Do I need a CSRF token?

Not when POSTing directly to FormLoom. If you forward through a Laravel route, use CSRF on your own route and `Http::post()` to FormLoom.

Laravel contact form

Verified against Laravel 11.x · June 2026

You have a Laravel backend, but you may not want to build, store, and maintain contact-form handling, spam filtering, and transactional email yourself. Point a Blade form at FormLoom (or forward from a controller) and skip the boilerplate — keep Laravel for your actual app logic.

Customize in the generator Full Laravel guide

The code

Either POST a Blade `<form>` directly to FormLoom, or forward from a controller with Laravel's HTTP client if you want server-side handling and CSRF in your own app first.

Plain HTML (no JavaScript)

contact.html

<form action="https://formloom.vercel.app/api/submit/YOUR_ACCESS_KEY" method="POST">
  <label>
    Name
    <input type="text" name="name" required />
  </label>
  <label>
    Email
    <input type="email" name="email" required />
  </label>
  <label>
    Message
    <textarea name="message" required placeholder="How can we help?"></textarea>
  </label>
  <!-- honeypot: bots fill this, humans don't see it -->
  <input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off" />
  <button type="submit">Send</button>
</form>

AJAX fetch (vanilla JS)

contact.html

<form id="contact-form">
  <label>
    Name
    <input type="text" name="name" required />
  </label>
  <label>
    Email
    <input type="email" name="email" required />
  </label>
  <label>
    Message
    <textarea name="message" required placeholder="How can we help?"></textarea>
  </label>
  <!-- honeypot: bots fill this, humans don't see it -->
  <input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off" />
  <button type="submit">Send</button>
</form>

<script>
const form = document.getElementById("contact-form");
form.addEventListener("submit", async (e) => {
  e.preventDefault();
  const res = await fetch("https://formloom.vercel.app/api/submit/YOUR_ACCESS_KEY", {
    method: "POST",
    headers: { "Content-Type": "application/json", Accept: "application/json" },
    body: JSON.stringify(Object.fromEntries(new FormData(form))),
  });
  const data = await res.json();
  if (data.success) {
    form.reset();
    alert("Thanks — we got your message.");
  } else {
    alert(data.message || "Something went wrong.");
  }
});
</script>

@formloom/client (typed SDK)

submit.ts

// npm i @formloom/client
import { createForm } from "@formloom/client";

type Contact = {
  name: string;
  email: string;
  message: string;
};

const form = createForm<Contact>("YOUR_ACCESS_KEY");

// End-to-end typed: TS errors if you send the wrong shape.
const { success, message } = await form.submit({
  name: form.name.value,
  email: form.email.value,
  message: form.message.value,
});

Gotchas

If you POST directly to FormLoom from Blade, you don't need Laravel's CSRF token (it's a cross-origin POST to FormLoom).
To keep CSRF and validation in Laravel, submit to your own route and forward to FormLoom with `Http::post()`.

Form types for Laravel

Tailored field sets and code for common use cases.

Laravel contact form Laravel newsletter form Laravel waitlist form Laravel feedback form Laravel support ticket form Laravel lead capture form Laravel rsvp form Laravel job application form Laravel survey form Laravel bug report form

FAQ

To skip building submission storage, spam scoring, a dashboard, and deliverable email. FormLoom handles the contact-form plumbing so you don't maintain it.