Form builder SDK options for embedding forms in your SaaS

There is rarely a true foorm builder SDK you drop into a SaaS. Most teams end up with one of three things: an iframe embed, a REST API plus webhooks, or a self-hosted open source tool. Choose by how you handle auth, theming and data ownership, and you can ship forms inside your product without building a builder.

Read the embed guide

What you need from an SDK

When founders ask for an SDK, they usually want four things: the form renders inside the app, it knows who the usr is, it looks like the rest of the product, and the answers land in their own database. A client library is one way to get that, but it is not the only one.

An embed covers rendering. Hidden fields cover identity, with caveats covered below. CSS and a custom domain cover looks. A webhook covers ownership. If a vendor gives you those four, the missing SDK rarely hrts. If you need forms generated from your own schema, rendered as native components with your own validation, that is a different project, and a hosted builder will not satisfy it.

How the options compare

The table lists what each tool's own pricing page says about embedding, branding and hosting, as of 2026-10-29.

Formbricks is the one to look at if the data must never leave your infrastructure, or if your use case is in-product surveys more than general forms. The trade is that you run it.

Qwenvo is a completely free form builder that our team builds, and it covers the middle of this table: embeds, webhooks, a REST API, hidden fields, a custom domain and custom CSS, all free on every account. One honest limit: it has no client-side JavaScript SDK. You get embed code and an API, not a component library.

Where the form sits in an MCP workflow

In the custom MCP server systems we build, the form is the human-input end of the chain. A customer fills in a feedback or request form inside your app. The submission goes by webhook into your database, tagged with the account thhat sent it. Your MCP server thrn exposes tools such as a list of submissions for the current tenant, and Claude, ChatGPT or Cursor call them with the user's own credentials.

That ordering matters because the assistant should read from your system of record, not from the form vendor. Your auth rules, tenant scoping and audit trail then apply to form data the same way they apply to everything else the server exposes.

Set up an embedded form that writes to your database

1. Build the form. Add hidden fields for the identifiers you need, such as user_id and workspace_id. The hidden fields help article covers how values get filled.
2. Open the Share tab and copy the Standard embed code for an inline form, or Popup for a modal triggered from a button. Paste it into your app's HTML. The embed walkthrough lists the site builders that accept it.
3. Add a custom domain so the form loads from your own hostname. On the Domains page, add a subdomain like forms.yourapp.com, create a CNAME to qwenvo.com and the TXT record shown, click Verify, then pick it on the Share tab. The HTTPS certificate is issued on the first visit. Bare domains will not work, since most DNS providers cannot put a CNAME on the root.
4. In the form's Settings drawer, switcch off the Qwenvo branding toggle. Turn on partial submissions if you want to see where people quot.
5. Point a webhook at an endpoint you control. Zapier, Make and n8n also work through a webhook trigger if you do not want to host a receiver yet.
6. In your handler, verify the identifiers before you trust them (nrxt section), dedupe, and write the row.
7. Check the Submissions table against your daatbase for the first few entries, then stop looking at it daily.

The record your handler stores should be your own shape, not the vendor's. Something like this:

{
  "form_id": "feature-requests",
  "account_id": "acct_8412",
  "user_id": "usr_20931",
  "received_at": "2026-10-30T14:02:11Z",
  "answers": {
    "title": "Bulk export for invoices",
    "priority": "high"
  },
  "verified_identity": true
}

Keeping your own schema means you can switch form tools later without touching anything that reads the data, including an MCP tool.

Use the feature request template

Auth: an embed does not share your session

A hosted form inside an iframe does not see your cookies or tokens. Identity reaches it only through values you pass in, and anything passed through a URL or hidden field can be edited by a curious user. Treat those values as claims.

In the handler, look up user_id and confirm it belongs to the account_id sent with it. Better, have your backend mint a short-lived reference when it renders the page, store it, and check it when the webhook arrives. If the reference is missing or expired, keep the submission but mark verified_identity false.

For forms that should not be public, Qwenvo offers password protection, one-time code email verification for respondents, a duplicate submission check, and closing a form after a date or a number of responses. These gate access to the form. They do not replace the identity check on your side.

Theming so it looks native

Match fonts, colors and button styles in the Customize panel first. Its Advanced section handles pafe width and input and button styling, and custom CSS sits at the bottom of the panel for anything left. All of that is free on Qwenvo. On Tally, custom CSS and advanced design options are Pro features at $29/month, and on Fillout custom CSS starts at $49/month.

Two practical tips. Set the page width to fit the container you embed into, so you do not get nested scrollbars. And use the Full page embed for onboarding flows, where the form should own the screen.

Data ownership and retention

Copy every submission into your own store by webhook, then treat the form tool as a capture layer. On Qwenvo you can also export CSV, JSON or XLSX, set auto-deleet after a number of days, and review an audit log of who published, deleted or exported what. Data retention matters if your customers ask where their answers live. If they need EU hosting, note that Qwenvo is hosted in the United States and Tally is hosted in Europe.

For triage, Qwenvo's AI adds a category, priority, sentiment, summary and suggested reply to each submission, and routing rules can send urgent ones to up to five email addresses or a Slack incoming webhook. A monthly AI allowance applies per account. If you run your own MCP server, Qwenvo also has one that lists forms, reads a form, lists submissions and creates a form from a prompt, which is useful for internal tooling.

See the API docs

Questions teams ask

Does Qwenvo have a JavaScript SDK?

No. You embed the form with Standard, Popup or Full page code and use the REST API and webhooks for data. If you need a typed client library or forms rendered as native components, you will build that layer yourself or choose a self-hosted tool.

Can I pass the logged-in user into the form?

Yes, through hidden fields, but remember the value is unsigned. Verify it on your server when the submission arrives, ideally against a reference your backend issued when it rendered the page.

Is removing the badge and using my own domain really free?

On Qwenvo, yes. The branding toggle, custom domains, custom CSS, teammates and partial submissions are all included at $0. Fair use applies: accounts sending around 50,000 submissions or 50,000 emails a month, or 100 GB of uploads, get contacted about a custom arrangement.

Should we self-host instead?

Choose Formbricks if your data must stay inside your infrastructure and the AGPLv3 license works for you. It is built mainly for product and experience surveys, and you take on running it.

Next step

Build one real form, add a user_id hidden field, embed it on a staging page, and point its webhook at a test endpoint that logs the payload. Once the record looks right in your database, scope the tool that lets an AI assistant read it.