Development and production forms
Set up separate Qubeforms endpoints for development and production. Configure origins, test email and webhook delivery, review launch settings, and retire old forms.
1. Create a distinct test form
Use names such as Contact — staging and Contact — production so the endpoint and inbox are easy to identify. Create each through Forms and configure it separately. There is no automatic clone or promotion workflow in the customer dashboard. Both forms use the owner’s plan and share monthly accepted-submission usage.
2. Use the correct endpoint and origin
Configure the public endpoint for each website environment and verify the actual URL in the browser’s Network panel after deployment. Public keys can be included in browser configuration; read keys and webhook secrets cannot. Add exact origins such as http://localhost:5173 only to the form that needs them. A wildcard subdomain origin does not include the bare domain. Serve local HTML over HTTP rather than using a file URL.
3. Keep test deliveries contained
Use a verified test recipient and, if enabled, a test webhook destination. Submit only visitor email addresses you control when testing autoresponders. Record the expected Reply-To name, honeypot name, CAPTCHA provider, redirects, and relevant routing rules. Test data is subject to the same retention and protection as other submissions.
4. Review the production configuration
Before switching the website endpoint, make the production form Active, allow its real origin, verify production recipients, and configure the desired redirect allowlist. Recheck Reply-To, spam controls, CAPTCHA widget keys, webhook destinations and secrets, templates, and team access where applicable. Save each relevant panel and send one non-sensitive test from the deployed page. A working staging form does not validate these independent production settings.
5. Retire or roll back an integration
If you need to roll back a website deployment, confirm its previous endpoint is still Active and permits the site before restoring it. When an old form is no longer used, export needed records and set its Status to Paused or Archived. Its public requests then return 404; existing records continue toward retention expiry. Archiving a form does not cancel billing. Review the deployed page to make sure it no longer posts there.
Public form keys can appear in browser code. Read keys, management credentials, and webhook signing secrets must stay on the server.