API Tokens and Authentication - Documentation

Create, use and revoke the API tokens that authenticate your requests to the Formbold REST API and MCP server.

What are Formbold API tokens for?

An API token lets your code or AI assistant act on your Formbold account without your password. You send it with each request to the REST API or the MCP server.

You might give one to a backend job that copies new submissions into your database, or to Cursor so it can create and manage your forms through MCP. API access is included on every plan, including Free.

Treat tokens like passwords. Anyone who has one can read your submissions.

How do I create an API token?

Open API & MCP in the dashboard sidebar.
Go to the API Tokens tab.
Create a new token and give it a name that says where it's used, like "Production CRM sync".
Copy the token right away and store it in a password manager or your server's environment variables.

Make one per app or machine. Then, when you retire a server, you revoke its token and nothing else breaks.

How do I use the token in a request?

Send it in the Authorization header with the Bearer scheme:

Authorization: Bearer YOUR_TOKEN

A quick way to check that a token works is to fetch a form's submissions. Replace 3Vy25 with your own form ID:

curl -H "Authorization: Bearer YOUR_TOKEN" https://api.formbold.com/api/forms/3Vy25/submissions

The REST API has one endpoint today:

Method	Endpoint	What it does
GET	https://api.formbold.com/api/forms/:formId/submissions	Lists a form's submissions (turn on HTTP API for that form first)

The full details, with parameters and responses, are in the API reference.

How do I use the token with the MCP server?

Send the same header to https://api.formbold.com/mcp. Most clients take it in a headers field next to the server URL. Setup for Cursor, VS Code, Claude Code, Claude Desktop and Codex is in MCP Server.

If the token is missing, the MCP server answers 401 with "Authentication token is required for Formbold MCP access." If it's wrong, expired or revoked, the message is "Invalid or expired Formbold MCP API token."

How do I revoke a token?

Open API & MCP, go to API Tokens, and revoke the token you no longer need. Any app still using it gets a 401 Unauthorized from then on, so update that app with a new token first if it should keep working.

How do I keep tokens safe?

Never commit tokens to Git, and never put one in client-side JavaScript. Anyone can read those.
Store it in an environment variable, like process.env.FORMBOLD_API_TOKEN.
Revoke any token you think has leaked. Then create a new one. It takes a minute.

The API Guide tab on the same page has a short version of this, if you want it handy while you work.