Configure and monitor Pro integrations

Review the shipped Pro integrations

Drecha Forms Pro currently includes:

• Google Sheets with OAuth and mapped row appends.
• Slack with OAuth and channel messages.
• Discord webhook messages with an optional bounded field embed.
• Zapier Catch Hook delivery.
• Make custom webhook delivery.
• Signed HTTPS webhooks using HMAC-SHA256.
• Mapped outbound REST using POST, PUT, or PATCH.
• A read-only external REST API with scoped Bearer tokens.

These are the implemented Pro capabilities. Payment fields, PDF generation, user registration, post creation, partial-entry recovery, save-and-resume, advanced analytics, and custom themes are not currently shipped.

Create a per-form integration

1. Confirm that Free and Pro are active and that Pro access is valid.
2. Open Drecha Forms > Integrations.
3. Connect Google Sheets or Slack through its OAuth card when using those providers. Save the registered Client ID and Client secret, select Connect, and approve only the displayed provider scopes.
4. Under Add an integration, choose the Form and Provider.
5. Enter a descriptive Name.
6. Complete the provider-specific destination fields.
7. Add a Field mapping JSON object when the provider supports mapping.
8. Optionally add a simple Run when field and Equals value, or a valid Advanced conditions JSON object.
9. Keep Activate this integration selected and choose Save integration.
10. Find it under Saved integrations and select Send test.

Mappings use paths such as {{responses.email}}, {{form.title}}, and {{entry.uuid}}. A simple mapping is:

{"email":"{{responses.email}}","reference":"{{entry.uuid}}"}

Mappings and custom headers must be JSON objects, not JSON lists. Unknown paths resolve to an empty value. Secrets, bearer tokens, basic passwords, OAuth credentials, destination URLs stored as credentials, and signing secrets are encrypted at rest.

Configure the destination safely

Provider-specific rules include:

• Google Sheets requires a spreadsheet and worksheet. Column A is reserved for an entry idempotency marker, which prevents the same entry from being appended twice.
• Slack requires a connected app and selected public or private channel.
• Discord accepts only Discord webhook hosts and a valid webhook path.
• Zapier accepts only hooks.zapier.com Catch Hook URLs.
• Make accepts its supported make.com or legacy integromat.com hook hosts.
• Signed webhooks require a secret of at least 16 characters and send event, idempotency, and sha256= signature headers.
• Outbound REST supports public HTTPS destinations, POST, PUT, or PATCH, a timeout from 3 through 30 seconds, controlled custom headers, and optional Bearer or Basic authentication.

All generic outbound destinations must use public HTTPS. Local hosts, .local or .internal names, private or reserved IP addresses, redirects, unsafe methods, and invalid header names are rejected to reduce SSRF and credential-leak risk.

Test before relying on an automation

Send test uses an example form, entry, and response. A success message means the provider accepted that HTTP request; it does not prove that every downstream Zap, scenario, spreadsheet formula, or workflow completed.

After the test, submit the real published form once and verify both the local entry and the destination. Tests do not apply the form's entry condition, while real submissions do.

Monitor deliveries and retry failures

Real integration work is queued only after Free stores a valid, non-spam entry. Each integration and entry pair receives a stable idempotency key. Queue failure leaves the entry intact and creates an administrator warning.

Open Recent deliveries to review Provider, Form, Status, Attempts, redacted details, and actions.

Failed work uses the shared bounded retry policy, including a provider's safe Retry-After delay when available. When a delivery reaches Failed:

1. Correct the destination, OAuth connection, credentials, mapping, or provider problem.
2. Confirm that the remote service can safely accept the same idempotency key again.
3. Select Retry.
4. Recheck Recent deliveries and the destination.

Pausing an integration stops new jobs for it. Removing it requires confirmation, deletes its configuration and credentials, and retains existing delivery history.

Create a least-privilege API token

The external API is read-only and available under /wp-json/drecha-forms-pro/v1. Its scopes are:

• forms:read for paginated forms and field metadata.
• submissions:read for paginated, searchable entry data.
• submissions:export for a formula-safe CSV page.

1. Under Scoped API tokens, enter a recognizable Token label.
2. Select only the required permissions.
3. Choose Create token.
4. Copy the dfp_ token immediately; it is shown once and only its keyed hash is stored.
5. Send it as Authorization: Bearer YOUR_TOKEN over HTTPS.

Requests are limited to 120 per token per minute. List endpoints default to 20 items and cap per_page at 100. Use page, per_page, status, form_id, and search where the submissions endpoint supports them.

Review Last used and revoke a token as soon as its client is retired or a secret may have leaked. Revocation requires confirmation and takes effect immediately.

Free and Pro differences

Free always owns form rendering, validation, local entry storage, uploads, ordinary email, CSV export, and privacy tools. Pro adds the outbound providers, automation conditions, encrypted connection data, delivery history, integration retries, and scoped external API described here.

If Pro becomes inactive, new premium deliveries and external API authorization stop. Saved integration configuration and encrypted credentials remain stored, while Free forms and entries continue to work. Restoring Pro resumes eligible future work; it does not replay every submission that occurred while Pro was inactive.

Troubleshoot Pro integrations

A provider test succeeds but real entries do not arrive

Confirm that the integration is Active, assigned to the correct form, and its condition matches the validated stored values. Spam entries never create integration jobs.

Google Sheets or Slack choices are empty

Check the OAuth app credentials and redirect URI, reconnect the provider, then use Refresh choices. For Google worksheets, supply the spreadsheet ID when refreshing worksheet choices.

A public HTTPS endpoint is rejected

Confirm the provider host and URL path, DNS resolution, and HTTPS scheme. Private networks, redirects, and unsupported provider hosts are intentionally blocked.

An API request returns 401, 403, or 429

401 means a valid Bearer header was not supplied. 403 means the token is invalid, revoked, lacks the requested scope, or Pro access is inactive. 429 means the per-minute limit was reached; wait before retrying.

A retry may duplicate remote work

Use the X-Drecha-Forms-Idempotency-Key supplied by webhook and JSON deliveries to deduplicate on the receiver. Google Sheets and Slack also use their provider-specific idempotency mechanisms.