Forms
Server / API Key

Server / API Key

The Server / API Key integration method is designed for server-to-server workflows, backend applications (Node.js, Python, Ruby, Go, etc.), automation platforms (like Zapier or Make.com), or mobile applications.

Because these environments run outside a standard web browser, origin headers are not available. Instead, you authenticate requests using the form's secret API key.

Setup Guide

  1. In the Gordon CRM dashboard, open your form's details page.
  2. Under the API Key section, reveal and copy the secret key.
  3. Authenticate your request using one of the following methods:
    • Request Header: Include the key in your headers as x-api-key.
    • Query Parameter: Include the key in your URL search parameters as api_key (e.g., https://app.gordoncrm.com/api/forms/YOUR_FORM_ID?api_key=YOUR_API_KEY).

Code Example

Using Request Header

curl -X POST https://app.gordoncrm.com/api/forms/YOUR_FORM_ID \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{
    "email": "lead@example.com",
    "first_name": "John",
    "last_name": "Doe",
    "phone": "555-0100"
  }'

Using Query Parameter

curl -X POST "https://app.gordoncrm.com/api/forms/YOUR_FORM_ID?api_key=YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "lead@example.com",
    "first_name": "John",
    "last_name": "Doe",
    "phone": "555-0100"
  }'

Key Considerations

API Key Security

Your API key grants complete authorization to submit data to your form.

Warning: Never expose your API key in frontend code (websites, single-page apps, or public repositories). If you suspect a key has been compromised, you can regenerate it at any time from the form settings page.

Verification Bypass

Because server-to-server submissions are authenticated with your secret API key, they automatically bypass email verification (double opt-in) and update the contact instantly. To safeguard existing CRM profiles from accidental overwrites, the pipeline follows the same Non-Destructive Merge rules:

  • Personal Details: First name, last name, and phone number fields are only updated if they are currently blank in the CRM.
  • Consent Overwrites: Marketing subscription preferences (is_subscribed and opt-in sources) always overwrite existing data on submission, ensuring the CRM captures the contact's latest explicit consent status.

Honeypot Bypass

The website_url spam protection honeypot is only required for browser-based submissions. When authenticating with an API key, the spam check is bypassed, meaning you do not need to include this field in your payload.

Rate Limits

Server-to-server submissions are subject to the same rate-limiting rules as browser submissions (5 requests per 60 seconds per form+IP). If you need to perform bulk contact imports, use the CRM's native CSV import tools instead of the forms API.

Related

React / SPAOverview