What Carrd forms can do, by plan
| Feature | Carrd plan | What it does |
|---|---|---|
| Contact form | Pro Standard or higher | Emails your Carrd account address, or up to five recipients, from @mail.carrd.site. Optional message filter. |
| Custom form → Send to URL | Pro Plus or higher | Sends the fields to any URL by AJAX, POST or GET, as form data, JSON or XML, with up to five custom headers. |
| Embed element (Code) | Pro Standard or higher | Inserts your own HTML, CSS and JavaScript into the page. |
| Spam protection | Pro Standard or higher | Basic bot mitigation on every form, plus optional Cloudflare Turnstile, reCAPTCHA v2 or hCaptcha. |
The contact form is fine for many sites. Its messages just come from Carrd’s sending domain, and Carrd’s own troubleshooting advice for missing messages is to allowlist @mail.carrd.site. With FormSMTP, the email is sent through your own SMTP account, from your own address, with the visitor as reply-to.
1Create a FormSMTP project
Sign up free and add a project. Pick your email provider so the SMTP host and port fill in, enter your login, and click Test connection. Any mailbox with SMTP access works: Gmail or Google Workspace, Microsoft 365, Zoho, your web host’s mailbox, or a sending service. Personal Outlook.com and Hotmail addresses can’t be used, because Microsoft only lets them sign in with OAuth.
2Lock it to your site
In Settings → Security, set Allowed websites to your Carrd address and any custom domain, each written out in full: https://yoursite.carrd.co and https://yourdomain.com, and Allowed recipients to your own address. Then copy the form key from API & code. It starts with fk_, it only works on the form endpoint, and it can only email you, so it’s safe in your page.
3Option A (Pro Plus): Send to URL
Click Add Element, then Form. Set Type to Custom, then Send to URL, and fill in:
| URL | https://app.formsmtp.com/api/v1/form/YOUR_FORM_KEY |
| Method | AJAX |
| Format | JSON |
| Headers | None needed |
With AJAX, Carrd treats any 2xx response as success and anything else as failure. FormSMTP answers 200 when the email is sent and an error status with a JSON message when it isn’t, so Carrd’s On Success and On Failure behaviors work as expected. Pick what visitors see in each case.
Now open Fields and set a Submitted ID on each one. That’s the key FormSMTP receives and the label in your email:
| Label | Type | Submitted ID |
|---|---|---|
| Name | Text | name |
email (becomes the reply-to address) | ||
| Message | Text Area | message |
| Subject | Hidden, with a Default Value such as “New message from my Carrd site” | _subject |
Leave out File fields: FormSMTP doesn’t accept file uploads. If you turn on a CAPTCHA, use Carrd’s Spam Protection option rather than FormSMTP’s, because FormSMTP’s check expects the widget’s token in every submission.
4Option B (Pro Standard): An Embed with an HTML form
On Pro Standard, add the form as code instead. Click Add Element, then Embed. Set Type to Code, Style to Inline, and paste:
<form id="fs-contact" action="https://app.formsmtp.com/api/v1/form/YOUR_FORM_KEY" method="POST">
<label>Name <input name="name" autocomplete="name" required></label>
<label>Email <input name="email" type="email" autocomplete="email" required></label>
<label>Message <textarea name="message" rows="5" required></textarea></label>
<input type="hidden" name="_subject" value="New message from my Carrd site">
<input type="hidden" name="_t">
<!-- Honeypot: hidden from people, irresistible to bots -->
<input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off">
<button type="submit">Send message</button>
<p id="fs-status" role="status"></p>
</form>
<script>
(function () {
var form = document.getElementById("fs-contact");
var status = document.getElementById("fs-status");
var button = form.querySelector("button");
form.querySelector('[name="_t"]').value = Date.now();
form.addEventListener("submit", async function (e) {
e.preventDefault();
button.disabled = true;
status.textContent = "Sending…";
try {
var res = await fetch(form.action, {
method: "POST",
headers: { Accept: "application/json" },
body: new URLSearchParams(new FormData(form)),
});
var data = await res.json();
if (!data.success) throw new Error(data.error);
form.reset();
status.textContent = "Thanks! Your message was sent.";
} catch (err) {
status.textContent = "Sorry, that didn't work: " + err.message;
} finally {
button.disabled = false;
}
});
})();
</script>This version includes FormSMTP’s honeypot and time trap, and shows the result inline. Add a <style> block to match your site’s fonts and colors. Carrd doesn’t render embeds in the builder, so publish to see it.
5Publish and test
Click Publish Changes and submit the form on your live carrd.co address or custom domain. The message arrives from your own address and appears under Logs in FormSMTP.
Troubleshooting
- Carrd shows its failure message. Carrd treats anything but a 2xx response as failure. Check Logs in FormSMTP; the most common causes are below.
- “This form isn’t allowed on …”. Add the exact address to Allowed websites. Your
carrd.coaddress and your custom domain count as different sites. - Fields arrive with odd names. Without a Submitted ID, Carrd falls back to the field’s ID, which it generates from the label. Set a Submitted ID on every field.
- Carrd reports an error on a custom form. Carrd recommends IDs that use only letters, numbers, hyphens and underscores, and unique labels for every field.
- Replies go to you instead of the visitor. The email field’s Submitted ID isn’t
email.
FAQ
Which Carrd plan do I need?
Pro Standard or higher for the Embed route, and Pro Plus or higher for a custom form with Send to URL. Carrd’s form and embed features aren’t available below Pro Standard.
Why not use Carrd’s own contact form?
You can. Its messages come from Carrd’s sending domain, though. FormSMTP sends through your own SMTP account, so the email comes from your address and your inbox treats it like any other message you send yourself.
Can I collect newsletter signups instead?
Yes. Add a hidden _subscribe field (Submitted ID _subscribe, Default Value newsletter) and FormSMTP adds the visitor to your Contacts instead of emailing you.
Can the visitor get a confirmation email?
Not from the form endpoint: it only emails you, so a copied form key can’t be used to spam other people. To email the visitor, call the send API with your API key from server code.
Is the form key safe in my page?
Yes, it’s made for that. The form key (fk_) only works on the form endpoint and always delivers to your own inbox, with per-visitor limits and a spam filter on top. Someone who copies it can’t email anyone else. The API key (fs_) can, so keep that one in server code or a secrets store.