Guide

Manage PostMyForm forms with an AI agent

Authorize an AI agent to create or manage PostMyForm forms safely through MCP, the CLI, or the public API.

Last updated 2026-09-07

Manage a PostMyForm form with an AI agent

An authorized AI agent can create and manage PostMyForm forms through the same public interfaces available to developers.

Use one of these interfaces:

| Interface | Best use | | --- | --- | | PostMyForm MCP | Agents and assistants with MCP support | | PostMyForm CLI | Shell-capable agents and automation | | PostMyForm API | Custom integrations that need direct HTTP control |

Prefer PostMyForm MCP when the agent supports MCP.

Use the PostMyForm CLI when the agent can run approved shell commands but MCP is not appropriate.

Use the PostMyForm API reference and public OpenAPI contract when building a custom HTTP integration.

All three interfaces use the public PostMyForm API as the authority for authentication, authorization, plan limits, and form behavior.

Authorize the agent

Create a dedicated PostMyForm API credential for the agent or automation.

Grant only the scopes required for the task:

  • forms:read permits form, field, and generated-HTML read operations.
  • forms:write permits form creation, form updates, and field replacement.

An agent that only inspects existing forms needs forms:read.

An agent that creates or changes forms normally needs both forms:read and forms:write.

Do not give an agent broader access than its task requires.

Revoke the credential when the agent or automation no longer needs it.

Keep authenticated dashboard instructions limited to the task of creating and revoking the credential. The workflow below does not depend on the current dashboard layout.

Keep the credential out of agent data

For the CLI and MCP server, provide the credential through POSTMYFORM_API_TOKEN.

For a temporary Bash shell:

read -rsp "PostMyForm API token: " POSTMYFORM_API_TOKEN
echo
export POSTMYFORM_API_TOKEN

Start the authorized CLI or MCP client from the controlled environment that contains the token.

When the session is complete:

unset POSTMYFORM_API_TOKEN

Do not place an API credential in:

  • a URL;
  • a command-line argument;
  • an MCP tool argument;
  • an agent prompt;
  • generated website HTML;
  • source control;
  • screenshots;
  • logs;
  • examples or documentation.

A custom raw-API integration should also load its credential from a controlled secret source. Follow the authentication contract in the API reference instead of inventing an authentication scheme.

Use only the supported form operations

The current public machine interfaces provide seven form operations:

  1. list forms;
  2. create a form;
  3. get one form;
  4. update one form;
  5. get form fields;
  6. replace form fields;
  7. get generated form HTML.

Do not guess additional commands, MCP tools, request fields, or endpoints.

For raw HTTP integrations, the public OpenAPI contract is the source of truth for request and response shapes.

Recommended MCP workflow

For an MCP-capable agent, use the seven released PostMyForm MCP tools.

1. Discover existing forms

Call:

list_forms

This is a read-only operation.

Select an existing form when it already represents the requested website form.

2. Create a form when needed

If no suitable form exists, call:

create_form

Provide the required form settings, including the form name and destination email.

create_form changes server state.

Do not automatically retry the mutation when its result is uncertain.

3. Read the selected form

Call:

get_form

Use the selected or newly returned form_id.

This lets the agent read the current form configuration before deciding whether a change is required.

4. Update form configuration when needed

If the current configuration must change, call:

update_form

Send only the properties that should change.

update_form changes server state.

Do not automatically retry the mutation when its result is uncertain.

5. Read the current fields

Before changing an existing field collection, call:

get_form_fields

This returns the complete ordered field configuration.

6. Replace fields when needed

If the desired fields differ from the current fields, call:

replace_form_fields

replace_form_fields replaces the complete ordered field collection. It is not an incremental append operation.

This operation changes server state.

Do not automatically retry the mutation when its result is uncertain.

7. Get the generated HTML

Call:

get_form_snippet

PostMyForm returns the generated public form HTML as data.

Use this returned HTML. Do not reconstruct form markup from guessed endpoint behavior.

The agent can return the HTML to the developer or pass it to another separately authorized development tool.

Use the same workflow through the CLI

A shell-capable agent can perform the same public form workflow with the PostMyForm CLI.

Discover forms:

postmyform forms list --json

Create a form when needed:

postmyform forms create \
  --name "Contact" \
  --destination-email "contact@example.com" \
  --allowed-origin "https://example.com" \
  --json

Read the selected form:

postmyform forms get FORM_ID --json

Update selected form properties when required:

postmyform forms update FORM_ID \
  --name "Website Contact"

Read the current fields:

postmyform forms fields get FORM_ID --json

Replace the complete field collection when required:

postmyform forms fields replace FORM_ID \
  --file fields.json

Get the generated HTML:

postmyform forms snippet FORM_ID

The CLI prints the HTML returned by PostMyForm.

The CLI does not automatically retry mutations.

For installation, supported platforms, exit codes, authentication details, and the complete released command reference, see the PostMyForm CLI documentation.

Use the raw API for custom integrations

Use raw HTTP when an integration needs direct control over requests and responses rather than MCP tools or CLI commands.

Keep the workflow the same:

  1. list existing forms;
  2. create a form only when required;
  3. read the selected form;
  4. update form configuration only when required;
  5. read the current field collection;
  6. replace the complete field collection only when required;
  7. request the generated form HTML.

Use only operations defined by the PostMyForm API reference and public OpenAPI contract.

Do not invent request fields or derive private endpoints from observed application behavior.

State-changing API operations must not be treated as automatically retryable.

Separate PostMyForm access from repository access

PostMyForm manages the hosted form endpoint, form configuration, form fields, and generated form HTML.

PostMyForm MCP and the PostMyForm CLI do not independently:

  • edit a customer repository;
  • commit or push source code;
  • deploy a website.

If an agent should change website source, give a separate development or repository tool only the authorization required for that task.

A supported workflow is:

Agent
  -> PostMyForm MCP, CLI, or API
  -> create or select form
  -> configure form and fields
  -> request generated HTML
  -> return HTML to the developer
     or to a separately authorized coding tool

Keep PostMyForm credentials separate from repository credentials.

Stay inside the public agent boundary

The current PostMyForm form-management machine interfaces do not give an agent authority to:

  • administer billing;
  • purchase a subscription;
  • read form submissions;
  • manage submission delivery;
  • manage Slack or Discord destinations;
  • perform account or operator administration;
  • access private PostMyForm backend systems.

Broader agent commerce and machine-payable billing are outside this workflow.

Agent safety checklist

Before allowing an agent to change a form:

  • use a dedicated credential;
  • grant only forms:read and, when needed, forms:write;
  • keep the credential in a controlled environment or secret mechanism;
  • use documented MCP tools, CLI commands, or OpenAPI operations only;
  • read current state before changing an existing form;
  • make state-changing operations explicit;
  • do not automatically retry uncertain mutations;
  • get generated HTML from PostMyForm instead of reconstructing it;
  • authorize repository editing separately;
  • revoke credentials that are no longer required.

Related resources