> ## Documentation Index
> Fetch the complete documentation index at: https://docs.submito.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Spam Protection

> How Submito protects your forms from spam and abuse.

## Built-in protection

Every Submito endpoint includes built-in spam protection — no configuration needed.

> [card] API key required
>
> Every submission must include a valid API key — anonymous abuse is blocked by default.

> [card] Quota enforcement
>
> Monthly quotas act as a natural cap against large-scale abuse.

> [card] Duplicate request protection
>
> Concurrent duplicate requests from the same API key are blocked automatically.

> [card] Payload size limit
>
> Non-JSON request bodies over 64KB are rejected before processing.

## What gets blocked

* Requests without a valid API key → `401`
* Requests with a revoked API key → `403`
* Requests after monthly quota is exceeded → `429`
* Non-JSON payloads over 64KB → `413`
* Malformed or empty request bodies → `400`
* Concurrent duplicate requests → `409`

## Tips for reducing spam

* **Don't expose your endpoint URL publicly** if possible — use a backend proxy
* **Add client-side validation** to catch obviously invalid submissions before they're sent
* **Use honeypot fields** — add a hidden input that humans won't fill but bots will:

```html theme={null}
<input type="text" name="_honey" style="display:none" tabindex="-1" autocomplete="off" />
```

Submito ignores fields prefixed with `_`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.