FormsList Is Now AI-Native: The Form Backend That Works Before You Sign Up

The way websites get made has quietly inverted. In 2023, a developer opened an editor and occasionally asked an AI for help. In 2026, for a huge class of sites — portfolios, landing pages, local business sites, event pages, waitlists — a person describes what they want and an agent builds the whole thing. Claude writes complete pages as Artifacts. v0 generates production React. Lovable and Bolt take you from prompt to deployed app. Cursor and Claude Code scaffold entire marketing sites inside a repo without the developer touching most of the files.

Almost every one of those sites needs exactly one piece of backend infrastructure on day one: a contact form that actually delivers. Not auth, not a database, not payments — those come later, if ever. A form is the minimum viable backend of the entire "agent builds you a website" category.

And a form is the one thing a frontend-generating agent cannot fake. It can write flawless HTML for the form itself, but <form> without an action that points somewhere real is decoration. The submission has to go to something: storage, spam filtering, an email notification to a real inbox. That something is a form backend — it's what FormsList has always done. Point your form's action at https://formslist.com/f/<your-form-id> and submissions are stored, filtered, and forwarded.

So the agents came looking. We saw forms generated inside Claude Artifacts submitting to us. We saw single-session Netlify deploys wired to us. The demand side of this shift arrived on its own — the supply side (us) had a problem, and so did every competitor.

Here is the flow every form backend on the market — Formspree, Getform, Basin, Web3Forms, and FormsList until today — imposed on an AI agent trying to ship a contact form:

1. Agent generates a beautiful site with a contact form.
2. Agent needs a form endpoint.
3. The form backend requires an account. Accounts require a human: email, password or OAuth, an email-verification click, maybe a CAPTCHA — ironically, the exact machinery designed to keep agents out.
4. Agent stops. Tells the human: "Go sign up at this website, create a form in their dashboard, and paste the endpoint URL back to me."
5. Human context-switches, signs up, wanders an unfamiliar dashboard, finds the endpoint, pastes it back.
6. Agent resumes and finishes the job — minutes or hours later, if the human comes back at all.

Step 4 is where the magic dies. The entire promise of the agentic workflow is "describe it, get it working." One human-required signup in the middle turns a ten-second task into a homework assignment. In practice, agents faced with this wall do one of three things: they leave a placeholder action="#" (form silently does nothing), they invent a plausible-looking endpoint that 404s, or they wire up a mailto: link and call it a day. All three ship a broken form to a person who believes their site works.

The signup wall wasn't malicious — it was an assumption baked in when every user was a human with a browser. Account first, resource second. Every SaaS works this way. It just happens to be exactly backwards for the way software is built now.

We inverted the order. Instead of sign up, then get a form, FormsList now does get a form, then claim it.

Any agent (or human, or shell script) can request a live form endpoint with a single unauthenticated API call, supplying only the email address that should receive submissions. The endpoint works immediately — real storage, real spam filtering, real email notifications. Ownership gets established afterwards: the email owner receives a claim link, clicks it, and the form attaches to their FormsList dashboard (creating a free account on the spot if they don't have one).

Three properties make this safe rather than reckless:

• The email address is the anchor of ownership. Submissions and the claim link go to the provided address. Whoever controls that inbox controls the form. An agent can provision on your behalf, but it can't take the form anywhere you can't follow.
• Unclaimed forms expire after 7 days. If nobody claims a form within a week, it's deleted. No zombie endpoints accumulating spam forever; no permanent free infrastructure for abusers.
• Provisioning is rate-limited per IP and per email, per day. One agent building one site gets a frictionless experience. A script trying to mint ten thousand endpoints hits a wall fast.

The pattern will feel familiar if you've used claim-based flows elsewhere — deploy previews you claim into your Vercel account, or gift subscriptions activated by the recipient. We think it's the correct default for any infrastructure that agents provision on behalf of humans: the resource is instant, the ownership is asynchronous.

Here's the entire integration. No API key, no account, no OAuth dance:

curl -X POST https://formslist.com/api/v1/instant \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'

The response comes back in well under a second with everything needed to ship a working form:

{
  "endpoint": "https://formslist.com/f/x7k2m9qa",
  "snippet": "<form action=\"https://formslist.com/f/x7k2m9qa\" method=\"POST\">...</form>",
  "claim_url": "https://formslist.com/claim/...",
  "expires_at": "2026-08-11T09:00:00Z"
}

• endpoint — live immediately. POST form data at it and the submission is stored, spam-scored, and emailed to the address you provided.
• snippet — a ready-to-paste HTML form wired to that endpoint, so an agent doesn't even have to compose the markup itself.
• claim_url — where ownership gets established. Claiming is verified through the email inbox, so holding this URL alone doesn't hand the form to a stranger.
• expires_at — the 7-day claim deadline. Claimed forms never expire.

That's the whole thing. An agent asked to "add a contact form" makes one HTTP call, pastes one snippet, and moves on. The human finds a claim email in their inbox when they care to look. We wrote a step-by-step tutorial covering the full flow, including testing your first submission.

Raw HTTP is the universal fallback, but the agents people actually use day-to-day — Claude Code, Claude Desktop, Cursor — speak the Model Context Protocol. MCP gives an agent typed, discoverable tools instead of "here, go read our API docs and guess."

So FormsList now ships formslist-mcp, an MCP server exposing seven tools:

• instant_provision — the claim-later flow above. Works with zero configuration: no API key needed.
• create_form — create a form in your account (named, permanent).
• list_forms / get_form — enumerate and inspect your forms.
• get_submissions — pull submissions, so your agent can summarize this week's leads without you opening a dashboard.
• configure_autoresponse — set up the automatic reply sent to people who submit.
• get_embed_snippet — fetch ready-to-paste HTML for any form.

Everything beyond instant_provision authenticates with a ff_sk_ API key from your account's API keys page — the same keys the REST API uses, available free on every plan. The server lives in the mcp/ directory of our repo and is coming to npm as formslist-mcp.

The practical effect: "add a contact form to this site" becomes a one-prompt task in Claude Code, and "any new leads this week?" becomes a question your editor can answer. We've written a full tool-by-tool guide to the MCP server for the details, including setup for each client and security notes.

Agents don't read marketing sites. When an LLM encounters a FormsList endpoint in someone's codebase — say, an action="https://formslist.com/f/x7k2m9qa" in an HTML file — it needs to figure out what that URL is and how to use it, right there, mid-task.

So we made the endpoints answer for themselves. GET any form endpoint and instead of an error page you get JSON usage documentation: what the endpoint is, which methods it accepts, how to POST to it, what special fields (like redirects and honeypots) it honors, and where the full docs live. The URL in the codebase is the documentation.

Errors got the same treatment. When something goes wrong, the response isn't a bare status code — it's structured for a machine to act on:

{
  "error": "Form not found",
  "fix": "Check the form hash in your action URL, or provision a new endpoint via POST /api/v1/instant",
  "docs_url": "https://formslist.com/docs"
}

Every error tells the agent what happened, what to do about it, and where to learn more. A human debugging at 2am appreciates this too — but the design target is an agent that hits the error, reads fix, and self-corrects without ever surfacing the problem to you.