3
Share the link and the key
Separately if the form is sensitive, together if the risk is casual.

The full walkthrough with screenshots is in the guide Control who can fill in your form.

Limits worth knowing

A key does not identify anybody. It only controls who gets in.
A key can be passed on and cannot be revoked per person.
Access settings live on the published version, so a change needs a publish.

See it on a finished piece

Product order form

16 fields

Job application form

20 fields

Rental application form

27 fields

Questions people ask

Can I see who used the key?

No. A key gates access, it does not identify anybody. For that, use login required with an allow-list.

How do I change the key?

Change it in the publish settings and publish. Access settings travel with the published version, so the live link only picks up the change on publish.

Is a secret key secure enough for confidential data?

It is a shared password, so treat it as one. For anything genuinely confidential, use login required and name the people who are allowed in.

Make your own form

The button opens the generator with this use case already described. Change the wording to match yours, generate, then edit anything you like.

Create a form with OneCraft