Control who can fill in your form

This guide shows you how to control who can open and fill in your form, using the four access types in the Publish tab.

Not every form should be open to the world. A staff request form, a client agreement, a form embedded on one page of your site: each wants a different door.

Find the Access Control card

Open your form in the builder and switch to the Publish tab. Under the publish status you get Access Control, with an Access Type dropdown holding four options. Whatever you pick saves immediately, and the extra fields for that option appear underneath.

Four access types. Pick one and its own settings appear underneath.

Public: anyone with the link

Public - Anyone can access is the default and the right answer most of the time. Anyone holding the link opens the form and fills it in. No key, no account, nothing in the way.

Use it for anything you would happily post publicly: event signups, feedback, enquiries, applications.

Secret Key: a password on the form

Secret Key - Password protected puts a shared password in front of the form. Pick it, then type your key into the Secret Key box. The eye button reveals what you typed and the copy button puts it on your clipboard, which is handy because you have to send the key to people yourself.

Visitors get an Access Required card with an Enter Secret Key box and an Unlock Form button. Get it right and the form loads. Get it wrong and they are told the key is invalid and can try again.

One behaviour worth knowing: a secret key form asks for the key every time. It is never remembered between visits, so somebody filling it in twice enters the key twice. That is deliberate, and it is why the key is worth choosing to be short and easy to type.

If a key is already set, the box shows “Enter new key to change” instead of the old key. Type a new value to replace it.

Type the key once, then use the copy button to send it to people.

Login Required: only signed in people

Login Required - Must be signed in puts the form behind a OneCraft account. It comes with a switch, Allow Any Signed User, which decides how tight the rule is.

Leave it on and anybody with a OneCraft account can fill in the form. That is enough when the link is private and you just want a name attached to every response.

Turn it off and an Allowed Email Addresses box appears. This is the useful mode. Enter the addresses that may fill in the form, separated by commas or new lines, and you can enter a whole company at once by writing the domain with an @ in front:

maria@example.com
david@example.com
@ourcompany.com

That list allows two named people plus everybody at ourcompany.com. The check happens on our servers and the list is never sent to the browser, so nobody can read your allowlist by inspecting the page. Somebody signed in with an address that is not on the list sees Access Denied, with the address they are signed in as, so they know which account to switch.

This mode suits internal forms where the people filling them in already have an account and are already signed in.

Turn Allow Any Signed User off and the email allowlist appears.

Domain Restricted: only on your own site

Domain Restricted - For iframe embedding is for a form that lives inside a page on your website. Under Allowed Parent Domains you list the sites it may appear on, one per line:

company.com
example.org

Subdomains of anything you list are allowed too, so company.com also covers shop.company.com. Leave the list empty and the form stays open to everyone, so the restriction only starts once you name at least one domain.

The panel carries an amber warning, and it is honest. This check reads the origin the browser reports, and anybody technical can fake that from outside a browser. It is a gate against casual copying, not a security control. If the content is genuinely private, use Secret Key or Login Required instead.

Publish after you change it

Access control is stored twice: once on the form, and once on every version you publish. That is what lets an older version keep its own rules. So after you change the access type, publish the form again so the live version carries the new setting.

Once it is live, open the link in a private window and check you get the door you expected. It takes ten seconds and it is the only way to be sure.

For what publishing does and how versions work, see Publish updates without breaking your live link.