Flows: forms, logins and APIs without a server

A flow is a short list of steps that runs on our servers at /api/flows/<name> on your site. A plain HTML form can post to it; no script or backend is needed.

A contact form

<form method="post" action="/api/flows/contact">
  <input name="name"> <input name="email" type="email"> <textarea name="message"></textarea>
  <button>Send</button>
</form>

Ask the assistant to “save the contact form entries”, or create the flow yourself with create_flow:

{ "name": "contact", "steps": [
  { "type": "store_submission" },
  { "type": "respond", "redirect": "/thanks" } ] }

Entries appear in the site's Form submissions. New flows that save or email what visitors send get spam protection automatically.

Steps

Step	What it does
`store_submission`	Saves the form entry (passwords and tokens are dropped).
`send_email`	Sends mail through your own mail account. See Sending email.
`http_request`	Calls an HTTPS API on a host you allowed with `allow_domain`; can use your stored secrets (`{{secret.NAME}}`), which are never shown back.
`check`	Compares two values (constant time) and stops with a status or a redirect when they differ.
`session`	Signs a visitor in to your site with a small per-site session store; pages can then be members-only. Or use Sign in with Sherman Studio with no flow at all.
`store_record`, `query_records`, `delete_record`, `update_record`	Your site's own record store.
`verify_hmac`, `parse_json`	Accept signed webhooks (GitHub, Stripe, Slack, Planning Center and others) and read their JSON.
`verify_human`	The spam check at a point of your choosing.
`respond`	Redirects, answers with JSON, or sets a cookie.

Any step can have a when condition, so a flow can branch. Values come from tokens such as {{input.email}} (what was sent), {{steps.<id>.json.x}} (an earlier step's answer), {{session.data.x}} and {{random}}.

Pages fed by a flow

A page can run a GET flow on every visit and show its answer as {{flow.*}}, for example events from an API or records from your record store, optionally cached for up to an hour. Pattern pages such as /sermons/:slug give each item its own address.

On a schedule

Flows can also run by themselves every few minutes or on a cron schedule: see Scheduled flows.

Safety rules

Flows that use cookies only accept posts from your own site.
Secrets can only be sent to hosts you allowed, never echoed into pages, redirects or stored entries.
GET flows can't save entries or change data (a link must never be able to do that).

Price

Each flow call is 3.01 credits per 1,000; a saved form entry adds 12.2 credits per 1,000. Sending email and the spam check cost nothing extra. Full list on the Billing page.