Form2Workflow
Sign in

Reference

View as Markdown All docs in one file

Best practices

Guidance for secure, reliable forms and workflows — and for working with AI agents.

Security#

  • Protect every webhook with a secret header (Header Auth in n8n). Webhook URLs aren't shown to browsers, but they can leak through logs and screenshots.
  • Validate in n8n. required is enforced by the browser only. Check required values, formats and allowed options in your workflow before acting on them.
  • Trust identity from endUser, not form fields. On protected forms, form2wf tells you who signed in; an email typed into a field proves nothing.
  • Scope API keys tightly — viewer for reporting, one key per agent, revoke unused keys.
  • Treat submitted text as untrusted when inserting it into HTML emails, SQL or AI prompts.

Reliability#

  • Make workflows idempotent. A slow workflow can receive the same submission twice because of retries. Deduplicate on a key such as form id + timestamp + email before side effects (recipe).
  • Reply fast. Respond to the webhook first and do slow work (AI calls, large uploads) afterwards, well inside 30 seconds.
  • Use production webhook URLs and keep workflows active; test URLs stop working when the n8n editor closes.
  • Watch for failures — a scheduled n8n agent or a quick question to your MCP-connected assistant (“any failed submissions today?”) catches broken workflows before customers do.

Form design#

  • Give every field an id and never reuse names within a level.
  • Keep slugs stable once a form is embedded; rename the display name instead.
  • Deactivate instead of deleting — is_active: false keeps history and can be undone.
  • Prefer several small forms linked with navigation over one huge form; each gets its own webhook and is easier to change.
  • Handle missing checkboxes — unchecked means absent, not false.
  • Keep file forms flat — don't combine file with object/array fields.
  • Pass values forward explicitly between forms via params and defaultValue templates.

Working with AI agents#

  • Install the Claude Code skill so the agent follows the read-modify-write sequence for config.
  • Ask the agent to show you the planned config before creating large forms.
  • Approve destructive tools (delete_form, set_form_access) deliberately.
  • Let agents verify their work: after you submit a test, “check list_submissions for the last delivery”.

Performance#

  • Keep onload responses small — return only the fields and rows the page shows.
  • Load f2wf.js once per page even with several forms.
  • Cache slow lookups in n8n (e.g. a Redis or data-table node) for onload webhooks called on every page view.