Authoritative features, clear operational boundaries.
Lugatu is engineered around truthful operational boundaries: zero outbound SMTP configuration, durable database persistence before notifications, and transparent quota accounting. Review our verified feature sets, system limits, and architectural invariants below.
1. Form Ingestion & Publishing Architecture
Lugatu supports three distinct ingestion models designed to balance rapid deployment with enterprise security: (1) Domainless Independent Hosted Forms with clean public permalinks (https://www.lugatu.com/f/{slug}) requiring zero domain setup; (2) Client-Side Static Form Endpoints for HTML5, React, Next.js, and Astro; and (3) Server-to-Server Ingestion REST API authenticated via private API keys (POST /api/v1/forms/{formId}/submissions).
Every form supports instant mode toggling between Standard Inquiry Mode and Survey Mode with multi-step pagination, custom completion redirects, and automated waitlist capacity controls.
curl -X POST https://www.lugatu.com/api/v1/forms/FORM_ID/submissions \
-H "Authorization: Bearer lug_live_01923456789abcdef0123456789abcde" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: lug_idem_01923456789a7b3fb3a1123456789abc" \
-d '{"fields":{"name":"Alex Morgan","email":"alex@example.com","message":"Technical inquiry"}}'2. Quota Architecture & Email Notification Limits
Notification delivery is strictly opt-in per form (OFF, INSTANT, DAILY_SUMMARY, WEEKLY_SUMMARY). Each independently verified root domain (eTLD+1) receives 500 outbound email deliveries per UTC calendar month, shared across all subdomains, with up to 2 verified destination mailboxes. Unlike legacy form services that discard leads upon reaching email limits, Lugatu atomically commits every legitimate response to PostgreSQL: quota exhaustion flags notifications as SuppressedByQuota while safely preserving the inquiry in the central Inbox.
To maintain platform reputation and prevent spam abuse, standalone domainless forms store submissions directly in your dashboard inbox without outbound email dispatch until an authenticated custom root domain is connected.
3. Data Persistence, Concurrency & Export Capacities
There are no artificial monthly response count caps on legitimate ordinary form or survey submissions during public beta. Inbound submissions undergo transactional atomic persistence with duplicate prevention via client or server idempotency keys (lug_idem_...). Workspace members can export filtered submissions to UTF-8 CSV or JSON at any time. Field values support up to 64 KB per individual field, with total request bodies bounded to 1 MB at the API gateway.
Idempotency keys eliminate duplicate records caused by mobile network retries: re-submitting with the identical key returns HTTP 200 OK with isDuplicate: true and the original submission ID without double-incrementing counters.
4. Security Architecture, Honeypots & Origin Verification
Lugatu enforces multi-layered abuse defense: (1) Smart invisible honeypot fields that intercept automated form scrapers without user CAPTCHAs; (2) Cloudflare Turnstile bot verification for high-risk public forms; (3) Strict browser Origin checks that reject server-to-server API keys (lug_live_...) with HTTP 403 FORBIDDEN_BROWSER_ORIGIN; and (4) Rate-limiting per client IP and submission endpoint.
5. Authentication, Nonces & Privacy Commitments
Users authenticate via verified email and password or Google Identity Services (GIS). Lugatu stores only the stable Google subject identifier (sub), verified email, and profile name. Raw OAuth access tokens and external passwords are never requested or stored. OAuth state nonces expire after 5 minutes and are strictly single-use. Lugatu operates under verified zero-sale and zero-advertising privacy commitments: form submitter data is never profiled, sold, or repurposed.
Security & Authentication Invariant
Technical Invariant: Server-to-server API keys (lug_live_...) must never be embedded in client-side HTML, JavaScript, or public repositories. Browser requests containing live keys are blocked automatically.
Troubleshooting & Common Ingestion Errors
Your verified root domain has dispatched all 500 monthly email units. Inquiries are safely stored in your dashboard Inbox and notifications resume upon the next UTC calendar month.
A private API key (lug_live_...) was submitted from a public browser origin. Use the public client endpoint (/api/v1/public/forms/...) or proxy submissions through your backend server.
Standalone domainless forms capture submissions directly into your dashboard inbox without external email delivery. Add and verify a custom root domain to enable outbound email alerts.
The submission contained an Idempotency-Key matching an existing record. Lugatu safely returned the original submission ID with isDuplicate: true without creating duplicates.
Frequently Asked Questions
What happens when my 500 monthly email limit is reached?
Lugatu never deletes or drops your submissions. Every inquiry remains searchable and accessible in your inbox. Only email dispatches are temporarily paused until the next calendar month.
Can I use Lugatu without owning a website or custom domain?
Yes. Domainless hosted forms (https://www.lugatu.com/f/{slug}) let you share responsive forms or surveys instantly via direct link, social bio, or QR code with full dashboard inbox persistence.
Are there monthly response count caps?
No commercial monthly response count caps are imposed during the public beta for legitimate ordinary form and survey usage.
How does root domain quota sharing work?
When you verify example.com, all subdomains (app.example.com, shop.example.com) and associated forms share the single 500 email monthly allowance, with up to two verified destination addresses.
Ready to create your form endpoint?
Get started for free in seconds. No credit card required.