---
title: "AI builders and coding agents"
description: "Paste one block of instructions into Lovable, Bolt, v0, Replit, Cursor, Claude Code or Codex, and it adds a form that posts to FormParcel from the browser."
url: "https://formparcel.live/docs/guides/ai"
---

# AI builders and coding agents

Paste one block of instructions into Lovable, Bolt, v0, Replit, Cursor, Claude Code or Codex, and it adds a form that posts to FormParcel from the browser.

Untested: Not yet tested on a live site. The steps follow how the form address works today; if one differs, [tell us](https://formparcel.live/contact).

## Copy the instructions

Copy your form address from the dashboard first. Then copy this block and replace `<your-form-id>` with the ID at the end of your address.

```text title="Instructions for your AI"
Add a working contact form to this site using FormParcel (a form backend).
Do not build a backend, database table, API route or server function for it, and never
send the form from a server: FormParcel takes it only from the visitor's browser.

Form address (POST): https://f.formparcel.live/f/<your-form-id>
  Replace <your-form-id> with the ID from the FormParcel dashboard, or ask me for it.
Bot-check script:    https://f.formparcel.live/f/formparcel.js
Allowed origins: if the form lists them, posts from any other host get 403, so first tell me to add
your preview or staging host (Lovable, Bolt, v0, Replit) under Allowed origins on the form's Spam tab.

1. Fields: keep the page's own fields, or use name, email and message. Every input needs a
   plain name attribute (it becomes the column and the email label). Up to 50 fields, names up to
   64 characters, values up to 4,096 characters. No file inputs. Do not start names with "_" (reserved).
   Never collect passwords, one-time codes or card numbers: they are refused.
2. Spam trap: put this inside the form, exactly as written, and keep it empty and hidden:
   <div aria-hidden="true" style="position:absolute;left:-10000px"><input type="text" name="_gotcha" tabindex="-1" autocomplete="off"></div>
3. Bot check: load this once on every page that has the form. Without it, leads wait in the
   owner's Spam folder and are not delivered: <script src="https://f.formparcel.live/f/formparcel.js" async></script>
4a. Plain HTML form: copy this tag exactly (its onsubmit waits for the script, which adds its proof):
    <form action="https://f.formparcel.live/f/<your-form-id>" method="POST" onsubmit="if(!window.FormParcel){event.preventDefault();var f=this;f.setAttribute('data-fp-wait','1');setTimeout(function(){if(f.getAttribute('data-fp-wait')){f.removeAttribute('data-fp-wait');HTMLFormElement.prototype.submit.call(f)}},10000)}">
    For a thank-you page, add inside the form: <input type="hidden" name="_next" value="https://<this site>/thanks">
    The page must be on this site's own domain.
4b. JavaScript form (React, Next.js, Vue): on submit, prevent the default, wait for the script
    (it may still be loading on a slow phone), get one proof per send, then POST:
    const fp = window.FormParcel || await new Promise((ok) => { addEventListener("formparcel:ready", () => ok(window.FormParcel), { once: true }); setTimeout(ok, 10000); });
    const _fp_proof = await fp?.proof("https://f.formparcel.live/f/<your-form-id>").catch(() => undefined);
    TypeScript: declare global { interface Window { FormParcel?: { proof(endpoint: string): Promise<string> } } }
    POST JSON {...fields, _fp_proof} with headers Content-Type: application/json and Accept: application/json.
    Show success only when the reply is 200 and accepted === true. 204 means the spam trap was filled:
    show nothing. On 4xx, show the reply's "error" field. Never resend a lead whose reply said
    deliveryStatus "pending": it is stored and on its way.
5. If the site sets a Content-Security-Policy, allow https://f.formparcel.live in script-src and connect-src.

Testing: never test with curl, a script or from a server: those posts have no bot check, so they
go to Spam. Repeated sends from one browser within 24 hours are held in Spam too. When the form
is live, tell me to press "Send a test lead" in the FormParcel dashboard, then to send the form once
from the live page. A real lead held in Spam is released with Not spam.
Docs: guide https://formparcel.live/docs/guides/ai.md · for agents https://formparcel.live/llms.txt
```

## Paste them into your builder

| Builder | Where | Watch for |
| --- | --- | --- |
| Lovable, Bolt, v0, Replit | The chat, as one message. | These builders like to add their own backend: a database table, an Edge Function or an API route. The instructions forbid it. If it adds one anyway, ask it to remove it and post from the browser. |
| Cursor, Claude Code, Codex | The chat or a task, in the repository of the site. | Agents test their work with `curl`. That post has no bot-check proof and lands in Spam, so its 200 answer proves nothing. They can also read [llms.txt](https://formparcel.live/llms.txt) and the Markdown copy of any page. |

## Check what it built

- The form’s `action`, or the `fetch` call, uses your form address.
- The page loads the bot check script, and a `fetch` sends the proof as `_fp_proof`.
- The hidden `_gotcha` field is there and stays empty.
- Nothing posts the form from a server.

> **Bot check.** A lead sent without FormParcel's bot check is saved but held in your Spam folder, not delivered. That is every post from a server, a webhook or `curl`, and every post from a page that does not load the script. The dashboard then shows **Bot check not installed** under Needs action. Fix: load the script on the page and send the proof from `FormParcel.proof()` with each `fetch`. [Learn more](https://formparcel.live/docs/reference/bot-check)

## Send a real lead

Use **Send a test lead** in the dashboard to check delivery. Then publish the site, submit the form once from the live page, and open the lead under **Leads**. If it is in **Spam**, open it and read the reason:

- **Sent without FormParcel's bot check (formparcel.js)** means the page did not send the proof. See [Bot check](https://formparcel.live/docs/reference/bot-check#fix-it).
- A third send from one browser to the form in 24 hours is held as a repeat sender, even with the proof. Testing again and again from your own browser ends up there, so test with **Send a test lead** and release a real lead with **Not spam**.
- A builder’s preview or staging address gets [origin not allowed](https://formparcel.live/docs/reference/responses#origin-not-allowed) when the form lists allowed origins. Add that host to the list on the form, or post from the live site.