# Best practices

Guidance for secure, reliable forms and workflows — and for working with AI agents.

## Security

-   **Protect every webhook with a secret header** (Header Auth in n8n). Webhook URLs aren't shown to browsers, but they can leak through logs and screenshots.
-   **Validate in n8n.** `required` is enforced by the browser only. Check required values, formats and allowed options in your workflow before acting on them.
-   **Trust identity from `endUser`, not form fields.** On protected forms, form2wf tells you who signed in; an email typed into a field proves nothing.
-   **Scope API keys tightly** — viewer for reporting, one key per agent, revoke unused keys.
-   **Treat submitted text as untrusted** when inserting it into HTML emails, SQL or AI prompts.

## Reliability

-   **Make workflows idempotent.** A slow workflow can receive the same submission twice because of retries. Deduplicate on a key such as form id + timestamp + email before side effects ([recipe](https://form2wf.com/docs/n8n-recipes#idempotency)).
-   **Reply fast.** Respond to the webhook first and do slow work (AI calls, large uploads) afterwards, well inside 30 seconds.
-   **Use production webhook URLs** and keep workflows active; test URLs stop working when the n8n editor closes.
-   **Watch for failures** — a scheduled n8n agent or a quick question to your MCP-connected assistant (“any failed submissions today?”) catches broken workflows before customers do.

## Form design

-   **Give every field an `id`** and never reuse `name`s within a level.
-   **Keep slugs stable** once a form is embedded; rename the display name instead.
-   **Deactivate instead of deleting** — `is_active: false` keeps history and can be undone.
-   **Prefer several small forms** linked with navigation over one huge form; each gets its own webhook and is easier to change.
-   **Handle missing checkboxes** — unchecked means absent, not `false`.
-   **Keep file forms flat** — don't combine `file` with `object`/`array` fields.
-   **Pass values forward explicitly** between forms via params and `defaultValue` templates.

## Working with AI agents

-   Install the [Claude Code skill](https://form2wf.com/docs/claude-skill) so the agent follows the read-modify-write sequence for `config`.
-   Ask the agent to show you the planned `config` before creating large forms.
-   Approve destructive tools (`delete_form`, `set_form_access`) deliberately.
-   Let agents verify their work: after you submit a test, “check `list_submissions` for the last delivery”.

## Performance

-   Keep onload responses small — return only the fields and rows the page shows.
-   Load `f2wf.js` once per page even with several forms.
-   Cache slow lookups in n8n (e.g. a Redis or data-table node) for onload webhooks called on every page view.

---
Source: https://form2wf.com/docs/best-practices — Form2Workflow documentation (Reference)