Formlyx Forms

Description

Formlyx is a hosted form service from RazorSoft, Inc. Forms and submissions stay at formlyx.com. This plugin connects a site to that account and embeds published forms.

Video Walkthrough

Product documentation is also on the Formlyx WordPress page.

Open Settings → Formlyx and choose Connect to Formlyx. You can sign in or create a Formlyx account on Formlyx’s site, including email verification, and then approve access. WordPress does not ask for an API key or your Formlyx password.

The site needs HTTPS. HTTP works only on localhost. The connection can be checked, reconnected, or disconnected from the same settings page. Disconnect removes the connection stored in WordPress and asks Formlyx to revoke it. It does not delete hosted forms, submissions, or the Formlyx account.

In the block editor, insert the Formlyx Form block and choose a published form, or enter its form ID. A public form can be embedded by ID without connecting the site. The form picker needs the connection.

The shortcode is [formlyx id="FORM_ID"]. An optional theme attribute accepts auto, light, dark, inherit, unstyled, or match. match is Match WordPress Theme. It styles the hosted form from this site’s active theme and does not change the appearance saved in Formlyx.

A page can contain more than one form. Published pages load https://www.formlyx.com/embed.js once. That script displays the form and sends the submission to Formlyx. It does not receive this site’s connection tokens.

When a Formlyx form includes file-upload fields, visitors upload those files through Formlyx’s hosted embed. Upload progress, validation, malware scanning, and storage are handled by Formlyx. WordPress does not store the uploaded files.

The editor shows the selected form’s name and ID. The live form appears on the published page. The form picker lists at most 100 published forms. An administrator can still enter a public form ID that is not in that list.

External services

This plugin connects to Formlyx, operated by RazorSoft, Inc.

• https://api.formlyx.com is used only on the server, and only after an administrator connects the site. WordPress sends the OAuth authorization code, the refresh token, and the client id to obtain and renew access. It sends the access token to read the workspace name and the list of forms, and to approve this site as an embed origin. The response is limited to 1 MB. Tokens stay in WordPress options and are not sent to visitors.
• https://www.formlyx.com/embed.js is loaded by a visitor’s browser when a page contains a Formlyx form. The script is served by Formlyx and is not bundled with this plugin, because Formlyx renders the form and receives the submission. The script sends the form entry to Formlyx. It does not receive this site’s OAuth tokens.
• When a form includes file fields, the visitor’s browser uploads file bytes to Formlyx endpoints under https://api.formlyx.com (public embed upload routes). Formlyx scans and stores those files in its private object storage. WordPress does not receive the file bytes.
• Connecting the site sends the administrator’s browser to https://api.formlyx.com to sign in or create an account and approve access. The site must use HTTPS, except for localhost.

Terms: https://www.formlyx.com/terms

Privacy policy: https://www.formlyx.com/privacy

Settings → Privacy includes suggested text for this site’s privacy policy. It covers the stored connection tokens, embedded form submissions, and uploaded files handled by Formlyx.

Development

Readable Gutenberg block source is included under src/. The compiled assets WordPress loads are under build/. Product documentation and walkthrough: https://www.formlyx.com/wordpress