Skip to content

Same form-handler API key reused across multiple forms

Many contact and sign-up forms send their data through a third-party form-handling service, which uses an API key to identify which account and form the submission belongs to. This check looks for the same key being reused across more than one form on the site. On this site, the same form-handler API key was found in use across multiple different form contexts. Reusing one key across multiple forms means there's no way to tell which form a piece of leaked or misused data actually came from, and if that key is ever exposed, every form using it is affected at once rather than just one. It also makes it harder to detect abuse, like spam submissions, targeting a specific form, since the activity for all forms is mixed together under the one key. Your developer should generate a separate API key for each form directly in the form handler's dashboard, services like Formspree or Netlify Forms typically support this natively, and update each form to use its own key. This is a straightforward configuration task, and the exact time depends on how many forms need separate keys.

Why this matters

Reusing one key across multiple forms means there's no way to tell which form a piece of leaked or misused data actually came from, and if that key is ever exposed, every form using it is affected at once rather than just one. It also makes it harder to detect abuse, like spam submissions, targeting a specific form, since the activity for all forms is mixed together under the one key.

How to fix it

Your developer should generate a separate API key for each form directly in the form handler's dashboard, services like Formspree or Netlify Forms typically support this natively, and update each form to use its own key. This is a straightforward configuration task, and the exact time depends on how many forms need separate keys.