Do I need a CSRF token?

Not when POSTing directly to FormLoom. If you forward through a Laravel route, use CSRF on your own route and `Http::post()` to FormLoom.

Laravel guide

You have a Laravel backend, but you may not want to build, store, and maintain contact-form handling, spam filtering, and transactional email yourself. Point a Blade form at FormLoom (or forward from a controller) and skip the boilerplate — keep Laravel for your actual app logic.

Approach

Either POST a Blade `<form>` directly to FormLoom, or forward from a controller with Laravel's HTTP client if you want server-side handling and CSRF in your own app first.

Code

contact.html

<form action="https://formloom.vercel.app/api/submit/YOUR_ACCESS_KEY" method="POST">
  <label>
    Name
    <input type="text" name="name" required />
  </label>
  <label>
    Email
    <input type="email" name="email" required />
  </label>
  <label>
    Message
    <textarea name="message" required placeholder="How can we help?"></textarea>
  </label>
  <!-- honeypot: bots fill this, humans don't see it -->
  <input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off" />
  <button type="submit">Send</button>
</form>

contact.html

<form id="contact-form">
  <label>
    Name
    <input type="text" name="name" required />
  </label>
  <label>
    Email
    <input type="email" name="email" required />
  </label>
  <label>
    Message
    <textarea name="message" required placeholder="How can we help?"></textarea>
  </label>
  <!-- honeypot: bots fill this, humans don't see it -->
  <input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off" />
  <button type="submit">Send</button>
</form>

<script>
const form = document.getElementById("contact-form");
form.addEventListener("submit", async (e) => {
  e.preventDefault();
  const res = await fetch("https://formloom.vercel.app/api/submit/YOUR_ACCESS_KEY", {
    method: "POST",
    headers: { "Content-Type": "application/json", Accept: "application/json" },
    body: JSON.stringify(Object.fromEntries(new FormData(form))),
  });
  const data = await res.json();
  if (data.success) {
    form.reset();
    alert("Thanks — we got your message.");
  } else {
    alert(data.message || "Something went wrong.");
  }
});
</script>

submit.ts

// npm i @formloom/client
import { createForm } from "@formloom/client";

type Contact = {
  name: string;
  email: string;
  message: string;
};

const form = createForm<Contact>("YOUR_ACCESS_KEY");

// End-to-end typed: TS errors if you send the wrong shape.
const { success, message } = await form.submit({
  name: form.name.value,
  email: form.email.value,
  message: form.message.value,
});

Gotchas

If you POST directly to FormLoom from Blade, you don't need Laravel's CSRF token (it's a cross-origin POST to FormLoom).
To keep CSRF and validation in Laravel, submit to your own route and forward to FormLoom with `Http::post()`.

FAQ

To skip building submission storage, spam scoring, a dashboard, and deliverable email. FormLoom handles the contact-form plumbing so you don't maintain it.

See the full Laravel contact form page with a live demo.