Frequently Asked Questions
Straight answers about how RG Forms works — verification warnings, email limits, spam protection, and who owns your data. For the full walkthrough, see how it works.
What is RG Forms?
RG Forms creates a live contact form endpoint backed entirely by your own Google account. It provisions a Google Sheet, a Drive folder, and a Google Apps Script web app in about 90 seconds — then your website POSTs submissions straight to that endpoint. There is no RG Forms server involved: submissions go from your visitor directly to your own Apps Script and land in your own Sheet.
Is RG Forms really free? What’s the catch?
Yes — completely free and open source, with no paid tier. There is no catch because there is nothing for us to host: RG Forms is a static site that sets things up inside your Google account, and Google hosts your Sheet and Apps Script endpoint for free. Your endpoint keeps working even if rgforms.com disappears.
Why does Google say “This app isn’t verified” when I authorize my script?
The “app” in that warning is your own Apps Script — the form handler RG Forms just created inside your Google account — not RG Forms itself. Google shows this screen for any script that requests sensitive permissions (sending email, contacting an external service) and hasn't gone through Google's app-verification program. A personal script created minutes ago is naturally unverified, so the warning is expected. It is safe to proceed because you are granting your own script access to your own account, and you can read its code in the Apps Script editor. Click Advanced, then Go to <project name> (unsafe), then Allow.
Why do I have to authorize the script at all?
Google requires a one-time manual authorization for any Apps Script that was deployed programmatically. RG Forms cannot grant permissions on your behalf — only you, the account owner, can click Allow. Open your endpoint URL once in your browser while signed in to Google and approve the dialog. The script only asks for access to its one spreadsheet, plus email sending and/or external requests if you enabled those features.
Setup failed saying Apps Script access needs to be enabled. What do I do?
Google requires you to opt in to the Apps Script API once per account before scripts can be created programmatically. Open script.google.com/home/usersettings, turn on “Google Apps Script API”, then return to RG Forms and retry. It takes a few seconds and never needs to be done again.
How do email notifications work, and how many emails can I send?
When enabled, your Apps Script emails every submission to your notification address from your own Google account, with optional CC, BCC, custom subject, sender name, and a reply-to mapped to the visitor's email field. Google caps Apps Script email at roughly 100 recipients per day on a free Gmail account and about 1,500 per day on a paid Google Workspace account. If the cap is hit, rows still get saved to your Sheet — only the notification is skipped.
Should I enable email notifications and spam protection when creating the project?
Yes, if there's any chance you'll want them. Both can be added later, but adding them after creation redeploys the script with a new permission and requires re-authorizing it. Enabling at creation costs nothing: notifications only fire if an address is set, and Turnstile validation stays off until you switch it on from the dashboard.
Why must I POST with Content-Type: text/plain instead of application/json?
Sending application/json triggers a CORS preflight (an OPTIONS request), and Apps Script web apps cannot answer OPTIONS, so the browser blocks the request. text/plain is a “simple” content type that skips the preflight. Your body is still a JSON string — the script parses it normally.
Can I add forms or edit fields later without breaking my endpoint?
Yes. Your script reads its configuration from a hidden _manifest tab in your Sheet on every request, so adding forms, editing fields, changing the notification address, or toggling spam protection takes effect immediately — no redeploy, and your endpoint URL never changes. Only adding a new permission (email or Turnstile capability) touches the deployment, and even that keeps the same URL.
How does spam protection work?
Two layers. A honeypot: a hidden _hp field that humans leave empty and bots fill in — the script silently discards those submissions while returning a fake success, so bots can't tell they were caught. And optionally Cloudflare Turnstile: you add the widget to your form, and the script verifies its token server-side with Cloudflare before saving anything. Turnstile validation is toggled from the dashboard and takes effect instantly.
Can RG Forms see my submissions or my Google Drive?
No. RG Forms has no server and no database — your OAuth token lives only in your browser's memory during setup, and the drive.file permission only covers files the app itself created. Submissions travel from your visitor's browser directly to your Apps Script endpoint and into your Sheet; they never pass through anything RG Forms operates.
Can an AI assistant wire up my form for me?
Yes. The dashboard exports RGFORMS.md — a skill file containing your endpoint URL, every form's exact field keys, and the calling conventions — that you can drop into any project for Claude Code, Cursor, Copilot, Windsurf, or any other AI IDE. There's also a machine-readable overview of the whole product at rgforms.com/llms.txt.