Form Forge

Form Forge is a self-hosted, schema-first form platform. Define a form, publish an immutable version, collect responses, and deliver them to signed webhooks with inspectable attempts and retries.

Use the hosted form page, embed a form on your site, or submit responses through the public API. Your PostgreSQL database stores forms, responses and delivery history. Form Forge is free/libre software under Apache 2.0, with no product analytics, advertising trackers or usage reports to the project authors. Optional Sentry reporting is controlled by the deployment owner.

Features

• Versioned forms: schema editor with live preview, conditional fields, immutable published versions, comparison and draft restoration.
• Flexible collection: hosted pages, iframe embedding with automatic height, and an idempotent public submission API.
• Intake controls: pause/resume, closing time, acceptance limits and custom closed messages across all published versions.
• Response management: date and answer search, selectable columns, new/processed status, CSV export and owner-confirmed deletion.
• Privacy controls: optional source metadata, disabled by default for new forms; no collection of unfinished responses.
• Reliable webhooks: signed payloads, transactional outbox, automatic retries, delivery diagnostics and manual recovery.
• Workspace access: owner, editor and viewer roles; GitHub, Google and GitLab sign-in with account linking.
• Integration contracts: OpenAPI and read-only MCP tools using existing workspace permissions.

Quick start

For local development, you need PostgreSQL, a GitHub OAuth application, pnpm 12.17.0, and a Node.js version supported by package.json: 22.22.2+, 24.15.0+, or 26+. See Getting started for the complete setup, including a local PostgreSQL container and OAuth callback URLs.

From the repository root:

pnpm install
cp apps/web/.env.example apps/web/.env

Configure the database URL, application secrets and GitHub OAuth credentials in apps/web/.env using the environment instructions. Export the same database URL for migrations, then start the application:

export DATABASE_URL='postgresql://postgres:postgres@127.0.0.1:5432/form_forge'
pnpm db:migrate
pnpm dev

In another terminal, start the local background-job server:

npx --ignore-scripts=false inngest-cli@latest dev \
  -u http://localhost:3000/api/inngest

Open localhost:3000, sign in, create a form and publish it. Submit a response on its hosted page and inspect it in Submissions. Add a public HTTPS webhook endpoint to try background delivery. The Inngest dashboard is at localhost:8288.

For production, use the Docker Compose guide or Netlify guide. Local development credentials are not suitable for deployment.

Documentation

Using Form Forge:

• Getting started: requirements, environment, database, OAuth and your first form.
• User guide: forms, sign-in methods, intake controls, privacy, responses and roles.
• Public API, OpenAPI and MCP: submission contract, idempotency, limits and integrations.
• Embedding: iframe setup, automatic height and events.
• Webhooks: payload format, signature verification, retries and deduplication.

Running an installation:

• Deployment and operations: configuration, reverse proxy, upgrades, backups and monitoring.
• Docker Compose: single-host installation, backup and restore.
• Netlify: Netlify with Neon and Inngest Cloud.
• Deployment verification: automated checks and what they prove.

Working on the project:

• Architecture: repository layout, technology and data flow.
• Development: commands, tests, CI and Playwright.
• Dependency maintenance: Dependabot, security updates and toolchain changes.
• Releasing: versioning and the release workflow.

Contributing

Contributions are welcome. Read CONTRIBUTING.md for setup, checks and pull request guidance, and follow the Code of conduct.

Report bugs and suggest features through GitHub Issues. To report a vulnerability, follow SECURITY.md instead of opening a public issue. See CHANGELOG.md for release history.

License

Apache License 2.0. Workspace packages are internal and are not published to npm.