API Keys & Authorization

API Keys & Authorization Security

Voieform uses two distinct key types for different security scopes: **Public Form API Keys** for client-side website submissions and **Secret Account API Keys** for administrative REST API calls.

1. Domain Origin Whitelisting (CORS Protection)

To prevent unauthorized websites from submitting spam to your Public Form API key, you can configure **Allowed Domain Origins** in your Voieform Dashboard (e.g. https://yourdomain.com). Submissions coming from non-whitelisted HTTP Origin or Referer headers will be blocked automatically with an HTTP 401 response.

2. Secret Key Authorization Header

When making administrative REST API requests, send your secret key in the HTTP Authorization header using the standard Bearer token format:

// Backend REST API Authorization Example
const response = await fetch("https://api.voieform.com/v1/forms", {
  method: "GET",
  headers: {
    "Authorization": "Bearer vf_sec_99a88b77c66d55",
    "Accept": "application/json"
  }
});

3. Key Rotation & Revocation

If you suspect your secret token has been compromised, navigate to **Settings → API Keys** in your Voieform Dashboard to immediately revoke the token and generate a new key pair.