Connect your website to CRM
Create the keys and inquiry types your website forms need.
Connect your website to CRM
Your website can send its contact, booking, and enquiry forms straight into your Workspace CRM inbox. Each submission becomes an inquiry you and your Managers can read, assign, and reply to in Backoffice.
Setting this up takes two parts: you create a key in Backoffice, then whoever builds your website uses that key when the form is submitted.
Before you start
CRM must be enabled for your Workspace. Check Settings then Capabilities. If
CRM is off, the inquiry intake settings are hidden and submissions are rejected.
Only an Owner can create or delete keys. Managers can see the keys that exist but cannot change them.
Step 1: Choose the kind of key
There are two kinds, and which one you need depends on how your website submits the form.
| Key | Use it when | Safe in a browser |
|---|---|---|
| Browser form key | The form is submitted by JavaScript in the visitor's browser. | Yes |
| Server API key | Your website's own server submits the form. | No |
If you are unsure, ask whoever built your website. Most website contact forms that post directly from the page need a browser form key. Sites built on WordPress, Next.js, or a similar framework often submit through their own server and need a server API key.
Step 2: Create the key
Browser form key
Go to Settings then Browser form keys and choose Create browser form key.
Give it a name you will recognise later, such as the website it belongs to. Then
list the allowed origins: the addresses your form is allowed to submit from, one
per line, such as https://hotel.example.com. Submissions from anywhere else are
rejected.
The key is shown in the list afterwards and can be copied at any time. It is designed to be public, so it is safe to put in your website's code.
Server API key
Go to Settings then Server API keys and choose Create server API key.
Give it a name, then copy the secret. It is shown once and never again, because we only keep a scrambled copy. Store it wherever your website keeps its other secrets. If you lose it, delete the key and create a new one.
Never put a server API key in a web page or anywhere a visitor could read it.
Step 3: Set up your inquiry types
Inquiry types are the categories your inquiries are sorted into, such as Rooms,
Events, or General. Manage them in Settings then Inquiry types.
Every Workspace starts with a General type, which is used when a submission
does not say which type it is. Create a type for each kind of form on your
website so inquiries arrive already sorted.
Each type has a slug, shown next to its name. Your website sends that slug with the submission, so give the slug to whoever builds the form.
Step 4: Send the key to whoever builds your website
Give them the key, the inquiry type slugs, and a link to
Send website inquiries to CRM, which describes exactly what the form should
send.
Once the first submission arrives you will see it in CRM under Inquiries.
Keeping your keys safe
Delete a key when the website using it is retired, when a secret may have been seen by someone who should not have it, or when you no longer want that form sending inquiries. Deleting takes effect immediately: submissions using that key start failing right away, so replace the key on your website first if the form is still in use.
Keep one key per website or per form rather than sharing a single key everywhere. That way you can retire one without breaking the others.