API Tokens & Authentication - FormBold Documentation

Generate, manage, and revoke Personal Access Tokens (PATs) for authenticating HTTP REST API and webhook requests.

What are FormBold API Tokens?

Personal Access Tokens (PATs) allow your external applications, serverless scripts, CLI utilities, and CI/CD pipelines to securely interact with the FormBold REST API without using your password.

📸 [Image Placeholder]: Screenshot of the API Tokens management page (/account/settings) with active tokens list and Generate New Token modal.

Generating a Personal Access Token

Go to Account Settings > Settings / API Tokens (/account/settings).
Click the 'Generate New Token' button.
Provide a clear token label describing its purpose (e.g. 'Production CRM Sync Worker').
Click 'Generate'.
Copy your token string immediately and store it in a secure password manager or environment variable (.env). For security reasons, FormBold will never display this token again.

Authenticating API Requests

Include your token in the HTTP Authorization header using the Bearer scheme:

curl -X GET "https://api.formbold.com/api/forms/YOUR_FORM_ID/submissions" \
  -H "Authorization: Bearer YOUR_PERSONAL_ACCESS_TOKEN" \
  -H "Accept: application/json"

Token Security Best Practices

Never commit API tokens to public Git repositories or client-side JavaScript bundles.
Use environment variables (e.g. process.env.FORMBOLD_API_TOKEN) to store credentials on servers.
Rotate tokens periodically and immediately revoke any token that may have been compromised.