Reliable form backend without SMTP headaches.
Connect your HTML, React, Next.js, Astro, or custom forms directly to a Lugatu endpoint. Anti-spam honeypot filtering, central inbox management, and notification delivery work out of the box with zero server configuration.
Zero Server & Zero SMTP
Never expose SMTP credentials or email passwords in frontend code. Avoid delivery failure and spam blacklists effortlessly.
Smart Honeypot & Rate Limiting
Frictionless anti-spam defense. Block automated spam bots silently without annoying your genuine visitors with difficult puzzles.
Centralized Durable Inbox
Every response is safely stored in your workspace PostgreSQL inbox. Messages are never discarded even if outbound email limits are reached.
1. Why Developers Eliminate SMTP for Web Forms
Traditional web forms relying on SMTP or PHP mail() suffer from high failure rates, exposed credentials in client bundles, and port blocks on modern serverless hosts. Lugatu replaces fragile mail servers with a resilient, transactional HTTPS form ingestion pipeline backed by PostgreSQL.
Lugatu handles SPF, DKIM, DMARC, and ISP rate limits on your behalf. Submissions are persisted before notifications are dispatched, ensuring zero lost inquiries.
2. Client-Side Browser Form Ingestion
For client-side forms on static sites, submit inquiries as JSON directly to your public form endpoint. Include an invisible honeypot field to block automated spam without user-facing CAPTCHAs.
<form id="contact-form">
<input type="text" name="name" placeholder="Your Name" required />
<input type="email" name="email" placeholder="you@domain.com" required />
<textarea name="message" placeholder="How can we help?" required></textarea>
<!-- Invisible Honeypot Field (Bots fill this; real users ignore it) -->
<input type="text" name="_gotcha" style="display:none !important" tabindex="-1" autocomplete="off" />
<button type="submit">Send Message</button>
</form>
<script>
document.getElementById('contact-form').addEventListener('submit', async (e) => {
e.preventDefault();
const form = e.target;
const formData = new FormData(form);
const payload = {
fields: {
name: formData.get('name'),
email: formData.get('email'),
message: formData.get('message')
},
honeypot: formData.get('_gotcha') || ''
};
const response = await fetch('https://www.lugatu.com/api/v1/public/forms/YOUR_PUBLIC_FORM_ID/submissions', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Accept': 'application/json'
},
body: JSON.stringify(payload)
});
if (response.ok) {
alert('Thank you! Your message was received.');
form.reset();
}
});
</script>3. Server-to-Server Programmatic Submissions
For backend applications, microservices, and server-rendered frameworks, Lugatu provides an authorized programmatic submission endpoint authenticated with your workspace live API key.
curl -X POST "https://www.lugatu.com/api/v1/forms/YOUR_FORM_GUID/submissions" \
-H "Authorization: Bearer lug_live_your_secret_api_key" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $(uuidgen)" \
-d '{
"fields": {
"name": "Alex Taylor",
"email": "alex@studio.design",
"message": "Project consultation request from custom backend service."
}
}'Architectural Security & Key Invariant
API Security Policy: Lugatu live API keys (lug_live_...) are strictly server-to-server credentials. Never embed API keys in client-side HTML, mobile bundles, or frontend scripts. For client-side forms, always use the public form endpoint (POST /api/v1/public/forms/{publicFormId}/submissions).
Troubleshooting & Common Ingestion Errors
Ensure the origin domain submitting the form is listed under your designated Website in the Lugatu dashboard. Lugatu enforces origin validation to prevent unauthorized form hijacking.
Verify your JSON payload structure. Inquiries must wrap form inputs inside a top-level "fields" object: {"fields": {"name": "...", "email": "..."}}.
Frequently Asked Questions
Do I need an SMTP server or email provider to use Lugatu?
No. Lugatu handles all email delivery, quota management, and SPF/DKIM verification out of the box using high-reputation transactional delivery infrastructure.
What happens if my monthly notification quota is reached?
Your submissions are never lost. All incoming inquiries remain securely preserved in your dashboard inbox, and you can upgrade or review them anytime.
Ready to streamline your form backend?
Deploy your first endpoint in under two minutes. Free tier included.