Overview
Every Formstack Documents document has a public merge URL, which you’ll find on the document’s Merge tab. By default, anyone who has the URL can send data to it and generate a merged document. If the URL is shared publicly or discovered by an automated bot, unexpected merges can happen.
You can restrict who can call your merge URLs in two ways: require an API key for the whole account, or restrict merges to specific IP addresses for individual documents. Both options also affect integrations that use the same URL, including Salesforce mappings, so read the notes below before enabling either one.
Option 1: Require an API key (account-wide)
Once enabled, every merge request to a public merge URL in your account must include your account’s API key and secret. Requests without them are rejected.
To enable:
- Go to Account → API → Advanced Settings.
- Turn on Require API Key for all merge requests.
- Save your changes.
Best for: Accounts that want to protect all documents at once.
Salesforce note: Salesforce mappings call the same merge URL, so they will continue to work only if the Salesforce integration is already sending the API key and secret saved in its settings. Confirm your Salesforce connection has the key and secret entered before turning this setting on, then test a merge from Salesforce afterward.
Option 2: Restrict merges by IP address (per document)
You can limit a single document so that it accepts merge requests only from IP addresses you approve.
To enable:
- Open the document and go to Advanced Settings.
- Find Restrict merges to specific IP address(es).
- Enter the IP address(es) allowed to merge this document.
- Save your changes.
Best for: Specific documents that are only ever called from known servers or networks.
Salesforce note: Once this is enabled, every caller that isn’t on the list is blocked, including Salesforce. To keep Salesforce mappings working, you must add the IP addresses Salesforce uses for its callouts to that document’s list.
Which option should I use?
| Require API key | Restrict by IP | |
|---|---|---|
| Scope | Entire account | One document at a time |
| Works with Salesforce mappings | Yes, if the API key and secret are saved in the Salesforce integration | Only if Salesforce’s callout IP addresses are on the document’s list |
| Best when | You want blanket protection | Callers come from known, fixed IPs |
You can use both together for added protection.
Frequently asked questions
Can I disable the public merge URL but keep my Salesforce mappings?
The public merge URL can’t be switched off on its own. Requiring an API key effectively makes it non-public while letting authenticated integrations like Salesforce continue to work.
How do I know if unexpected merges are happening?
Review your merge history for unfamiliar activity, such as a spike in volume or merges you didn’t initiate. If you see any, enable one of the options above and contact Support.
Need help?
Contact Intellistack Support and include the document ID(s) you’d like to secure.