Get started in 30 seconds.

1. Create a project

Sign up and create a project from your dashboard. You'll get a unique endpoint URL instantly — no configuration needed.

2. Point your form

Set your HTML form's action attribute to your Postix endpoint URL.

<form action="https://postix.exivar.com/f/YOUR_PROJECT_ID" method="POST">
  <input name="name" placeholder="Name" required />
  <input name="email" type="email" placeholder="Email" required />
  <textarea name="message" placeholder="Message"></textarea>
  <button type="submit">Send</button>
</form>

3. Or use JavaScript

You can also submit via fetch or any HTTP client. Send JSON with the appropriate content type header.

fetch("https://postix.exivar.com/f/YOUR_PROJECT_ID", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    name: "Jane Doe",
    email: "jane@example.com",
    message: "Hello from JavaScript!"
  })
})

Bot protection

Add the Postix script to every page with a Postix form, then turn on Bot Protection in your project settings. The script adds a hidden check to each form. Bots that do not run JavaScript are rejected, and your visitors see nothing.

<script src="https://postix.exivar.com/v1/postix.js" async></script>

If you send JSON with fetch, add a token to the body:

body: JSON.stringify({
  name: "Jane Doe",
  email: "jane@example.com",
  _postix_token: await postix.token("YOUR_PROJECT_ID")
})

• Your page must be served over HTTPS.
• Visitors with JavaScript turned off cannot submit while protection is on.
• Posts from servers or tools like curl are rejected. If you submit from your own backend, leave protection off.

Redirects

After a form submission, the user is redirected based on this priority:

1. _redirect hidden field in the form (per-submission override)
2. Success/Error redirect URL configured in project settings
3. Back to the page the form was on, with #form-submitted or #form-error appended
4. JSON response (for fetch / API callers with no Referer)

Add a hidden field to override the redirect per form:

<input type="hidden" name="_redirect" value="https://yoursite.com/thanks" />

Detecting submission status

When no redirect is configured, the user is sent back to the form page with a URL hash. Use JavaScript to show a success or error message:

if (window.location.hash === "#form-submitted") {
  alert("Thanks! Your message was sent.")
}
if (window.location.hash === "#form-error") {
  alert("Something went wrong. Please try again.")
}

Allowed origins

By default, any domain can submit to your endpoint. Restrict this in your project settings by adding specific allowed origins. The server checks the Origin and Referer headers on each request. Use *.example.com to allow all subdomains.

Submission metadata

Every submission automatically captures metadata from the request headers:

Supported content types

Webhooks

Configure webhooks in your project settings to receive a POST request every time a form is submitted. Each webhook receives a JSON payload with the submission data, the project and the form it was sent to.

{
  "event": "submission.created",
  "project": { "id": "psx_abc123", "name": "My Project" },
  "form": { "id": "psx_abc123", "name": "Main form" },
  "submission": {
    "id": 1,
    "data": { "name": "John", "email": "john@example.com" },
    "meta": { "ip": "1.2.3.4", "country": "US" },
    "createdAt": "2026-03-19T12:00:00.000Z"
  }
}

If you set a webhook secret, each request includes an X-Postix-Signature header with an HMAC-SHA256 signature for verification.