---
title: Public endpoints
description: "The published form boundary and the Meta webhook: what they are, why they take no token, and why neither is the interface you build on."
---

Two groups of endpoints answer requests that carry no token. Neither is part of this API: they take no scope, and an access token buys you nothing on either. They are described because you will see them in traffic and should know what they are.

## The form boundary

```
GET  /api/public/forms/{key}
POST /api/public/forms/{key}
GET  /embed.js
GET  /f/{key}/qr
```

These serve a workspace's own published forms to its own visitors. A form resolves its workspace from the key in the path — an unguessable value the workspace issues — rather than from a session or a token, which a visitor does not have.

**Every refusal answers the same `404`.** A key that never existed, a form that is unpublished, a workspace whose marketing module is off: all `404`, deliberately indistinguishable, so the keyspace cannot be probed. Do not read a `404` here as "no such form".

A post is bounded by the form's own limits once the form is resolved, not by the 1 MB that applies elsewhere, and these routes answer CORS themselves — without credentials, per form — because they are posted to from the workspace's own pages rather than from this application's origin.

This is not an API for building on. If you want to create submissions programmatically, use the records endpoints with a token.

## The Meta webhook

```
GET  /api/public/meta/webhook
POST /api/public/meta/webhook
```

`GET` answers Meta's verification challenge. `POST` receives lead delivery.

The workspace is determined by the **signature**, not by anything in the path or body: the request carries `X-Hub-Signature-256`, an HMAC-SHA256 over the exact bytes of the body, and the page a lead names identifies the workspace that registered it. A request whose signature does not verify is refused.

Inbound only. There is nothing to call here, and nothing you can do with these endpoints from a client.

## What this means for you

If you are integrating with Taylorz CRM, the two groups above are not your interface. Yours is `/api/v1` with a bearer token, described in the [API reference](/), and MCP if you need tools rather than resources.