How to safely publish form responses on your website
A common request: “I want to show a list of registrants on our site” or “I need responses inside my own admin”. The REST API does that — and the difference between a safe and an unsafe implementation is one thing: where the API key lives.
The basic rule
The API key belongs on your server, never in browser JavaScript. Put the key in front-end code and anyone can read it from the page source — and download every response from every one of your forms, not just the ones you meant to show.
The correct flow is: the browser asks your server → your server asks Gatherino with the key → your server returns only the fields that are meant to be public.
The server part
Fetching responses on your backend (Node.js):
const res = await fetch(
`https://gatherino.com/api/v1/submissions?formId=${FORM_ID}&limit=100`,
{ headers: { Authorization: `Bearer ${process.env.GATHERINO_KEY}` } }
);
const { items, total, totalPages } = await res.json();
// Publish selected fields only — never the whole data object
const publicList = items.map((s) => ({
name: s.data[FIELD_NAME_ID],
city: s.data[FIELD_CITY_ID],
}));The steps
- 1
Create an API key
In Settings → API keys. It is shown once, so store it in a server-side environment variable.
- 2
Find the field IDs
The form detail endpoint returns each field’s ID and label. Keep the mapping — IDs are stable.
- 3
Handle pagination
One request returns at most 100 responses. Walk further pages using totalPages.
- 4
Add caching
Do not call the API on every page load. Caching for a few minutes is plenty and saves you effort too.
- 5
Filter what you publish
Pick specific fields. Never ship the whole response object to the browser.
Personal data: a list of names on a public website is a publication of personal data. Make sure you have a legal basis, or publish only details respondents expect to be public (for example names on a start list they knew about in advance).
FAQ
Can I call the API straight from the browser?
Not with your API key — it would be public. Always go through your own server.
Why are data keys like field_1778…?
Those are the form’s field IDs. Fetch their labels from the form detail.
How often should I fetch?
As needed — for a registrant list every few minutes is plenty. For instant reactions use a webhook.
Does the API handle diacritics?
Yes, everything is UTF-8.
Related
Try Gatherino for free
Free plan: 3 forms and 100 responses a month. No credit card, EU-hosted data.
Get started free →