Create a Headless endpoint
A Headless endpoint gives you a public URL for submitting answers to a Makeform form. Create one when you want to build your own form page or send submissions from a server.
Beta
This feature is available to all accounts. Its request and response format can change without a new API version. Do not depend on it for anything you cannot update quickly.
Create an endpoint
In the dashboard, choose Create → Headless to create a Headless form with an endpoint. You can also use the MCP tool create_headless_form. To add an endpoint to an existing form that does not have one, use update_headless_endpoint.
Each form can have one endpoint. The form must be published before it accepts submissions.
A new Headless form starts in loose schema mode with the honeypot enabled. It is enabled only if you provide at least one allowed origin and the form owner is within the Free plan’s endpoint limit. An endpoint added to an existing Page form starts disabled, in strict mode, with the honeypot enabled and no allowed origins.
You can enable an endpoint only after adding an allowed origin or a backend API key. A Page form with hosted CAPTCHA enabled cannot accept Headless submissions.
The MCP create_headless_form tool accepts name, optional domains, schema_mode, and the auto_reply and owner_notification booleans. It returns the endpoint and its submit URL in endpoint and submit_url. The endpoint ID is endpoint.endpoint_id; the form ID is form.id. If you omit owner_notification, the result has {"enabled":true} for that setting.
Configure endpoint settings
You can manage these settings in the dashboard or with MCP, as indicated:
| Setting | Values | Where |
|---|---|---|
enabled | true or false | Dashboard, MCP |
allowed_origins | List of origins | Dashboard, MCP |
schema_mode | strict or loose | Dashboard, MCP |
spam_mode | honeypot (default) or none | Dashboard, MCP |
| Turnstile | Enablement, site key and secret | Dashboard only |
| Backend API key | Create, rotate or revoke | Dashboard; MCP create_headless_api_key creates or replaces it |
| Auto-reply | Paid plans | MCP update_headless_endpoint |
| Verified email fields | Business plan | MCP update_headless_endpoint only |
In strict mode, the endpoint checks submitted keys, types and options against the form schema. In loose mode, unknown keys are accepted and learned into the schema before storage. Page forms must use strict mode.
When you enter a domain in the dashboard, it expands example.com to https://example.com and https://www.example.com. Entering localhost:3000 adds both HTTP and HTTPS origins. Paths are dropped. Origin matching uses the exact scheme, host and optional port.
Example
For a form on https://example.com, add that origin and use strict mode with the default honeypot:
{
"allowed_origins": ["https://example.com"],
"schema_mode": "strict",
"spam_mode": "honeypot",
"enabled": true
}The endpoint’s submit URL uses its endpoint ID:
https://submit.makeform.ai/f/ENDPOINT_IDUse the endpoint ID, not the form ID. In the dashboard, confirm the endpoint is enabled and the origin matches the page that will send submissions.