# Embed in your website or send through the API

> Embed a form in your own website with two lines, send answers through the API in your own site's design, or receive answers with a webhook.

Besides the hosted page, a published form can accept answers when it's embedded in a website or sent through the API (headless). You can copy the code from the form's **Share** tab.

## Embed in your website

On the **Share** tab, paste the two lines under **Embed in your website** where you want the form to appear.

```html
<div data-mukumo-form="PUBLIC_ID"></div>
<script src="https://app.mukumo.com/f/embed.js" async></script>
```

- The height adjusts to the content automatically.
- If you set a page to go to after sending, the whole page of your website goes there.
- When an answer is sent, a `mukumo-form:submitted` event fires on the `div`. Use it to connect measurement tags.
- To pass values from your website's URL (for example, `?utm_source=...`) to hidden values, write the keys on the `div`, like `data-hidden="utm_source,utm_campaign"`.

Where you can't add scripts (for example, some blog blocks), use the iframe code on the same tab. The height is fixed in this case.

## Send in your own site's design (API)

Keep your own site's form and make mukumo only the place it sends to.

- With an ordinary HTML form, set `action` to `https://app.mukumo.com/api/forms/PUBLIC_ID/submissions` and `method` to `post`. Make each field's `name` the same as its **Field keys** entry on the **Share** tab. After sending, the visitor goes to the page you set to go to after sending (or, if there isn't one, the hosted page's done screen).
- To send from JavaScript, `POST` JSON. When mukumo accepts the answer, it returns `201` with `{ "ok": true, "id": "…", "number": 12 }`. If the answer isn't valid, it returns `400`, and `fields` holds the reason for each field (`required` or `invalid`).
- You can read the form's fields with `GET https://app.mukumo.com/api/forms/PUBLIC_ID`.

To block automated submissions, add an empty field named `_hp` that people can't see. mukumo doesn't keep submissions where it's filled in.

## Limit which sites can use it

If you enter site URLs (for example, `https://example.com`) in **Sites that can embed and use the API** in Settings, only those sites can embed the form, and mukumo accepts API submissions from browsers only from those sites. When it's empty, any site can use it.

## Receive answers with a webhook

If you enter a destination URL (https) under **Webhook** in Settings, mukumo sends each answer to it as JSON whenever one arrives. The `X-Webhook-Signature` header (`t=timestamp,v1=signature`) holds the HMAC-SHA256 of `"timestamp.body"`, calculated with the **Signing secret** in Settings. If your calculation matches, the request came from mukumo.